Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CVEs (12,832)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2013-0334 3Bundler FedoraprojectOpensuse 3Bundler FedoraOpensuse May 6, 2026 Oct 31, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source.
CVE-2010-5077 3Ioquake3 OpenarenaTremulous 3Ioquake3 Engine OpenarenaTremulous May 6, 2026 Oct 27, 2014 N/A· v4 N/A· v3 7.8 HIGH· v2 server/sv_main.c in Quake3 Arena, as used in ioquake3 before r1762, OpenArena, Tremulous, and other products, allows remote attackers to cause a denial of service (network traffic amplification) via a spoofed (1) getstat...Show more server/sv_main.c in Quake3 Arena, as used in ioquake3 before r1762, OpenArena, Tremulous, and other products, allows remote attackers to cause a denial of service (network traffic amplification) via a spoofed (1) getstatus or (2) rcon request.Show less
CVE-2014-3955 1Freebsd 1Freebsd May 6, 2026 Oct 27, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 routed in FreeBSD 8.4 through 10.1-RC2 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via an RIP request from a source not on a directly connected network.
CVE-2014-0136 1Redhat 1Cloudforms 3.0 Management Engine May 6, 2026 Oct 27, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The (1) get and (2) log methods in the AgentController in Red Hat CloudForms 3.0 Management Engine (CFME) 5.x allow remote attackers to insert arbitrary text into log files via unspecified vectors.
CVE-2011-4953 1Cobbler Project 1Cobbler May 6, 2026 Oct 27, 2014 N/A· v4 N/A· v3 6.8 MEDIUM· v2 The set_mgmt_parameters function in item.py in cobbler before 2.2.2 allows context-dependent attackers to execute arbitrary code via vectors related to the use of the yaml.load function instead of the yaml.safe_load func...Show more The set_mgmt_parameters function in item.py in cobbler before 2.2.2 allows context-dependent attackers to execute arbitrary code via vectors related to the use of the yaml.load function instead of the yaml.safe_load function, as demonstrated using Puppet.Show less
CVE-2011-4104 1Djangoproject 1Tastypie May 6, 2026 Oct 27, 2014 N/A· v4 N/A· v3 7.5 HIGH· v2 The from_yaml method in serializers.py in Django Tastypie before 0.9.10 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.
CVE-2011-4103 1Djangoproject 1Piston May 6, 2026 Oct 27, 2014 N/A· v4 N/A· v3 7.5 HIGH· v2 emitters.py in Django Piston before 0.2.3 and 0.2.x before 0.2.2.1 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.
CVE-2014-3137 1Bottlepy 1Bottle May 6, 2026 Oct 25, 2014 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote attackers to bypass intended access restrictions via an accepted Content-Type follow...Show more Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote attackers to bypass intended access restrictions via an accepted Content-Type followed by a ; (semi-colon) and a Content-Type that would not be accepted, as demonstrated in YouCompleteMe to execute arbitrary code.Show less
CVE-2014-0476 2Canonical Chkrootkit 2Chkrootkit Ubuntu Linux May 6, 2026 Oct 25, 2014 N/A· v4 N/A· v3 3.7 LOW· v2 The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable. NOTE: this is only a vulnerability when /tmp is not mo...Show more The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable. NOTE: this is only a vulnerability when /tmp is not mounted with the noexec option.Show less
CVE-2014-1929 1Python Gnupg Project 1Python Gnupg May 6, 2026 Oct 25, 2014 N/A· v4 N/A· v3 4.4 MEDIUM· v2 python-gnupg 0.3.5 and 0.3.6 allows context-dependent attackers to have an unspecified impact via vectors related to "option injection through positional arguments." NOTE: this vulnerability exists because of an incomple...Show more python-gnupg 0.3.5 and 0.3.6 allows context-dependent attackers to have an unspecified impact via vectors related to "option injection through positional arguments." NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.Show less
