Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CVEs (12,711)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2008-4404 1Ibm 1Zseries Apr 23, 2026 Oct 3, 2008 N/A· v4 N/A· v3 10.0 HIGH· v2 The IPv6 Neighbor Discovery Protocol (NDP) implementation on IBM zSeries servers does not validate the origin of Neighbor Discovery messages, which allows remote attackers to cause a denial of service (loss of connectivi...Show more The IPv6 Neighbor Discovery Protocol (NDP) implementation on IBM zSeries servers does not validate the origin of Neighbor Discovery messages, which allows remote attackers to cause a denial of service (loss of connectivity) or read private network traffic via a spoofed message that modifies the Forward Information Base (FIB), a related issue to CVE-2008-2476.Show less
CVE-2008-2476 6Force10 FreebsdJuniper+3 more 6Freebsd FtosJnos+3 more Apr 23, 2026 Oct 3, 2008 N/A· v4 N/A· v3 9.3 HIGH· v2 The IPv6 Neighbor Discovery Protocol (NDP) implementation in (1) FreeBSD 6.3 through 7.1, (2) OpenBSD 4.2 and 4.3, (3) NetBSD, (4) Force10 FTOS before E7.7.1.1, (5) Juniper JUNOS, and (6) Wind River VxWorks 5.x through 6...Show more The IPv6 Neighbor Discovery Protocol (NDP) implementation in (1) FreeBSD 6.3 through 7.1, (2) OpenBSD 4.2 and 4.3, (3) NetBSD, (4) Force10 FTOS before E7.7.1.1, (5) Juniper JUNOS, and (6) Wind River VxWorks 5.x through 6.4 does not validate the origin of Neighbor Discovery messages, which allows remote attackers to cause a denial of service (loss of connectivity) or read private network traffic via a spoofed message that modifies the Forward Information Base (FIB).Show less
CVE-2008-4380 1Samsung 1Dvr Shr2040 Apr 23, 2026 Oct 1, 2008 N/A· v4 N/A· v3 7.8 HIGH· v2 The web interface in Samsung DVR SHR2040 allows remote attackers to cause a denial of service (crash) via a malformed HTTP request, related to the filter for configuration properties and "/x" characters.
CVE-2008-4366 1Camera Life 1Camera Life Apr 23, 2026 Sep 30, 2008 N/A· v4 N/A· v3 6.5 MEDIUM· v2 Unrestricted file upload vulnerability in the image upload component in Camera Life 2.6.2b4 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it...Show more Unrestricted file upload vulnerability in the image upload component in Camera Life 2.6.2b4 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in a user directory under images/photos/upload.Show less
CVE-2008-4363 1Deslock 1Deslock Apr 23, 2026 Sep 30, 2008 N/A· v4 N/A· v3 7.2 HIGH· v2 DLMFENC.sys 1.0.0.28 in DESlock+ 3.2.7 allows local users to cause a denial of service (system crash) or potentially execute arbitrary code via a certain DLMFENC_IOCTL request to \\.\DLKPFSD_Device that overwrites a poin...Show more DLMFENC.sys 1.0.0.28 in DESlock+ 3.2.7 allows local users to cause a denial of service (system crash) or potentially execute arbitrary code via a certain DLMFENC_IOCTL request to \\.\DLKPFSD_Device that overwrites a pointer, probably related to use of the ProbeForRead function when ProbeForWrite was intended.Show less
CVE-2008-4358 1Spaw Editor 1Spaw Php Apr 23, 2026 Sep 30, 2008 N/A· v4 N/A· v3 10.0 HIGH· v2 Unspecified vulnerability in class/theme.class.php in SPAW Editor PHP Edition before 2.0.8.1 has unknown impact and attack vectors, probably related to directory traversal sequences in the theme name.
