Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CVEs (12,815)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2014-3308 1Cisco 8Asr 9000 Rsp440 Router Asr 9001Asr 9006+5 more May 6, 2026 Jul 7, 2014 N/A· v4 N/A· v3 6.4 MEDIUM· v2 Cisco IOS XR on Trident line cards in ASR 9000 devices lacks a static punt policer, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted packets, aka Bug ID CSCun83985.
CVE-2014-0868 1Ibm 2Algo Credit Limits Algorithmics May 6, 2026 Jul 7, 2014 N/A· v4 N/A· v3 4.9 MEDIUM· v2 RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics relies on client-side input validation, which allows remote authenticated users to bypass intended dual-control restr...Show more RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics relies on client-side input validation, which allows remote authenticated users to bypass intended dual-control restrictions and modify data via a crafted XML document, as demonstrated by manipulation of read-only limit data.Show less
CVE-2014-0865 1Ibm 2Algo Credit Limits Algorithmics May 6, 2026 Jul 7, 2014 N/A· v4 N/A· v3 4.9 MEDIUM· v2 RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics relies on client-side input validation, which allows remote authenticated users to bypass intended dual-control restr...Show more RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics relies on client-side input validation, which allows remote authenticated users to bypass intended dual-control restrictions and modify data via crafted serialized objects, as demonstrated by limit manipulations.Show less
CVE-2014-4611 1Linux 1Linux Kernel May 6, 2026 Jul 3, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Integer overflow in the LZ4 algorithm implementation, as used in Yann Collet LZ4 before r118 and in the lz4_uncompress function in lib/lz4/lz4_decompress.c in the Linux kernel before 3.15.2, on 32-bit platforms might all...Show more Integer overflow in the LZ4 algorithm implementation, as used in Yann Collet LZ4 before r118 and in the lz4_uncompress function in lib/lz4/lz4_decompress.c in the Linux kernel before 3.15.2, on 32-bit platforms might allow context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted Literal Run that would be improperly handled by programs not complying with an API limitation, a different vulnerability than CVE-2014-4715.Show less
CVE-2014-3890 1Silex 1Sx 2000wg Firmware May 6, 2026 Jul 2, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 silex SX-2000WG devices with firmware before 1.5.4 allow remote attackers to cause a denial of service (connectivity outage) via a crafted IP packet, a different vulnerability than CVE-2014-3889.
CVE-2014-3889 1Silex 1Sx 2000wg Firmware May 6, 2026 Jul 2, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 silex SX-2000WG devices with firmware before 1.5.4 allow remote attackers to cause a denial of service (connectivity outage) via crafted data in the Options field of a TCP header, a different vulnerability than CVE-2014-...Show more silex SX-2000WG devices with firmware before 1.5.4 allow remote attackers to cause a denial of service (connectivity outage) via crafted data in the Options field of a TCP header, a different vulnerability than CVE-2014-3890.Show less
CVE-2014-1369 1Apple 1Safari May 6, 2026 Jul 1, 2014 N/A· v4 N/A· v3 4.3 MEDIUM· v2 WebKit in Apple Safari before 6.1.5 and 7.x before 7.0.5 allows user-assisted remote attackers to access file: URLs by leveraging a URL drag operation that originates at a crafted web site.
CVE-2014-1360 1Apple 1Iphone Os May 6, 2026 Jul 1, 2014 N/A· v4 N/A· v3 2.1 LOW· v2 Lockdown in Apple iOS before 7.1.2 does not properly verify data from activation servers, which makes it easier for physically proximate attackers to bypass the Activation Lock protection mechanism via unspecified vector...Show more Lockdown in Apple iOS before 7.1.2 does not properly verify data from activation servers, which makes it easier for physically proximate attackers to bypass the Activation Lock protection mechanism via unspecified vectors.Show less
CVE-2014-4617 3Debian GnupgOpensuse 3Debian Linux GnupgOpensuse May 6, 2026 Jun 25, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The do_uncompress function in g10/compress.c in GnuPG 1.x before 1.4.17 and 2.x before 2.0.24 allows context-dependent attackers to cause a denial of service (infinite loop) via malformed compressed packets, as demonstra...Show more The do_uncompress function in g10/compress.c in GnuPG 1.x before 1.4.17 and 2.x before 2.0.24 allows context-dependent attackers to cause a denial of service (infinite loop) via malformed compressed packets, as demonstrated by an a3 01 5b ff byte sequence.Show less
CVE-2014-3299 1Cisco 1Ios May 6, 2026 Jun 25, 2014 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Cisco IOS allows remote authenticated users to cause a denial of service (device reload) via malformed IPsec packets, aka Bug ID CSCui79745.
