Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CVEs (12,832)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2014-8789 1Gleamtech 1Filevista May 6, 2026 Dec 2, 2014 N/A· v4 N/A· v3 6.5 MEDIUM· v2 GleamTech FileVista before 6.1 allows remote authenticated users to create arbitrary files and possibly execute arbitrary code via a crafted path in a zip archive, which is not properly handled during extraction.
CVE-2014-7178 1Enalean 1Tuleap May 6, 2026 Nov 28, 2014 N/A· v4 N/A· v3 9.3 HIGH· v2 Enalean Tuleap before 7.5.99.6 allows remote attackers to execute arbitrary commands via the User-Agent header, which is provided to the passthru PHP function.
CVE-2014-9093 4Canonical DebianFedoraproject+1 more 4Debian Linux FedoraLibreoffice+1 more May 6, 2026 Nov 26, 2014 N/A· v4 N/A· v3 7.5 HIGH· v2 LibreOffice before 4.3.5 allows remote attackers to cause a denial of service (invalid write operation and crash) and possibly execute arbitrary code via a crafted RTF file.
CVE-2014-7142 3Canonical OracleSquid Cache 3Solaris SquidUbuntu Linux May 6, 2026 Nov 26, 2014 N/A· v4 N/A· v3 6.4 MEDIUM· v2 The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a crafted (1) ICMP or (2) ICMP6 packet size.
CVE-2014-6609 1Digium 1Asterisk May 6, 2026 Nov 26, 2014 N/A· v4 N/A· v3 4.0 MEDIUM· v2 The res_pjsip_pubsub module in Asterisk Open Source 12.x before 12.5.1 allows remote authenticated users to cause a denial of service (crash) via crafted headers in a SIP SUBSCRIBE request for an event package.
CVE-2014-2037 1Xelerance 1Openswan May 6, 2026 Nov 26, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Openswan 2.6.40 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets that lack expected payloads. NOTE: this vulnerability exists because of an incompl...Show more Openswan 2.6.40 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets that lack expected payloads. NOTE: this vulnerability exists because of an incomplete fix for CVE 2013-6466.Show less
CVE-2014-9038 1Wordpress 1Wordpress May 6, 2026 Nov 25, 2014 N/A· v4 N/A· v3 6.4 MEDIUM· v2 wp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to conduct server-side request forgery (SSRF) attacks by referring to a 127.0.0.0/8 res...Show more wp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to conduct server-side request forgery (SSRF) attacks by referring to a 127.0.0.0/8 resource.Show less
CVE-2014-8420 1Sonicwall 3Analyzer Global Management SystemUma Em5000 May 6, 2026 Nov 25, 2014 N/A· v4 N/A· v3 9.0 HIGH· v2 The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2, SonicWALL Analyzer before 7.2 SP2, and SonicWALL UMA before 7.2 SP2 allows remote authenticated users to execute arbitrary co...Show more The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2, SonicWALL Analyzer before 7.2 SP2, and SonicWALL UMA before 7.2 SP2 allows remote authenticated users to execute arbitrary code via unspecified vectors.Show less
CVE-2014-7839 1Redhat 1Resteasy May 6, 2026 Nov 25, 2014 N/A· v4 N/A· v3 6.4 MEDIUM· v2 DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the (1) external-general-entities or (2) external-parameter-entities features, which allows remote attackers to conduct XML external entity (XXE) attacks vi...Show more DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the (1) external-general-entities or (2) external-parameter-entities features, which allows remote attackers to conduct XML external entity (XXE) attacks via unspecified vectors.Show less
CVE-2014-9030 3Debian OpensuseXen 3Debian Linux OpensuseXen May 6, 2026 Nov 24, 2014 N/A· v4 N/A· v3 7.1 HIGH· v2 The do_mmu_update function in arch/x86/mm.c in Xen 3.2.x through 4.4.x does not properly manage page references, which allows remote domains to cause a denial of service by leveraging control over an HVM guest and a craf...Show more The do_mmu_update function in arch/x86/mm.c in Xen 3.2.x through 4.4.x does not properly manage page references, which allows remote domains to cause a denial of service by leveraging control over an HVM guest and a crafted MMU_MACHPHYS_UPDATE.Show less
CVE-2014-8416 1Digium 1Asterisk May 6, 2026 Nov 24, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Use-after-free vulnerability in the PJSIP channel driver in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1, when using the res_pjsip_refer module, allows remote attackers to cause a denial of service (cra...Show more Use-after-free vulnerability in the PJSIP channel driver in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1, when using the res_pjsip_refer module, allows remote attackers to cause a denial of service (crash) via an in-dialog INVITE with Replaces message, which triggers the channel to be hung up.Show less
CVE-2014-8415 1Digium 1Asterisk May 6, 2026 Nov 24, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Race condition in the chan_pjsip channel driver in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1 allows remote attackers to cause a denial of service (assertion failure and crash) via a cancel request fo...Show more Race condition in the chan_pjsip channel driver in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1 allows remote attackers to cause a denial of service (assertion failure and crash) via a cancel request for a SIP session with a queued action to (1) answer a session or (2) send ringing.Show less
CVE-2014-7821 3Fedoraproject OpenstackRedhat 3Fedora NeutronOpenstack May 6, 2026 Nov 24, 2014 N/A· v4 N/A· v3 4.0 MEDIUM· v2 OpenStack Neutron before 2014.1.4 and 2014.2.x before 2014.2.1 allows remote authenticated users to cause a denial of service (crash) via a crafted dns_nameservers value in the DNS configuration.