CVE-2014-1928 1Python Gnupg Project 1Python Gnupg May 6, 2026 Oct 25, 2014 N/A· v4 N/A· v3 4.6 MEDIUM· v2 The shell_quote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated usin...Show more The shell_quote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "\" (backslash) characters to form multi-command sequences, a different vulnerability than CVE-2014-1927. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.Show less
CVE-2014-1927 1Python Gnupg Project 1Python Gnupg May 6, 2026 Oct 25, 2014 N/A· v4 N/A· v3 7.5 HIGH· v2 The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$...Show more The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$(" command-substitution sequences, a different vulnerability than CVE-2014-1928. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.Show less
CVE-2014-6611 1Blackberry 2Blackberry Os Blackberry World May 6, 2026 Oct 25, 2014 N/A· v4 N/A· v3 4.3 MEDIUM· v2 The BlackBerry World app before 5.0.0.262 on BlackBerry 10 OS 10.2.0, before 5.0.0.263 on BlackBerry 10 OS 10.2.1, and before 5.1.0.53 on BlackBerry 10 OS 10.3.0 does not properly validate download/update requests, which...Show more The BlackBerry World app before 5.0.0.262 on BlackBerry 10 OS 10.2.0, before 5.0.0.263 on BlackBerry 10 OS 10.2.1, and before 5.1.0.53 on BlackBerry 10 OS 10.3.0 does not properly validate download/update requests, which allows user-assisted man-in-the-middle attackers to spoof servers and trigger the download of a crafted app by modifying the client-server data stream.Show less
CVE-2014-6151 1Ibm 1Tivoli Integrated Portal May 6, 2026 Oct 25, 2014 N/A· v4 N/A· v3 3.5 LOW· v2 CRLF injection vulnerability in IBM Tivoli Integrated Portal (TIP) 2.2.x allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
CVE-2014-6230 1Wp Ban Project 1Wp Ban May 6, 2026 Oct 25, 2014 N/A· v4 N/A· v3 4.3 MEDIUM· v2 WP-Ban plugin before 1.6.4 for WordPress, when running in certain configurations, allows remote attackers to bypass the IP blacklist via a crafted X-Forwarded-For header.
CVE-2014-4840 1Ibm 1Tririga Application Platform May 6, 2026 Oct 19, 2014 N/A· v4 N/A· v3 7.5 HIGH· v2 IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote attackers to execute arbitrary code via a crafted URL.
CVE-2014-4833 1Ibm 1Qradar Security Information And Event Manager May 6, 2026 Oct 19, 2014 N/A· v4 N/A· v3 6.5 MEDIUM· v2 IBM Security QRadar SIEM QRM 7.1 MR1 and QRM/QVM 7.2 MR2 allows remote authenticated users to gain privileges via invalid input.
CVE-2014-4828 1Ibm 1Qradar Security Information And Event Manager May 6, 2026 Oct 19, 2014 N/A· v4 N/A· v3 4.3 MEDIUM· v2 IBM Security QRadar SIEM QRM 7.1 MR1 and QRM/QVM 7.2 MR2 allows remote attackers to conduct clickjacking attacks via a crafted HTTP request.
CVE-2014-3567 1Openssl 1Openssl May 6, 2026 Oct 19, 2014 N/A· v4 N/A· v3 7.1 HIGH· v2 Memory leak in the tls_decrypt_ticket function in t1_lib.c in OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service (memory consumption) via a crafted s...Show more Memory leak in the tls_decrypt_ticket function in t1_lib.c in OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service (memory consumption) via a crafted session ticket that triggers an integrity-check failure.Show less
CVE-2014-3513 1Openssl 1Openssl May 6, 2026 Oct 19, 2014 N/A· v4 N/A· v3 7.1 HIGH· v2 Memory leak in d1_srtp.c in the DTLS SRTP extension in OpenSSL 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service (memory consumption) via a crafted handshake message.

Previous 1...490491492...642 Next