CVE-2014-0244 1Samba 1Samba May 6, 2026 Jun 23, 2014 N/A· v4 N/A· v3 3.3 LOW· v2 The sys_recvfrom function in nmbd in Samba 3.6.x before 3.6.24, 4.0.x before 4.0.19, and 4.1.x before 4.1.9 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a malformed UDP pac...Show more The sys_recvfrom function in nmbd in Samba 3.6.x before 3.6.24, 4.0.x before 4.0.19, and 4.1.x before 4.1.9 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a malformed UDP packet.Show less
CVE-2014-2779 1Microsoft 1Malware Protection Engine May 6, 2026 Jun 18, 2014 N/A· v4 N/A· v3 4.3 MEDIUM· v2 mpengine.dll in Microsoft Malware Protection Engine before 1.1.10701.0 allows remote attackers to cause a denial of service (system hang) via a crafted file.
CVE-2014-0478 1Debian 1Advanced Package Tool May 6, 2026 Jun 17, 2014 N/A· v4 N/A· v3 4.0 MEDIUM· v2 APT before 1.0.4 does not properly validate source packages, which allows man-in-the-middle attackers to download and install Trojan horse packages by removing the Release signature.
CVE-2014-2003 1Justsystems 2Ichitaro Just Online Update May 6, 2026 Jun 16, 2014 N/A· v4 N/A· v3 7.6 HIGH· v2 JustSystems JUST Online Update, as used in Ichitaro through 2014 and other products, does not properly validate signatures of update modules, which allows remote attackers to spoof modules and execute arbitrary code via...Show more JustSystems JUST Online Update, as used in Ichitaro through 2014 and other products, does not properly validate signatures of update modules, which allows remote attackers to spoof modules and execute arbitrary code via a crafted signature.Show less
CVE-2014-3814 1Juniper 3Netscreen 5200 Netscreen 5400Screenos May 6, 2026 Jun 13, 2014 N/A· v4 N/A· v3 7.8 HIGH· v2 The Juniper Networks NetScreen Firewall devices with ScreenOS before 6.3r17, when configured to use the internal DNS lookup client, allows remote attackers to cause a denial of service (crash and reboot) via a sequence o...Show more The Juniper Networks NetScreen Firewall devices with ScreenOS before 6.3r17, when configured to use the internal DNS lookup client, allows remote attackers to cause a denial of service (crash and reboot) via a sequence of malformed packets to the device IP.Show less
CVE-2013-2163 1Monkey Project 1Monkey May 6, 2026 Jun 13, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Monkey HTTP Daemon (monkeyd) before 1.2.2 allows remote attackers to cause a denial of service (infinite loop) via an offset equal to the file size in the Range HTTP header.
CVE-2014-3859 1Isc 1Bind May 6, 2026 Jun 13, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 libdns in ISC BIND 9.10.0 before P2 does not properly handle EDNS options, which allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a crafted packet, as demonstrated by a...Show more libdns in ISC BIND 9.10.0 before P2 does not properly handle EDNS options, which allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a crafted packet, as demonstrated by an attack against named, dig, or delv.Show less
CVE-2014-1539 1Mozilla 2Firefox Thunderbird May 6, 2026 Jun 11, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Mozilla Firefox before 30.0 and Thunderbird through 24.6 on OS X do not ensure visibility of the cursor after interaction with a Flash object and a DIV element, which makes it easier for remote attackers to conduct click...Show more Mozilla Firefox before 30.0 and Thunderbird through 24.6 on OS X do not ensure visibility of the cursor after interaction with a Flash object and a DIV element, which makes it easier for remote attackers to conduct clickjacking attacks via JavaScript code that produces a fake cursor image.Show less
CVE-2014-1818 1Microsoft 9Windows 7 Windows 8Windows 8.1+6 more May 6, 2026 Jun 11, 2014 N/A· v4 N/A· v3 9.3 HIGH· v2 GDI+ in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Office 2007 SP3 and 2010...Show more GDI+ in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Office 2007 SP3 and 2010 SP1 and SP2, Live Meeting 2007 Console, Lync 2010 and 2013, Lync 2010 Attendee, and Lync Basic 2013 allows remote attackers to execute arbitrary code via a crafted EMF+ record in an image file, aka "GDI+ Image Parsing Vulnerability."Show less
CVE-2014-3880 1Freebsd 1Freebsd May 6, 2026 Jun 10, 2014 N/A· v4 N/A· v3 4.9 MEDIUM· v2 The (1) execve and (2) fexecve system calls in the FreeBSD kernel 8.4 before p11, 9.1 before p14, 9.2 before p7, and 10.0 before p4 destroys the virtual memory address space and mappings for a process before all threads...Show more The (1) execve and (2) fexecve system calls in the FreeBSD kernel 8.4 before p11, 9.1 before p14, 9.2 before p7, and 10.0 before p4 destroys the virtual memory address space and mappings for a process before all threads have terminated, which allows local users to cause a denial of service (triple-fault and system reboot) via a crafted system call, which triggers an invalid page table pointer dereference.Show less

Previous 1...496497498...641 Next