Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CVEs (13,696)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2009-2583 1Ibm 1Tivoli Identity Manager Apr 23, 2026 Jul 23, 2009 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Multiple session fixation vulnerabilities in IBM Tivoli Identity Manager (ITIM) 5.0.0.6 allow remote attackers to hijack web sessions via unspecified vectors involving the (1) console and (2) self service interfaces.
CVE-2009-2534 1Realnetworks 2Helix Server Helix Server Mobile Apr 23, 2026 Jul 20, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 RealNetworks Helix Server and Helix Mobile Server before 13.0.0 allow remote attackers to cause a denial of service (daemon crash) via an RTSP SETUP request that (1) specifies the / URI or (2) lacks a / character in the...Show more RealNetworks Helix Server and Helix Mobile Server before 13.0.0 allow remote attackers to cause a denial of service (daemon crash) via an RTSP SETUP request that (1) specifies the / URI or (2) lacks a / character in the URI.Show less
CVE-2009-2533 1Realnetworks 2Helix Server Helix Server Mobile Apr 23, 2026 Jul 20, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 rmserver in RealNetworks Helix Server and Helix Mobile Server before 13.0.0 allows remote attackers to cause a denial of service (daemon exit) via multiple RTSP SET_PARAMETER requests with empty DataConvertBuffer headers...Show more rmserver in RealNetworks Helix Server and Helix Mobile Server before 13.0.0 allows remote attackers to cause a denial of service (daemon exit) via multiple RTSP SET_PARAMETER requests with empty DataConvertBuffer headers.Show less
CVE-2009-1538 1Microsoft 4Directx Windows 2000Windows Server 2003+1 more Apr 23, 2026 Jul 15, 2009 N/A· v4 N/A· v3 9.3 HIGH· v2 The QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2 performs updates to pointers without properly v...Show more The QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2 performs updates to pointers without properly validating unspecified data values, which allows remote attackers to execute arbitrary code via a crafted QuickTime media file, aka "DirectX Pointer Validation Vulnerability."Show less
CVE-2009-2431 1Wordpress 1Wordpress Apr 23, 2026 Jul 10, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 WordPress 2.7.1 places the username of a post's author in an HTML comment, which allows remote attackers to obtain sensitive information by reading the HTML source.
CVE-2009-2425 1Tor 1Tor Apr 23, 2026 Jul 10, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Tor before 0.2.0.35 allows remote attackers to cause a denial of service (application crash) via a malformed router descriptor.
CVE-2009-2386 1Awingsoft 1Awakening Winds3d Viewer Plugin Apr 23, 2026 Jul 10, 2009 N/A· v4 N/A· v3 9.3 HIGH· v2 Insecure method vulnerability in Awingsoft Awakening Winds3D Viewer plugin 3.5.0.0, 3.0.0.5, and possibly other versions allows remote attackers to force the download and execution of arbitrary files via the GetURL metho...Show more Insecure method vulnerability in Awingsoft Awakening Winds3D Viewer plugin 3.5.0.0, 3.0.0.5, and possibly other versions allows remote attackers to force the download and execution of arbitrary files via the GetURL method.Show less
CVE-2009-2421 1Apple 1Safari Apr 23, 2026 Jul 9, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The CFCharacterSetInitInlineBuffer method in CoreFoundation.dll in Apple Safari 3.2.3 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbitrary co...Show more The CFCharacterSetInitInlineBuffer method in CoreFoundation.dll in Apple Safari 3.2.3 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbitrary code via a "high-bit character" in a URL fragment for an unspecified protocol.Show less
CVE-2009-2420 1Apple 1Safari Apr 23, 2026 Jul 9, 2009 N/A· v4 N/A· v3 5.8 MEDIUM· v2 Apple Safari 3.2.3 does not properly implement the file: protocol handler, which allows remote attackers to read arbitrary files or cause a denial of service (launch of multiple Windows Explorer instances) via vectors in...Show more Apple Safari 3.2.3 does not properly implement the file: protocol handler, which allows remote attackers to read arbitrary files or cause a denial of service (launch of multiple Windows Explorer instances) via vectors involving an unspecified HTML tag, possibly a related issue to CVE-2009-1703.Show less
CVE-2009-2320 1Axesstel 1Mv 410r Apr 23, 2026 Jul 5, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 The web interface on the Axesstel MV 410R relies on client-side JavaScript code to validate input, which allows remote attackers to send crafted data, and possibly have unspecified other impact, via a client that does no...Show more The web interface on the Axesstel MV 410R relies on client-side JavaScript code to validate input, which allows remote attackers to send crafted data, and possibly have unspecified other impact, via a client that does not process JavaScript.Show less
CVE-2009-2318 1Axesstel 1Mv 410r Apr 23, 2026 Jul 5, 2009 N/A· v4 N/A· v3 7.8 HIGH· v2 The Axesstel MV 410R allows remote attackers to cause a denial of service via a flood of SYN packets, a related issue to CVE-1999-0116.
