← Back
CWE-20

12,832 CVEs • Abstraction: Class • Likelihood of Exploit: High

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

JSON object

Loading...

CVEs (12,832)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2014-3021
1Ibm
1Websphere Application Server
May 6, 2026
Oct 19, 2014
N/A· v4
N/A· v3
5.0 MEDIUM· v2
IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.35, 8.0 before 8.0.0.10, and 8.5 before 8.5.5.4 does not properly handle HTTP headers, which allows remote attackers to obtain sensitive cookie and authentication d...Show more
IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.35, 8.0 before 8.0.0.10, and 8.5 before 8.5.5.4 does not properly handle HTTP headers, which allows remote attackers to obtain sensitive cookie and authentication data via an unspecified HTTP method.Show less
CVE-2014-4443
1Apple
1Mac Os X
May 6, 2026
Oct 18, 2014
N/A· v4
N/A· v3
7.8 HIGH· v2
Apple OS X before 10.10 allows remote attackers to cause a denial of service (NULL pointer dereference) via crafted ASN.1 data.
CVE-2014-4442
1Apple
1Mac Os X
May 6, 2026
Oct 18, 2014
N/A· v4
N/A· v3
4.7 MEDIUM· v2
The kernel in Apple OS X before 10.10 allows local users to cause a denial of service (panic) via a message to a system control socket.
CVE-2014-4434
1Apple
1Mac Os X
May 6, 2026
Oct 18, 2014
N/A· v4
N/A· v3
4.9 MEDIUM· v2
The kernel in Apple OS X before 10.10 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted filename on an HFS filesystem.
CVE-2014-4417
1Apple
1Mac Os X
May 6, 2026
Oct 18, 2014
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Safari in Apple OS X before 10.10 allows remote attackers to cause a denial of service (universal Push Notification outage) via a web site that triggers an uncaught SafariNotificationAgent exception by providing a crafte...Show more
Safari in Apple OS X before 10.10 allows remote attackers to cause a denial of service (universal Push Notification outage) via a web site that triggers an uncaught SafariNotificationAgent exception by providing a crafted Push Notification.Show less
CVE-2014-3573
1Redhat
1Enterprise Virtualization Manager
May 6, 2026
Oct 18, 2014
N/A· v4
N/A· v3
6.5 MEDIUM· v2
The oVirt Engine backend module, as used in Red Hat Enterprise Virtualization Manager before 3.4.2, uses an "insecure DocumentBuilderFactory," which allows remote attackers to read arbitrary files or possibly have other...Show more
The oVirt Engine backend module, as used in Red Hat Enterprise Virtualization Manager before 3.4.2, uses an "insecure DocumentBuilderFactory," which allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted XML/RSDL document, related to an XML External Entity (XXE) issue.Show less
CVE-2014-2278
1Seeddms
1Seeddms
May 6, 2026
Oct 17, 2014
N/A· v4
N/A· v3
5.1 MEDIUM· v2
Unrestricted file upload vulnerability in op/op.AddFile2.php in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allows remote attackers to execute arbitrary code by uploading a file with an executable extension specifi...Show more
Unrestricted file upload vulnerability in op/op.AddFile2.php in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allows remote attackers to execute arbitrary code by uploading a file with an executable extension specified by the partitionIndex parameter and leveraging CVE-2014-2279.2 to access it via the directory specified by the fileId parameter.Show less
CVE-2014-8755
1Panasonic
1Network Camera View
May 6, 2026
Oct 17, 2014
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Panasonic Network Camera View 3 and 4 allows remote attackers to execute arbitrary code via a crafted page, which triggers an invalid pointer dereference, related to "the ability to nullify an arbitrary address in memory...Show more
