Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CVEs (12,834)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2015-7748 1Juniper 1Junos May 6, 2026 Oct 19, 2015 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Juniper chassis with Trio (Trinity) chipset line cards and Junos OS 13.3 before 13.3R8, 14.1 before 14.1R6, 14.2 before 14.2R5, and 15.1 before 15.1R2 allow remote attackers to cause a denial of service (MPC line card cr...Show more Juniper chassis with Trio (Trinity) chipset line cards and Junos OS 13.3 before 13.3R8, 14.1 before 14.1R6, 14.2 before 14.2R5, and 15.1 before 15.1R2 allow remote attackers to cause a denial of service (MPC line card crash) via a crafted uBFD packet.Show less
CVE-2015-1808 2Jenkins Redhat 2Jenkins Openshift May 6, 2026 Oct 16, 2015 N/A· v4 N/A· v3 3.5 LOW· v2 Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users to cause a denial of service (improper plug-in and tool installation) via crafted update center data.
CVE-2015-6334 1Cisco 1Asr 5000 Software May 6, 2026 Oct 16, 2015 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Cisco ASR 5000 and 5500 devices with software 18.0.0.57828 and 19.0.M0.61045 allow remote attackers to cause a denial of service (vpnmgr process restart) via a crafted header in a TACACS packet, aka Bug ID CSCuw01984.
CVE-2015-7838 1Solarwinds 1Storage Manager May 6, 2026 Oct 15, 2015 N/A· v4 N/A· v3 10.0 HIGH· v2 ProcessFileUpload.jsp in SolarWinds Storage Manager before 6.2 allows remote attackers to upload and execute arbitrary files via unspecified vectors.
CVE-2015-6318 1Cisco 1Telepresence Video Communication Server Software May 6, 2026 Oct 12, 2015 N/A· v4 N/A· v3 6.9 MEDIUM· v2 Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.1 and X8.5.2 allows local users to write to arbitrary files via an unspecified symlink attack, aka Bug ID CSCuv11969.
CVE-2015-1047 1Vmware 1Vcenter Server May 6, 2026 Oct 12, 2015 N/A· v4 N/A· v3 5.0 MEDIUM· v2 vpxd in VMware vCenter Server 5.0 before u3e, 5.1 before u3, and 5.5 before u2 allows remote attackers to cause a denial of service via a long heartbeat message.
CVE-2015-1303 1Google 1Chrome May 6, 2026 Oct 12, 2015 N/A· v4 N/A· v3 7.5 HIGH· v2 bindings/core/v8/V8DOMWrapper.h in Blink, as used in Google Chrome before 45.0.2454.101, does not perform a rethrow action to propagate information about a cross-context exception, which allows remote attackers to bypass...Show more bindings/core/v8/V8DOMWrapper.h in Blink, as used in Google Chrome before 45.0.2454.101, does not perform a rethrow action to propagate information about a cross-context exception, which allows remote attackers to bypass the Same Origin Policy via a crafted HTML document containing an IFRAME element.Show less
CVE-2015-5235 3Fedoraproject OpensuseRedhat 7Enterprise Linux Desktop Enterprise Linux Hpc NodeEnterprise Linux Server+4 more May 6, 2026 Oct 9, 2015 N/A· v4 N/A· v3 4.3 MEDIUM· v2 IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to bypass the approval process or trick users into approving applet execution via...Show more IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to bypass the approval process or trick users into approving applet execution via a crafted web page.Show less
CVE-2015-5234 3Fedoraproject OpensuseRedhat 7Enterprise Linux Desktop Enterprise Linux Hpc NodeEnterprise Linux Server+4 more May 6, 2026 Oct 9, 2015 N/A· v4 N/A· v3 6.8 MEDIUM· v2 IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute...Show more IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks.Show less
CVE-2015-1337 2Canonical Simpestreams Project 2Simplestreams Ubuntu Linux May 6, 2026 Oct 9, 2015 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Simple Streams (simplestreams) does not properly verify the GPG signatures of disk image files, which allows remote mirror servers to spoof disk images and have unspecified other impact via a 403 (aka Forbidden) response...Show more Simple Streams (simplestreams) does not properly verify the GPG signatures of disk image files, which allows remote mirror servers to spoof disk images and have unspecified other impact via a 403 (aka Forbidden) response.Show less
CVE-2015-5883 1Apple 1Mac Os X May 6, 2026 Oct 9, 2015 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The bidirectional text-display and text-selection implementations in Terminal in Apple OS X before 10.11 interpret directional override formatting characters differently, which allows remote attackers to spoof the conten...Show more The bidirectional text-display and text-selection implementations in Terminal in Apple OS X before 10.11 interpret directional override formatting characters differently, which allows remote attackers to spoof the content of a text document via a crafted character sequence.Show less
CVE-2015-5828 2Apple Opensuse 2Leap Safari May 6, 2026 Oct 9, 2015 N/A· v4 N/A· v3 4.3 MEDIUM· v2 The API in the WebKit Plug-ins component in Apple Safari before 9 does not provide notification of an HTTP Redirection (aka 3xx) status code to a plugin, which allows remote attackers to bypass intended request restricti...Show more The API in the WebKit Plug-ins component in Apple Safari before 9 does not provide notification of an HTTP Redirection (aka 3xx) status code to a plugin, which allows remote attackers to bypass intended request restrictions via a crafted web site.Show less
CVE-2015-5780 1Apple 1Safari May 6, 2026 Oct 9, 2015 N/A· v4 N/A· v3 10.0 HIGH· v2 The Safari Extensions implementation in Apple Safari before 9 does not require user confirmation before replacing an installed extension, which has unspecified impact and attack vectors.