CVE-2008-4343 1Chilkat Software 1Chilkat Xml Activex Control Apr 23, 2026 Sep 30, 2008 N/A· v4 N/A· v3 9.3 HIGH· v2 The Chilkat XML ChilkatUtil.CkData.1 ActiveX control (ChilkatUtil.dll) 3.0.3.0 and earlier allows remote attackers to create, overwrite, and modify arbitrary files for execution via a call to the (1) SaveToFile, (2) Save...Show more The Chilkat XML ChilkatUtil.CkData.1 ActiveX control (ChilkatUtil.dll) 3.0.3.0 and earlier allows remote attackers to create, overwrite, and modify arbitrary files for execution via a call to the (1) SaveToFile, (2) SaveToTempFile, or (3) AppendBinary method. NOTE: this issue might only be exploitable in limited environments or non-default browser settings. NOTE: this can be leveraged for remote code execution by accessing files using hcp:// URLs.Show less
CVE-2008-4342 3Burnaware Technologies ImpressumNumedia Soft 3Burnaware CdburnerxpNumedia Dvd Burning Sdk Apr 23, 2026 Sep 30, 2008 N/A· v4 N/A· v3 9.3 HIGH· v2 NuMedia Soft NMS DVD Burning SDK Activex NMSDVDX.DVDEngineX.1 ActiveX control (NMSDVDX.dll) 1.013C and earlier, as used in CDBurnerXP 4.2.1.976, BurnAware 2.1.3, Blaze Media Pro 8.02 Special Edition, and possibly other p...Show more NuMedia Soft NMS DVD Burning SDK Activex NMSDVDX.DVDEngineX.1 ActiveX control (NMSDVDX.dll) 1.013C and earlier, as used in CDBurnerXP 4.2.1.976, BurnAware 2.1.3, Blaze Media Pro 8.02 Special Edition, and possibly other products, allows remote attackers to overwrite and create arbitrary files via calls to the EnableLog and LogMessage methods. NOTE: this issue might only be exploitable in limited environments or non-default browser settings. NOTE: some of these details are obtained from third party information. NOTE: this can be leveraged for remote code execution by accessing files using hcp:// URLs.Show less
CVE-2008-4340 1Google 1Chrome Apr 23, 2026 Sep 30, 2008 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Google Chrome 0.2.149.29 and 0.2.149.30 allows remote attackers to cause a denial of service (memory consumption) via an HTML document containing a carriage return ("\r\n\r\n") argument to the window.open function.
CVE-2008-4329 1Openengine 1Openengine Apr 23, 2026 Sep 30, 2008 N/A· v4 N/A· v3 10.0 HIGH· v2 PHP remote file inclusion vulnerability in cms/system/openengine.php in openEngine 2.0 beta4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the oe_classpath parameter.
CVE-2008-4318 1Project Observer 1Observer Apr 23, 2026 Sep 29, 2008 N/A· v4 N/A· v3 10.0 HIGH· v2 Observer 0.3.2.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the query parameter to (1) whois.php or (2) netcmd.php.