CVE-2009-2305 1Armassa 2Ard 9808 Ard 9808 Software Apr 23, 2026 Jul 2, 2009 N/A· v4 N/A· v3 7.8 HIGH· v2 The ARD-9808 DVR card security camera allows remote attackers to cause a denial of service via a long URI composed of //.\ (slash slash dot backslash) sequences.
CVE-2009-2304 1Avatic 1Aardvark Topsites Php Apr 23, 2026 Jul 2, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 index.php in Aardvark Topsites PHP 5.2.0 and earlier allows remote attackers to obtain sensitive information via a nonexistent account name in the u parameter in a rate action, which reveals the installation path in an e...Show more index.php in Aardvark Topsites PHP 5.2.0 and earlier allows remote attackers to obtain sensitive information via a nonexistent account name in the u parameter in a rate action, which reveals the installation path in an error message.Show less
CVE-2009-2303 1Avatic 1Aardvark Topsites Php Apr 23, 2026 Jul 2, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 index.php in Aardvark Topsites PHP 5.2.1 and earlier allows remote attackers to obtain sensitive information via a negative integer value for the start parameter in a search action, which reveals the installation path in...Show more index.php in Aardvark Topsites PHP 5.2.1 and earlier allows remote attackers to obtain sensitive information via a negative integer value for the start parameter in a search action, which reveals the installation path in an error message.Show less
CVE-2009-2301 1Radware 2Appwall Gateway Apr 23, 2026 Jul 2, 2009 N/A· v4 N/A· v3 7.8 HIGH· v2 The radware AppWall Web Application Firewall (WAF) 1.0.2.6, with Gateway 4.6.0.2, allows remote attackers to read source code via a direct request to (1) funcs.inc, (2) defines.inc, or (3) msg.inc in Management/.
CVE-2009-2261 1Giorgio Tani 1Peazip Apr 23, 2026 Jun 30, 2009 N/A· v4 N/A· v3 9.3 HIGH· v2 PeaZIP 2.6.1, 2.5.1, and earlier on Windows allows user-assisted remote attackers to execute arbitrary commands via a .zip archive with a .txt file whose name contains \| (pipe) characters and a command.
CVE-2009-2256 1Netgear 1Dg632 Apr 23, 2026 Jun 30, 2009 N/A· v4 N/A· v3 7.8 HIGH· v2 The administrative web interface on the Netgear DG632 with firmware 3.4.0_ap allows remote attackers to cause a denial of service (web outage) via an HTTP POST request to cgi-bin/firmwarecfg.
CVE-2009-2185 2Strongswan Xelerance 2Openswan Strongswan Apr 23, 2026 Jun 25, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The ASN.1 parser (pluto/asn1.c, libstrongswan/asn1/asn1.c, libstrongswan/asn1/asn1_parser.c) in (a) strongSwan 2.8 before 2.8.10, 4.2 before 4.2.16, and 4.3 before 4.3.2; and (b) openSwan 2.6 before 2.6.22 and 2.4 before...Show more The ASN.1 parser (pluto/asn1.c, libstrongswan/asn1/asn1.c, libstrongswan/asn1/asn1_parser.c) in (a) strongSwan 2.8 before 2.8.10, 4.2 before 4.2.16, and 4.3 before 4.3.2; and (b) openSwan 2.6 before 2.6.22 and 2.4 before 2.4.15 allows remote attackers to cause a denial of service (pluto IKE daemon crash) via an X.509 certificate with (1) crafted Relative Distinguished Names (RDNs), (2) a crafted UTCTIME string, or (3) a crafted GENERALIZEDTIME string.Show less
CVE-2009-2138 1Tbdev 1Tbdev.net Apr 23, 2026 Jun 19, 2009 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Multiple open redirect vulnerabilities in TBDev.NET 01-01-08 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via (1) the returnto parameter to login.php or (2) the returnto pa...Show more Multiple open redirect vulnerabilities in TBDev.NET 01-01-08 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via (1) the returnto parameter to login.php or (2) the returnto parameter in a delete action to news.php. NOTE: this can be leveraged for cross-site scripting (XSS) by redirecting to a data: URI.Show less
CVE-2009-0959 1Apple 2Iphone Os Ipod Touch Apr 23, 2026 Jun 19, 2009 N/A· v4 N/A· v3 7.1 HIGH· v2 The MPEG-4 video codec in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to cause a denial of service (device reset) via a crafted MPEG-4 video file that triggers...Show more The MPEG-4 video codec in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to cause a denial of service (device reset) via a crafted MPEG-4 video file that triggers an "input validation issue."Show less

Previous 1...635636637...685 Next