Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CVEs (13,740)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2016-8277 1Huawei 3Usg9520 Usg9560Usg9580 May 6, 2026 Oct 3, 2016 N/A· v4 6.5 MEDIUM· v3 6.8 MEDIUM· v2 Huawei USG9520, USG9560, and USG9580 unified security gateways with software before V300R001C01SPCa00 allow remote authenticated users to cause a denial of service (device restart) via an unspecified command parameter.
CVE-2016-1244 2Debian Unadf Project 2Debian Linux Unadf May 6, 2026 Oct 3, 2016 N/A· v4 8.8 HIGH· v3 9.3 HIGH· v2 The extractTree function in unADF allows remote attackers to execute arbitrary code via shell metacharacters in a directory name in an adf file.
CVE-2016-1240 1Apache 1Tomcat May 6, 2026 Oct 3, 2016 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the tomcat6 and libtomcat6-java packages before 6.0.35-1ubuntu3.8 on Ubuntu 12.04 LTS,...Show more The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the tomcat6 and libtomcat6-java packages before 6.0.35-1ubuntu3.8 on Ubuntu 12.04 LTS, the tomcat7 and libtomcat7-java packages before 7.0.52-1ubuntu0.7 on Ubuntu 14.04 LTS, and tomcat8 and libtomcat8-java packages before 8.0.32-1ubuntu1.2 on Ubuntu 16.04 LTS allows local users with access to the tomcat account to gain root privileges via a symlink attack on the Catalina log file, as demonstrated by /var/log/tomcat7/catalina.out.Show less
CVE-2016-2776 3Hp IscOracle 5Bind Hp UxLinux+2 more May 6, 2026 Sep 28, 2016 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x before 9.11.0rc3 does not properly construct responses, which allows remote attackers to cause a denial of service (assertion failure a...Show more buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x before 9.11.0rc3 does not properly construct responses, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted query.Show less
CVE-2016-6305 1Openssl 1Openssl May 6, 2026 Sep 26, 2016 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The ssl3_read_bytes function in record/rec_layer_s3.c in OpenSSL 1.1.0 before 1.1.0a allows remote attackers to cause a denial of service (infinite loop) by triggering a zero-length record in an SSL_peek call.
CVE-2016-6901 1Huawei 2Ar Firmware Netengine 16ex Firmware May 6, 2026 Sep 26, 2016 N/A· v4 6.5 MEDIUM· v3 6.8 MEDIUM· v2 Format string vulnerability in Huawei AR100, AR120, AR150, AR200, AR500, AR550, AR1200, AR2200, AR2500, AR3200, and AR3600 routers with software before V200R007C00SPC900 and NetEngine 16EX routers with software before V2...Show more Format string vulnerability in Huawei AR100, AR120, AR150, AR200, AR500, AR550, AR1200, AR2200, AR2500, AR3200, and AR3600 routers with software before V200R007C00SPC900 and NetEngine 16EX routers with software before V200R007C00SPC900 allows remote authenticated users to cause a denial of service via format string specifiers in vectors involving partial commands.Show less
CVE-2016-6153 3Fedoraproject OpensuseSqlite 3Fedora LeapSqlite May 6, 2026 Sep 26, 2016 N/A· v4 5.9 MEDIUM· v3 4.6 MEDIUM· v2 os_unix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which might allow local users to obtain sensitive information, cause a denial of service (application crash), or have unsp...Show more os_unix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which might allow local users to obtain sensitive information, cause a denial of service (application crash), or have unspecified other impact by leveraging use of the current working directory for temporary files.Show less
CVE-2016-4972 1Openstack 4Mitaka Murano MuranoMurano Dashboard+1 more May 6, 2026 Sep 26, 2016 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), and python-muranoclient before 0.7.3 (liberty) and 0.8.x before 0.8.5 (mitaka)...Show more OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), and python-muranoclient before 0.7.3 (liberty) and 0.8.x before 0.8.5 (mitaka) improperly use loaders inherited from yaml.Loader when parsing MuranoPL and UI files, which allows remote attackers to create arbitrary Python objects and execute arbitrary code via crafted extended YAML tags in UI definitions in packages.Show less
CVE-2016-7162 2Canonical File Roller Project 2File Roller Ubuntu Linux May 6, 2026 Sep 26, 2016 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The _g_file_remove_directory function in file-utils.c in File Roller 3.5.4 through 3.20.2 allows remote attackers to delete arbitrary files via a symlink attack on a folder in an archive.
