Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CVEs (13,740)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2017-3800 1Cisco 1Email Security Appliance May 13, 2026 Jan 26, 2017 N/A· v4 5.8 MEDIUM· v3 5.0 MEDIUM· v2 A vulnerability in the content scanning engine of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an unauthenticated, remote attacker to bypass configured message or content filters on the de...Show more A vulnerability in the content scanning engine of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an unauthenticated, remote attacker to bypass configured message or content filters on the device. Affected Products: This vulnerability affects all releases prior to the first fixed release of Cisco AsyncOS Software for Cisco Email Security Appliances, both virtual and hardware appliances, if the software is configured to apply a message filter or content filter to incoming email attachments. The vulnerability is not limited to any specific rules or actions for a message filter or content filter. More Information: CSCuz16076. Known Affected Releases: 9.7.1-066 9.7.1-HP2-207 9.8.5-085. Known Fixed Releases: 10.0.1-083 10.0.1-087.Show less
CVE-2017-5371 1Sybase 1Adaptive Server Enterprise May 13, 2026 Jan 23, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Odata Server in SAP Adaptive Server Enterprise (ASE) 16 allows remote attackers to cause a denial of service (process crash) via a series of crafted requests, aka SAP Security Note 2330422.
CVE-2016-9385 2Citrix Xen 2Xen Xenserver May 13, 2026 Jan 23, 2017 N/A· v4 6.0 MEDIUM· v3 4.9 MEDIUM· v2 The x86 segment base write emulation functionality in Xen 4.4.x through 4.7.x allows local x86 PV guest OS administrators to cause a denial of service (host crash) by leveraging lack of canonical address checks.
CVE-2016-9383 2Citrix Xen 2Xen Xenserver May 13, 2026 Jan 23, 2017 N/A· v4 8.8 HIGH· v3 7.2 HIGH· v2 Xen, when running on a 64-bit hypervisor, allows local x86 guest OS users to modify arbitrary memory and consequently obtain sensitive information, cause a denial of service (host crash), or execute arbitrary code on the...Show more Xen, when running on a 64-bit hypervisor, allows local x86 guest OS users to modify arbitrary memory and consequently obtain sensitive information, cause a denial of service (host crash), or execute arbitrary code on the host by leveraging broken emulation of bit test instructions.Show less
CVE-2016-9380 2Citrix Xen 2Xen Xenserver May 13, 2026 Jan 23, 2017 N/A· v4 7.5 HIGH· v3 4.6 MEDIUM· v2 The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via NUL bytes in the bootloader confi...Show more The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via NUL bytes in the bootloader configuration file.Show less
CVE-2016-9379 2Citrix Xen 2Xen Xenserver May 13, 2026 Jan 23, 2017 N/A· v4 7.9 HIGH· v3 4.6 MEDIUM· v2 The pygrub boot loader emulator in Xen, when S-expression output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via string quotes and S-expressions in...Show more The pygrub boot loader emulator in Xen, when S-expression output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via string quotes and S-expressions in the bootloader configuration file.Show less
CVE-2016-6603 1Zohocorp 1Webnms Framework May 13, 2026 Jan 23, 2017 N/A· v4 9.8 CRITICAL· v3 5.0 MEDIUM· v2 ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP header.
CVE-2016-5119 1Keepass 1Keepass May 13, 2026 Jan 23, 2017 N/A· v4 7.5 HIGH· v3 5.1 MEDIUM· v2 The automatic update feature in KeePass 2.33 and earlier allows man-in-the-middle attackers to execute arbitrary code by spoofing the version check response and supplying a crafted update.
CVE-2016-4793 1Cakephp 1Cakephp May 13, 2026 Jan 23, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header.
CVE-2016-9436 3Opensuse Opensuse ProjectTats 3Leap LeapW3m May 13, 2026 Jan 20, 2017 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 parsetagx.c in w3m before 0.5.3+git20161009 does not properly initialize values, which allows remote attackers to crash the application via a crafted html file, related to a <i> tag.