CVE-2014-7817 4Canonical DebianGnu+1 more 4Debian Linux GlibcOpensuse+1 more May 6, 2026 Nov 24, 2014 N/A· v4 N/A· v3 4.6 MEDIUM· v2 The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrated by input containing "$((`...`))".
CVE-2014-9060 1Moodle 1Moodle May 6, 2026 Nov 24, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not properly restrict the parameters used in a return URL, which allows remote attackers to trigger the generat...Show more The LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not properly restrict the parameters used in a return URL, which allows remote attackers to trigger the generation of arbitrary messages via a modified URL, related to mod/lti/locallib.php and mod/lti/return.php.Show less
CVE-2014-8594 3Debian OpensuseXen 3Debian Linux OpensuseXen May 6, 2026 Nov 19, 2014 N/A· v4 N/A· v3 5.4 MEDIUM· v2 The do_mmu_update function in arch/x86/mm.c in Xen 4.x through 4.4.x does not properly restrict updates to only PV page tables, which allows remote PV guests to cause a denial of service (NULL pointer dereference) by lev...Show more The do_mmu_update function in arch/x86/mm.c in Xen 4.x through 4.4.x does not properly restrict updates to only PV page tables, which allows remote PV guests to cause a denial of service (NULL pointer dereference) by leveraging hardware emulation services for HVM guests using Hardware Assisted Paging (HAP).Show less
CVE-2014-7899 1Google 1Chrome May 6, 2026 Nov 19, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Google Chrome before 38.0.2125.101 allows remote attackers to spoof the address bar by placing a blob: substring at the beginning of the URL, followed by the original URI scheme and a long username string.
CVE-2014-7146 1Mantisbt 1Mantisbt May 6, 2026 Nov 18, 2014 N/A· v4 N/A· v3 7.5 HIGH· v2 The XmlImportExport plugin in MantisBT 1.2.17 and earlier allows remote attackers to execute arbitrary PHP code via a crafted (1) description field or (2) issuelink attribute in an XML file, which is not properly handled...Show more The XmlImportExport plugin in MantisBT 1.2.17 and earlier allows remote attackers to execute arbitrary PHP code via a crafted (1) description field or (2) issuelink attribute in an XML file, which is not properly handled when executing the preg_replace function with the e modifier.Show less
CVE-2014-4461 1Apple 3Iphone Os Mac Os XTvos May 6, 2026 Nov 18, 2014 N/A· v4 N/A· v3 9.3 HIGH· v2 The kernel in Apple iOS before 8.1.1 and Apple TV before 7.0.2 does not properly validate IOSharedDataQueue object metadata, which allows attackers to execute arbitrary code in a privileged context via a crafted applicat...Show more The kernel in Apple iOS before 8.1.1 and Apple TV before 7.0.2 does not properly validate IOSharedDataQueue object metadata, which allows attackers to execute arbitrary code in a privileged context via a crafted application.Show less
CVE-2014-6105 1Ibm 1Security Identity Manager May 6, 2026 Nov 18, 2014 N/A· v4 N/A· v3 4.3 MEDIUM· v2 IBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to conduct clickjacking attacks via unspecified vectors.

Previous 1...488489490...642 Next