CVE-2016-3110 2Fedoraproject Redhat 3Fedora Jboss Enterprise Application PlatformJboss Enterprise Web Server May 6, 2026 Sep 26, 2016 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 mod_cluster, as used in Red Hat JBoss Web Server 2.1, allows remote attackers to cause a denial of service (Apache http server crash) via an MCMP message containing a series of = (equals) characters after a legitimate el...Show more mod_cluster, as used in Red Hat JBoss Web Server 2.1, allows remote attackers to cause a denial of service (Apache http server crash) via an MCMP message containing a series of = (equals) characters after a legitimate element.Show less
CVE-2016-5947 1Ibm 2Spectrum Control Tivoli Storage Productivity Center May 6, 2026 Sep 26, 2016 N/A· v4 5.7 MEDIUM· v3 3.5 LOW· v2 IBM Spectrum Control (formerly Tivoli Storage Productivity Center) 5.2.x before 5.2.11 allows remote authenticated users to conduct clickjacking attacks via a crafted web site.
CVE-2016-3000 1Ibm 1Connections May 6, 2026 Sep 26, 2016 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 The help service in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to cause a denial of service (service degradation) via a crafted URL.
CVE-2016-5174 1Google 1Chrome May 6, 2026 Sep 25, 2016 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 browser/ui/cocoa/browser_window_controller_private.mm in Google Chrome before 53.0.2785.113 does not process fullscreen toggle requests during a fullscreen transition, which allows remote attackers to cause a denial of s...Show more browser/ui/cocoa/browser_window_controller_private.mm in Google Chrome before 53.0.2785.113 does not process fullscreen toggle requests during a fullscreen transition, which allows remote attackers to cause a denial of service (unsuppressed popup) via a crafted web site.Show less
CVE-2016-4753 1Apple 4Iphone Os Mac Os XTvos+1 more May 6, 2026 Sep 25, 2016 N/A· v4 7.8 HIGH· v3 9.3 HIGH· v2 Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 mishandle signed disk images, which allows attackers to execute arbitrary code in a privileged context via a crafted app.
CVE-2016-4728 1Apple 4Iphone Os ItunesSafari+1 more May 6, 2026 Sep 25, 2016 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 mishandles error prototypes, which allows remote attackers to execute arbitrary code via a crafted web site.
CVE-2016-4722 1Apple 2Iphone Os Mac Os X May 6, 2026 Sep 25, 2016 N/A· v4 5.9 MEDIUM· v3 7.1 HIGH· v2 The IDS - Connectivity component in Apple iOS before 10 and OS X before 10.12 allows man-in-the-middle attackers to conduct Call Relay spoofing attacks and cause a denial of service via unspecified vectors.
CVE-2016-4711 1Apple 2Iphone Os Mac Os X May 6, 2026 Sep 25, 2016 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 CCrypt in corecrypto in CommonCrypto in Apple iOS before 10 and OS X before 10.12 allows attackers to discover cleartext information by leveraging a function call that specifies the same buffer for input and output.
CVE-2016-4706 1Apple 1Mac Os X May 6, 2026 Sep 25, 2016 N/A· v4 5.5 MEDIUM· v3 4.9 MEDIUM· v2 cd9660 in Apple OS X before 10.12 allows local users to cause a denial of service via unspecified vectors.
CVE-2016-4701 1Apple 1Mac Os X May 6, 2026 Sep 25, 2016 N/A· v4 6.2 MEDIUM· v3 2.1 LOW· v2 Application Firewall in Apple OS X before 10.12 allows local users to cause a denial of service via vectors involving a crafted SO_EXECPATH environment variable.
CVE-2016-4698 1Apple 2Iphone Os Mac Os X May 6, 2026 Sep 25, 2016 N/A· v4 7.8 HIGH· v3 9.3 HIGH· v2 AppleMobileFileIntegrity in Apple iOS before 10 and OS X before 10.12 mishandles process entitlement and Team ID values in the task port inheritance policy, which allows attackers to execute arbitrary code in a privilege...Show more AppleMobileFileIntegrity in Apple iOS before 10 and OS X before 10.12 mishandles process entitlement and Team ID values in the task port inheritance policy, which allows attackers to execute arbitrary code in a privileged context via a crafted app.Show less

Previous 1...491492493...687 Next