← Back
CWE-20

12,713 CVEs • Abstraction: Class • Likelihood of Exploit: High

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

JSON object

Loading...

CVEs (12,713)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2009-0744
1Apple
1Safari
Apr 23, 2026
Feb 27, 2009
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Apple Safari 4 Beta build 528.16 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a feeds: URI beginning with a (1) % (percent), (2) { (open curly bracket), (3) }...Show more
Apple Safari 4 Beta build 528.16 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a feeds: URI beginning with a (1) % (percent), (2) { (open curly bracket), (3) } (close curly bracket), (4) ^ (caret), (5) ` (backquote), or (6) | (pipe) character, followed by an & (ampersand) character.Show less
CVE-2009-0519
1Adobe
4Air
Flash PlayerFlash Player For Linux+1 more
Apr 23, 2026
Feb 26, 2009
N/A· v4
N/A· v3
9.3 HIGH· v2
Unspecified vulnerability in Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 allows remote attackers to cause a denial of service (browser crash) or possibly execute arbitrary code via a crafted Shockw...Show more
Unspecified vulnerability in Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 allows remote attackers to cause a denial of service (browser crash) or possibly execute arbitrary code via a crafted Shockwave Flash (aka .swf) file.Show less
CVE-2008-6298
1Rocketeer.dip
1Sisapilocation
Apr 23, 2026
Feb 26, 2009
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Unspecified vulnerability in sISAPILocation before 1.0.2.2 allows remote attackers to bypass intended access restrictions for character encoding and the cookie secure flag via unknown vectors related to the "HTTP header...Show more
Unspecified vulnerability in sISAPILocation before 1.0.2.2 allows remote attackers to bypass intended access restrictions for character encoding and the cookie secure flag via unknown vectors related to the "HTTP header rewrite function."Show less
CVE-2009-0651
1Symantec
1Veritas Netbackup Server /enterprise Server
Apr 23, 2026
Feb 20, 2009
N/A· v4
N/A· v3
6.5 MEDIUM· v2
Unspecified vulnerability in the Veritas network daemon (aka vnetd) in Symantec Veritas NetBackup Server / Enterprise Server 5.x, 6.0 before MP7 SP1, and 6.5 before 6.5.3.1 allows remote attackers to execute arbitrary co...Show more
Unspecified vulnerability in the Veritas network daemon (aka vnetd) in Symantec Veritas NetBackup Server / Enterprise Server 5.x, 6.0 before MP7 SP1, and 6.5 before 6.5.3.1 allows remote attackers to execute arbitrary code via unknown vectors related to "initial communications setup."Show less
CVE-2008-6207
1Phpg Upload
1Phpg Upload
Apr 23, 2026
Feb 20, 2009
N/A· v4
N/A· v3
8.5 HIGH· v2
Unrestricted file upload vulnerability in form_upload.php in PHPG Upload 1.0 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct re...Show more
Unrestricted file upload vulnerability in form_upload.php in PHPG Upload 1.0 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.Show less
CVE-2008-6185
1Noticeware
1Noticeware Email Server Ng
Apr 23, 2026
Feb 19, 2009
N/A· v4
N/A· v3
5.0 MEDIUM· v2
NoticeWare Email Server NG 5.1.2.2 allows remote attackers to cause a denial of service (crash) via multiple POP3 requests with a long PASS command.
CVE-2009-0647
1Microsoft
1Windows Live Messenger
Apr 23, 2026
Feb 19, 2009
N/A· v4
N/A· v3
5.0 MEDIUM· v2
msnmsgr.exe in Windows Live Messenger (WLM) 2009 build 14.0.8064.206, and other 14.0.8064.x builds, allows remote attackers to cause a denial of service (application crash) via a modified header in a packet, as possibly...Show more
msnmsgr.exe in Windows Live Messenger (WLM) 2009 build 14.0.8064.206, and other 14.0.8064.x builds, allows remote attackers to cause a denial of service (application crash) via a modified header in a packet, as possibly demonstrated by a UTF-8.0 value of the charset field in the Content-Type header line. NOTE: this has been reported as a format string vulnerability by some sources, but the provenance of that information is unknown.Show less
CVE-2008-6175
1K2sxs
1Silvershield
Apr 23, 2026
Feb 19, 2009
N/A· v4
N/A· v3
5.0 MEDIUM· v2
SilverSHielD 1.0.2.34 allows remote attackers to cause a denial of service (application crash) via a crafted argument to the opendir SFTP command.
CVE-2008-6171
1Drupal
1Drupal
Apr 23, 2026
Feb 19, 2009
N/A· v4
N/A· v3
9.3 HIGH· v2
includes/bootstrap.inc in Drupal 5.x before 5.12 and 6.x before 6.6, when the server is configured for "IP-based virtual hosts," allows remote attackers to include and execute arbitrary files via the HTTP Host header.
CVE-2009-0609
1Sun
1Java System Directory Server
Apr 23, 2026
Feb 17, 2009
N/A· v4
N/A· v3
7.8 HIGH· v2
Sun Java System Directory Proxy Server in Sun Java System Directory Server Enterprise Edition 6.0 through 6.3, when a JDBC data source is used, does not properly handle (1) a long value in an ADD or (2) long string attri...Show more
