Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CVEs (12,724)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2009-2954 1Microsoft 1Internet Explorer Apr 23, 2026 Aug 24, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Microsoft Internet Explorer 6.0.2900.2180 and earlier allows remote attackers to cause a denial of service (CPU consumption and application hang) via JavaScript code with a long string value for the hash property (aka lo...Show more Microsoft Internet Explorer 6.0.2900.2180 and earlier allows remote attackers to cause a denial of service (CPU consumption and application hang) via JavaScript code with a long string value for the hash property (aka location.hash), a related issue to CVE-2008-5715.Show less
CVE-2008-7052 1Preprojects 1Pre Real Estate Listings Apr 23, 2026 Aug 24, 2009 N/A· v4 N/A· v3 6.5 MEDIUM· v2 Unrestricted file upload vulnerability in profile.php in Pre Projects Pre Real Estate Listings allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a profile log...Show more Unrestricted file upload vulnerability in profile.php in Pre Projects Pre Real Estate Listings allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a profile logo, then accessing it via a direct request to the file in re_images/.Show less
CVE-2008-7037 1Itn 1Itn News Gadget Apr 23, 2026 Aug 24, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 The Sidebar gadget in ITN News Gadget (aka ITN Hub Gadget) 1.06 for Windows Vista, and possibly other versions before 1.23, allows remote web servers or man-in-the-middle attackers to execute arbitrary commands via scrip...Show more The Sidebar gadget in ITN News Gadget (aka ITN Hub Gadget) 1.06 for Windows Vista, and possibly other versions before 1.23, allows remote web servers or man-in-the-middle attackers to execute arbitrary commands via script in a short_title response.Show less
CVE-2008-7029 1Alilg 1Aliboard Apr 23, 2026 Aug 24, 2009 N/A· v4 N/A· v3 6.0 MEDIUM· v2 Unrestricted file upload vulnerability in usercp.php in AlilG Application AliBoard Beta allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as an avatar, then acce...Show more Unrestricted file upload vulnerability in usercp.php in AlilG Application AliBoard Beta allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as an avatar, then accessing it via a direct request to the file in uploads/avatars/.Show less
CVE-2009-2918 1Thegreenbow 1Thegreenbow Vpn Client Apr 23, 2026 Aug 21, 2009 N/A· v4 N/A· v3 2.1 LOW· v2 The tgbvpn.sys driver in TheGreenBow IPSec VPN Client 4.61.003 allows local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted request to the 0x80000034 IOCTL, probably involving...Show more The tgbvpn.sys driver in TheGreenBow IPSec VPN Client 4.61.003 allows local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted request to the 0x80000034 IOCTL, probably involving an input or output buffer size of 0.Show less
CVE-2009-2055 1Cisco 1Ios Xr Apr 22, 2026 Aug 19, 2009 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 Cisco IOS XR 3.4.0 through 3.8.1 allows remote attackers to cause a denial of service (session reset) via a BGP UPDATE message with an invalid attribute, as demonstrated in the wild on 17 August 2009.
CVE-2009-0682 1Ca 1Internet Security Suite Apr 23, 2026 Aug 19, 2009 N/A· v4 N/A· v3 2.1 LOW· v2 vetmonnt.sys in CA Internet Security Suite r3, vetmonnt.sys before 9.0.0.184 in Internet Security Suite r4, and vetmonnt.sys before 10.0.0.217 in Internet Security Suite r5 do not properly verify IOCTL calls, which allow...Show more vetmonnt.sys in CA Internet Security Suite r3, vetmonnt.sys before 9.0.0.184 in Internet Security Suite r4, and vetmonnt.sys before 10.0.0.217 in Internet Security Suite r5 do not properly verify IOCTL calls, which allows local users to cause a denial of service (system crash) via a crafted call.Show less
CVE-2008-6978 1Fullrevolution 1Aspwebalbum Apr 23, 2026 Aug 19, 2009 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Unrestricted file upload vulnerability in Full Revolution aspWebAlbum 3.2 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the...Show more Unrestricted file upload vulnerability in Full Revolution aspWebAlbum 3.2 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in pics/, related to the uploadmedia action in album.asp.Show less
CVE-2008-6976 1Mikrotik 1Routeros Apr 23, 2026 Aug 19, 2009 N/A· v4 N/A· v3 6.4 MEDIUM· v2 MikroTik RouterOS 3.x through 3.13 and 2.x through 2.9.51 allows remote attackers to modify Network Management System (NMS) settings via a crafted SNMP set request.