CVE-2016-9435 3Opensuse Opensuse ProjectTats 3Leap LeapW3m May 13, 2026 Jan 20, 2017 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 The HTMLtagproc1 function in file.c in w3m before 0.5.3+git20161009 does not properly initialize values, which allows remote attackers to crash the application via a crafted html file, related to <dd> tags.
CVE-2014-9755 1Viprinet 1Multichannel Vpn Router 300 Firmware May 13, 2026 Jan 20, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The hardware VPN client in Viprinet MultichannelVPN Router 300 version 2013070830/2013080900 does not validate the remote VPN endpoint identity (through the checking of the endpoint's SSL key) before initiating the excha...Show more The hardware VPN client in Viprinet MultichannelVPN Router 300 version 2013070830/2013080900 does not validate the remote VPN endpoint identity (through the checking of the endpoint's SSL key) before initiating the exchange, which allows remote attackers to perform a replay attack.Show less
CVE-2014-9754 1Viprinet 1Multichannel Vpn Router 300 Firmware May 13, 2026 Jan 20, 2017 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 The hardware VPN client in Viprinet MultichannelVPN Router 300 version 2013070830/2013080900 does not validate the remote VPN endpoint identity (through the checking of the endpoint's SSL key) before initiating the excha...Show more The hardware VPN client in Viprinet MultichannelVPN Router 300 version 2013070830/2013080900 does not validate the remote VPN endpoint identity (through the checking of the endpoint's SSL key) before initiating the exchange, which allows an attacker to perform a Man in the Middle attack.Show less
CVE-2017-2576 1Moodle 1Moodle May 13, 2026 Jan 20, 2017 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 In Moodle 2.x and 3.x, there is incorrect sanitization of attributes in forums.
CVE-2016-7543 2Fedoraproject Gnu 2Bash Fedora May 13, 2026 Jan 19, 2017 N/A· v4 8.4 HIGH· v3 7.2 HIGH· v2 Bash before 4.4 allows local users to execute arbitrary commands with root privileges via crafted SHELLOPTS and PS4 environment variables.
CVE-2015-8212 1Netbsd 1Netbsd May 13, 2026 Jan 19, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 CGI handling flaw in bozohttpd in NetBSD 6.0 through 6.0.6, 6.1 through 6.1.5, and 7.0 allows remote attackers to execute arbitrary code via crafted arguments, which are handled by a non-CGI aware program.
CVE-2016-5222 1Google 1Chrome May 13, 2026 Jan 19, 2017 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Incorrect handling of invalid URLs in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HT...Show more Incorrect handling of invalid URLs in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.Show less
CVE-2016-5218 1Google 1Chrome May 13, 2026 Jan 19, 2017 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 The extensions API in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled navigation within PDFs, which allowed a remote attacker to temporarily spoof the cont...Show more The extensions API in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled navigation within PDFs, which allowed a remote attacker to temporarily spoof the contents of the Omnibox (URL bar) via a crafted HTML page containing PDF data.Show less
CVE-2016-5197 1Google 1Chrome May 13, 2026 Jan 19, 2017 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 The content view client in Google Chrome prior to 54.0.2840.85 for Android insufficiently validated intent URLs, which allowed a remote attacker who had compromised the renderer process to start arbitrary activity on the...Show more The content view client in Google Chrome prior to 54.0.2840.85 for Android insufficiently validated intent URLs, which allowed a remote attacker who had compromised the renderer process to start arbitrary activity on the system via a crafted HTML page.Show less
CVE-2016-9278 1Samsung 1Exynos Fimg2d Driver May 13, 2026 Jan 18, 2017 N/A· v4 5.5 MEDIUM· v3 4.9 MEDIUM· v2 The Samsung Exynos fimg2d driver for Android with Exynos 5433, 54xx, or 7420 chipsets allows local users to cause a denial of service (kernel panic) via a crafted ioctl command. The Samsung ID is SVE-2016-6736.

Previous 1...484485486...687 Next