CVE-2008-4295 1Microsoft 1Windows Mobile Apr 23, 2026 Sep 27, 2008 N/A· v4 N/A· v3 5.4 MEDIUM· v2 Microsoft Windows Mobile 6.0 on HTC Wiza 200 and HTC MDA 8125 devices does not properly handle the first attempt to establish a Bluetooth connection to a peer with a long name, which allows remote attackers to cause a de...Show more Microsoft Windows Mobile 6.0 on HTC Wiza 200 and HTC MDA 8125 devices does not properly handle the first attempt to establish a Bluetooth connection to a peer with a long name, which allows remote attackers to cause a denial of service (device reboot) by configuring a Bluetooth device with a long hci name and (1) connecting directly to the Windows Mobile system or (2) waiting for the Windows Mobile system to scan for nearby devices.Show less
CVE-2008-4200 1Opera 1Opera Browser Apr 23, 2026 Sep 27, 2008 N/A· v4 N/A· v3 6.4 MEDIUM· v2 Opera before 9.52 does not ensure that the address field of a news feed represents the feed's actual URL, which allows remote attackers to change this field to display the URL of a page containing web script controlled b...Show more Opera before 9.52 does not ensure that the address field of a news feed represents the feed's actual URL, which allows remote attackers to change this field to display the URL of a page containing web script controlled by the attacker.Show less
CVE-2008-3811 1Cisco 1Ios Apr 23, 2026 Sep 26, 2008 N/A· v4 N/A· v3 7.8 HIGH· v2 Cisco IOS 12.2 and 12.4, when NAT Skinny Call Control Protocol (SCCP) Fragmentation Support is enabled, allows remote attackers to cause a denial of service (device reload) via segmented SCCP messages, aka Cisco Bug ID C...Show more Cisco IOS 12.2 and 12.4, when NAT Skinny Call Control Protocol (SCCP) Fragmentation Support is enabled, allows remote attackers to cause a denial of service (device reload) via segmented SCCP messages, aka Cisco Bug ID CSCsi17020, a different vulnerability than CVE-2008-3810.Show less
CVE-2008-3810 1Cisco 1Ios Apr 23, 2026 Sep 26, 2008 N/A· v4 N/A· v3 7.8 HIGH· v2 Cisco IOS 12.2 and 12.4, when NAT Skinny Call Control Protocol (SCCP) Fragmentation Support is enabled, allows remote attackers to cause a denial of service (device reload) via segmented SCCP messages, aka CSCsg22426, a...Show more Cisco IOS 12.2 and 12.4, when NAT Skinny Call Control Protocol (SCCP) Fragmentation Support is enabled, allows remote attackers to cause a denial of service (device reload) via segmented SCCP messages, aka CSCsg22426, a different vulnerability than CVE-2008-3811.Show less
CVE-2008-4137 1Php Crawler 1Php Crawler Apr 23, 2026 Sep 24, 2008 N/A· v4 N/A· v3 7.5 HIGH· v2 PHP remote file inclusion vulnerability in footer.php in PHP-Crawler 0.8 allows remote attackers to execute arbitrary PHP code via a URL in the footer_file parameter.
CVE-2008-4136 1Michael Roth Software 1Pftp Apr 23, 2026 Sep 24, 2008 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Michael Roth Software Personal FTP Server (PFT) 6.0f allows remote attackers to cause a denial of service (service crash) via multiple RETR commands, possibly involving long filenames.
CVE-2008-4163 1Isc 1Bind Apr 23, 2026 Sep 22, 2008 N/A· v4 N/A· v3 7.8 HIGH· v2 Unspecified vulnerability in ISC BIND 9.3.5-P2-W1, 9.4.2-P2-W1, and 9.5.0-P2-W1 on Windows allows remote attackers to cause a denial of service (UDP client handler termination) via unknown vectors.
CVE-2008-4133 1D Link 1Dir 100 Apr 23, 2026 Sep 19, 2008 N/A· v4 N/A· v3 4.3 MEDIUM· v2 The web proxy service on the D-Link DIR-100 with firmware 1.12 and earlier does not properly filter web requests with large URLs, which allows remote attackers to bypass web restriction filters.
CVE-2008-4106 1Wordpress 1Wordpress Apr 23, 2026 Sep 18, 2008 N/A· v4 N/A· v3 5.1 MEDIUM· v2 WordPress before 2.6.2 does not properly handle MySQL warnings about insertion of username strings that exceed the maximum column width of the user_login column, and does not properly handle space characters when compari...Show more WordPress before 2.6.2 does not properly handle MySQL warnings about insertion of username strings that exceed the maximum column width of the user_login column, and does not properly handle space characters when comparing usernames, which allows remote attackers to change an arbitrary user's password to a random value by registering a similar username and then requesting a password reset, related to a "SQL column truncation vulnerability." NOTE: the attacker can discover the random password by also exploiting CVE-2008-4107.Show less

Previous 1...601602603...636 Next