CVE-2009-2855 1Squid Cache 1Squid Apr 23, 2026 Aug 18, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7 allows remote attackers to cause a denial of service via a crafted auth header with certain comma delimiters that trigger an infinite loop of calls to the...Show more The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7 allows remote attackers to cause a denial of service via a crafted auth header with certain comma delimiters that trigger an infinite loop of calls to the strcspn function.Show less
CVE-2009-2852 1Ryan.mcgeary 1Wp Syntax Apr 23, 2026 Aug 18, 2009 N/A· v4 N/A· v3 6.8 MEDIUM· v2 WP-Syntax plugin 0.9.1 and earlier for Wordpress, with register_globals enabled, allows remote attackers to execute arbitrary PHP code via the test_filter[wp_head] array parameter to test/index.php, which is used in a ca...Show more WP-Syntax plugin 0.9.1 and earlier for Wordpress, with register_globals enabled, allows remote attackers to execute arbitrary PHP code via the test_filter[wp_head] array parameter to test/index.php, which is used in a call to the call_user_func_array function.Show less
CVE-2009-2765 1Dd Wrt 1Dd Wrt Apr 23, 2026 Aug 14, 2009 N/A· v4 N/A· v3 8.3 HIGH· v2 httpd.c in httpd in the management GUI in DD-WRT 24 sp1, and other versions before build 12533, allows remote attackers to execute arbitrary commands via shell metacharacters in a request to a cgi-bin/ URI.
CVE-2008-6962 1Avira 4Antivir Antivir PersonalAntivir Professional+1 more Apr 23, 2026 Aug 13, 2009 N/A· v4 N/A· v3 7.2 HIGH· v2 Avira AntiVir Premium, Premium Security Suite, AntiVir Professional, and AntiVir Personal - FREE allows local users to execute arbitrary code via a crafted IOCTL request that overwrites a kernel pointer.
CVE-2009-1536 1Microsoft 3.net Framework Windows Server 2008Windows Vista Apr 23, 2026 Aug 12, 2009 N/A· v4 N/A· v3 2.6 LOW· v2 ASP.NET in Microsoft .NET Framework 2.0 SP1 and SP2 and 3.5 Gold and SP1, when ASP 2.0 is used in integrated mode on IIS 7.0, does not properly manage request scheduling, which allows remote attackers to cause a denial o...Show more ASP.NET in Microsoft .NET Framework 2.0 SP1 and SP2 and 3.5 Gold and SP1, when ASP 2.0 is used in integrated mode on IIS 7.0, does not properly manage request scheduling, which allows remote attackers to cause a denial of service (daemon outage) via a series of crafted HTTP requests, aka "Remote Unauthenticated Denial of Service in ASP.NET Vulnerability."Show less
CVE-2008-6948 1Collabtive 1Collabtive Apr 23, 2026 Aug 12, 2009 N/A· v4 N/A· v3 6.5 MEDIUM· v2 Unrestricted file upload vulnerability in Collabtive 0.4.8 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension and using a text/plain MIME type, then accessing it...Show more Unrestricted file upload vulnerability in Collabtive 0.4.8 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension and using a text/plain MIME type, then accessing it via a direct request to the file in files/, related to (1) the showproject action in managefile.php or (2) the Messages feature.Show less
CVE-2008-6944 1Scriptsfeed 1Auto Classifieds Apr 23, 2026 Aug 12, 2009 N/A· v4 N/A· v3 6.5 MEDIUM· v2 Unrestricted file upload vulnerability in ScriptsFeed Auto Classifieds allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a profile logo, then accessing it via...Show more Unrestricted file upload vulnerability in ScriptsFeed Auto Classifieds allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a profile logo, then accessing it via a direct request to the file in cars_images/.Show less
CVE-2008-6943 1Scriptsfeed 1Recipes Listing Portal Apr 23, 2026 Aug 12, 2009 N/A· v4 N/A· v3 6.5 MEDIUM· v2 Unrestricted file upload vulnerability in ScriptsFeed Recipes Listing Portal allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a recipe photo, then accessing...Show more Unrestricted file upload vulnerability in ScriptsFeed Recipes Listing Portal allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a recipe photo, then accessing it via a direct request to the file in pictures/.Show less
CVE-2008-6942 1Scriptsfeed 1Realtor Classifieds System Apr 23, 2026 Aug 12, 2009 N/A· v4 N/A· v3 6.5 MEDIUM· v2 Unrestricted file upload vulnerability in ScriptsFeed Realtor Classifieds System (aka Real Estate Classifieds) allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension...Show more Unrestricted file upload vulnerability in ScriptsFeed Realtor Classifieds System (aka Real Estate Classifieds) allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a profile logo, then accessing it via a direct request to the file in re_images/.Show less
CVE-2008-6938 1Holger Zimmermann 1Pi3web Apr 23, 2026 Aug 11, 2009 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Pi3Web 2.0.3 before PL2, when installed on Windows as a desktop application and without using the Pi3Web/Conf/Intenet.pi3, allows remote attackers to cause a denial of service (crash or hang) and obtain the full pathname...Show more Pi3Web 2.0.3 before PL2, when installed on Windows as a desktop application and without using the Pi3Web/Conf/Intenet.pi3, allows remote attackers to cause a denial of service (crash or hang) and obtain the full pathname of the server via a request to a file in the ISAPI directory that is not an executable DLL, which triggers the crash when the DLL load fails, as demonstrated using Isapi\users.txt.Show less
CVE-2009-2715 1Sun 1Virtualbox Apr 23, 2026 Aug 7, 2009 N/A· v4 N/A· v3 4.9 MEDIUM· v2 Sun VirtualBox 2.2 through 3.0.2 r49928 allows guest OS users to cause a denial of service (Linux host OS reboot) via a sysenter instruction.

Previous 1...585586587...637 Next