CVE-2015-6598 1Google 1Android May 6, 2026 Oct 6, 2015 N/A· v4 N/A· v3 10.0 HIGH· v2 libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23306638.
CVE-2015-7686 1Email Address Project 1Email Address May 6, 2026 Oct 6, 2015 N/A· v4 N/A· v3 7.8 HIGH· v2 Algorithmic complexity vulnerability in Address.pm in the Email-Address module 1.908 and earlier for Perl allows remote attackers to cause a denial of service (CPU consumption) via a crafted string containing a list of e...Show more Algorithmic complexity vulnerability in Address.pm in the Email-Address module 1.908 and earlier for Perl allows remote attackers to cause a denial of service (CPU consumption) via a crafted string containing a list of e-mail addresses in conjunction with parenthesis characters that can be associated with nested comments. NOTE: the default configuration in 1.908 mitigates this vulnerability but misparses certain realistic comments.Show less
CVE-2015-4992 1Ibm 1Sterling B2b Integrator May 6, 2026 Oct 6, 2015 N/A· v4 N/A· v3 3.5 LOW· v2 IBM Sterling B2B Integrator 5.2 before 5020500_8 allows remote authenticated users to conduct clickjacking attacks via unspecified vectors.
CVE-2014-9751 4Debian NtpOracle+1 more 6Debian Linux Enterprise Linux DesktopEnterprise Linux Server+3 more May 6, 2026 Oct 6, 2015 N/A· v4 N/A· v3 6.8 MEDIUM· v2 The read_network_packet function in ntp_io.c in ntpd in NTP 4.x before 4.2.8p1 on Linux and OS X does not properly determine whether a source IP address is an IPv6 loopback address, which makes it easier for remote attac...Show more The read_network_packet function in ntp_io.c in ntpd in NTP 4.x before 4.2.8p1 on Linux and OS X does not properly determine whether a source IP address is an IPv6 loopback address, which makes it easier for remote attackers to spoof restricted packets, and read or write to the runtime state, by leveraging the ability to reach the ntpd machine's network interface with a packet from the ::1 address.Show less
CVE-2014-9750 4Debian NtpOracle+1 more 6Debian Linux Enterprise Linux DesktopEnterprise Linux Server+3 more May 6, 2026 Oct 6, 2015 N/A· v4 N/A· v3 5.8 MEDIUM· v2 ntp_crypto.c in ntpd in NTP 4.x before 4.2.8p1, when Autokey Authentication is enabled, allows remote attackers to obtain sensitive information from process memory or cause a denial of service (daemon crash) via a packet...Show more ntp_crypto.c in ntpd in NTP 4.x before 4.2.8p1, when Autokey Authentication is enabled, allows remote attackers to obtain sensitive information from process memory or cause a denial of service (daemon crash) via a packet containing an extension field with an invalid value for the length of its value field.Show less
CVE-2015-6602 1Google 1Android May 6, 2026 Oct 2, 2015 N/A· v4 N/A· v3 9.3 HIGH· v2 libutils in Android through 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted metadata in a (1) MP3 or (2) MP4 file, as demonstrated by an attack against use of libutils by libstagefright in Andr...Show more libutils in Android through 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted metadata in a (1) MP3 or (2) MP4 file, as demonstrated by an attack against use of libutils by libstagefright in Android 5.x.Show less
CVE-2015-3876 1Google 1Android May 6, 2026 Oct 2, 2015 N/A· v4 N/A· v3 9.3 HIGH· v2 libstagefright in Android through 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted metadata in a (1) MP3 or (2) MP4 file.

Previous 1...471472473...642 Next