Sun Java System Directory Proxy Server in Sun Java System Directory Server Enterprise Edition 6.0 through 6.3, when a JDBC data source is used, does not properly handle (1) a long value in an ADD or (2) long string attributes, which allows remote attackers to cause a denial of service (JDBC backend outage) via crafted LDAP requests.Show less
CVE-2009-0606
1Openhandsetalliance
1Android Sdk
Apr 23, 2026
Feb 17, 2009
N/A· v4
N/A· v3
7.2 HIGH· v2
The link_image function in linker/linker.c in the dynamic linker in Bionic in Open Handset Alliance Android 1.0 on the T-Mobile G1 phone does not properly handle file descriptors 0, 1, and 2 for a setgid program, which a...Show more
The link_image function in linker/linker.c in the dynamic linker in Bionic in Open Handset Alliance Android 1.0 on the T-Mobile G1 phone does not properly handle file descriptors 0, 1, and 2 for a setgid program, which allows local users to create arbitrary files owned by certain groups, possibly a related issue to CVE-2002-0820.Show less
CVE-2009-0602
1Wikkitikkitavi
1Wikkitikkitavi
Apr 23, 2026
Feb 16, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
Unrestricted file upload vulnerability in upload.php in WikkiTikkiTavi 1.11 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to th...Show more
Unrestricted file upload vulnerability in upload.php in WikkiTikkiTavi 1.11 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in img/.Show less
CVE-2009-0600
1Wireshark
1Wireshark
Apr 23, 2026
Feb 16, 2009
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Wireshark 0.99.6 through 1.0.5 allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted Tektronix K12 text capture file, as demonstrated by a file with exactly one frame.
CVE-2009-0137
1Apple
1Safari
Apr 23, 2026
Feb 13, 2009
N/A· v4
N/A· v3
10.0 HIGH· v2
Multiple unspecified vulnerabilities in Safari RSS in Apple Mac OS X 10.4.11 and 10.5.6, and Windows XP and Vista, allow remote attackers to execute arbitrary JavaScript in the local security zone via a crafted feed: URL...Show more
Multiple unspecified vulnerabilities in Safari RSS in Apple Mac OS X 10.4.11 and 10.5.6, and Windows XP and Vista, allow remote attackers to execute arbitrary JavaScript in the local security zone via a crafted feed: URL, related to "input validation issues."Show less
CVE-2009-0545
1Zeroshell
1Zeroshell
Apr 23, 2026
Feb 12, 2009
N/A· v4
N/A· v3
10.0 HIGH· v2
cgi-bin/kerbynet in ZeroShell 1.0beta11 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the type parameter in a NoAuthREQ x509List action.
CVE-2008-6122
1Netgear
1Wgr614
Apr 23, 2026
Feb 11, 2009
N/A· v4
N/A· v3
7.8 HIGH· v2
The web management interface in Netgear WGR614v9 allows remote attackers to cause a denial of service (crash) via a request that contains a question mark ("?").
CVE-2008-6121
1Socialengine
1Socialengine
Apr 23, 2026
Feb 11, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
CRLF injection vulnerability in SocialEngine (SE) 2.7 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the PHPSESSID cookie.
CVE-2008-6119
1Goople Cms
1Goople Cms
Apr 23, 2026
Feb 11, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
Static code injection vulnerability in gooplecms/admin/account/action/editpass.php in Goople CMS 1.7 allows remote attackers to inject arbitrary PHP code into admin/userandpass.php via the (1) username and (2) password p...Show more
Static code injection vulnerability in gooplecms/admin/account/action/editpass.php in Goople CMS 1.7 allows remote attackers to inject arbitrary PHP code into admin/userandpass.php via the (1) username and (2) password parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.Show less
CVE-2009-0099
1Microsoft
1Exchange Server
Apr 23, 2026
Feb 10, 2009
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The Electronic Messaging System Microsoft Data Base (EMSMDB32) provider in Microsoft Exchange 2000 Server SP3 and Exchange Server 2003 SP2, as used in Exchange System Attendant, allows remote attackers to cause a denial...Show more
The Electronic Messaging System Microsoft Data Base (EMSMDB32) provider in Microsoft Exchange 2000 Server SP3 and Exchange Server 2003 SP2, as used in Exchange System Attendant, allows remote attackers to cause a denial of service (application outage) via a malformed MAPI command, aka "Literal Processing Vulnerability."Show less
CVE-2008-4283
1Ibm
1Websphere Application Server
Apr 23, 2026
Feb 10, 2009
N/A· v4
N/A· v3
10.0 HIGH· v2
CRLF injection vulnerability in the WebContainer component in IBM WebSphere Application Server (WAS) 5.1.1.19 and earlier 5.1.x versions allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response...Show more
CRLF injection vulnerability in the WebContainer component in IBM WebSphere Application Server (WAS) 5.1.1.19 and earlier 5.1.x versions allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.Show less