Panasonic Network Camera View 3 and 4 allows remote attackers to execute arbitrary code via a crafted page, which triggers an invalid pointer dereference, related to "the ability to nullify an arbitrary address in memory."Show less
CVE-2014-8310
1Sap
1Businessobjects
May 6, 2026
Oct 16, 2014
N/A· v4
N/A· v3
7.1 HIGH· v2
The CMS CORBA listener in SAP BusinessObjects BI Edge 4.0 allows remote attackers to cause a denial of service (server shutdown) via crafted OSCAFactory::Session ORB message.
CVE-2014-3686
3Canonical
DebianW1.fi
4Debian Linux
HostapdUbuntu Linux+1 more
May 6, 2026
Oct 16, 2014
N/A· v4
N/A· v3
6.8 MEDIUM· v2
wpa_supplicant and hostapd 0.7.2 through 2.2, when running with certain configurations and using wpa_cli or hostapd_cli with action scripts, allows remote attackers to execute arbitrary commands via a crafted frame.
CVE-2014-4138
1Microsoft
1Internet Explorer
May 6, 2026
Oct 15, 2014
N/A· v4
N/A· v3
9.3 HIGH· v2
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a differe...Show more
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-4130 and CVE-2014-4132.Show less
CVE-2014-4134
1Microsoft
1Internet Explorer
May 6, 2026
Oct 15, 2014
N/A· v4
N/A· v3
9.3 HIGH· v2
Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVE-2014-4133
1Microsoft
1Internet Explorer
May 6, 2026
Oct 15, 2014
N/A· v4
N/A· v3
9.3 HIGH· v2
Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a di...Show more
Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-4137.Show less
CVE-2014-4132
1Microsoft
1Internet Explorer
May 6, 2026
Oct 15, 2014
N/A· v4
N/A· v3
9.3 HIGH· v2
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a differe...Show more
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-4130 and CVE-2014-4138.Show less
CVE-2014-4130
1Microsoft
1Internet Explorer
May 6, 2026
Oct 15, 2014
N/A· v4
N/A· v3
9.3 HIGH· v2
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a differe...Show more
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-4132 and CVE-2014-4138.Show less
CVE-2014-4129
1Microsoft
1Internet Explorer
May 6, 2026
Oct 15, 2014
N/A· v4
N/A· v3
9.3 HIGH· v2
Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVE-2014-4128
1Microsoft
1Internet Explorer
May 6, 2026
Oct 15, 2014
N/A· v4
N/A· v3
9.3 HIGH· v2
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVE-2014-4126
1Microsoft
1Internet Explorer
May 6, 2026
Oct 15, 2014
N/A· v4
N/A· v3
9.3 HIGH· v2
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVE-2014-4117
1Microsoft
5Office
Office Compatibility PackSharepoint Server+2 more
May 6, 2026
Oct 15, 2014
N/A· v4
N/A· v3
9.3 HIGH· v2
Microsoft Office 2007 SP3, Word 2007 SP3, Office 2010 SP1 and SP2, Word 2010 SP1 and SP2, Office for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP1 and SP2, and Word Web A...Show more
Microsoft Office 2007 SP3, Word 2007 SP3, Office 2010 SP1 and SP2, Word 2010 SP1 and SP2, Office for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP1 and SP2, and Word Web Apps 2010 Gold, SP1, and SP2 allow remote attackers to execute arbitrary code via crafted properties in a Word document, aka "Microsoft Word File Format Vulnerability."Show less
CVE-2014-3825
1Juniper
13Junos
Srx100Srx110+10 more
May 6, 2026
Oct 14, 2014
N/A· v4
N/A· v3
6.8 MEDIUM· v2
The Juniper SRX Series devices with Junos 11.4 before 11.4R12-S4, 12.1X44 before 12.1X44-D40, 12.1X45 before 12.1X45-D30, 12.1X46 before 12.1X46-D25, and 12.1X47 before 12.1X47-D10, when an Application Layer Gateway (ALG...Show more
The Juniper SRX Series devices with Junos 11.4 before 11.4R12-S4, 12.1X44 before 12.1X44-D40, 12.1X45 before 12.1X45-D30, 12.1X46 before 12.1X46-D25, and 12.1X47 before 12.1X47-D10, when an Application Layer Gateway (ALG) is enabled, allows remote attackers to cause a denial of service (flowd crash) via a crafted packet.Show less