← Back
CWE-20

13,695 CVEs • Abstraction: Class • Likelihood of Exploit: High

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

JSON object

Loading...

CVEs (13,695)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2009-1668
1Typsoft
1Typsoft Ftp Server
Apr 23, 2026
May 18, 2009
N/A· v4
N/A· v3
4.0 MEDIUM· v2
TYPSoft FTP Server 1.11 allows remote attackers to cause a denial of service (CPU consumption) by sending an ABOR (abort) command without an active file transfer.
CVE-2009-0943
1Apple
2Mac Os X
Mac Os X Server
Apr 23, 2026
May 13, 2009
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Help Viewer in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7 does not verify that HTML pathnames are located in a registered help book, which allows remote attackers to execute arbitrary code via a help: URL that trigger...Show more
Help Viewer in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7 does not verify that HTML pathnames are located in a registered help book, which allows remote attackers to execute arbitrary code via a help: URL that triggers invocation of AppleScript files.Show less
CVE-2009-0942
1Apple
2Mac Os X
Mac Os X Server
Apr 23, 2026
May 13, 2009
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Help Viewer in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7 does not verify that certain Cascading Style Sheets (CSS) are located in a registered help book, which allows remote attackers to execute arbitrary code via a...Show more
Help Viewer in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7 does not verify that certain Cascading Style Sheets (CSS) are located in a registered help book, which allows remote attackers to execute arbitrary code via a help: URL that triggers invocation of AppleScript files.Show less
CVE-2009-0161
1Apple
2Mac Os X
Mac Os X Server
Apr 23, 2026
May 13, 2009
N/A· v4
N/A· v3
6.4 MEDIUM· v2
The OpenSSL::OCSP module for Ruby in Apple Mac OS X 10.5 before 10.5.7 misinterprets an unspecified invalid response as a successful OCSP certificate validation, which might allow remote attackers to spoof certificate au...Show more
The OpenSSL::OCSP module for Ruby in Apple Mac OS X 10.5 before 10.5.7 misinterprets an unspecified invalid response as a successful OCSP certificate validation, which might allow remote attackers to spoof certificate authentication via a revoked certificate.Show less
CVE-2009-0156
1Apple
2Mac Os X
Mac Os X Server
Apr 23, 2026
May 13, 2009
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Launch Services in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7 allows remote attackers to cause a denial of service (persistent Finder crash) via a crafted Mach-O executable that triggers an out-of-bounds memory read.
CVE-2008-1517
1Apple
2Mac Os X
Mac Os X Server
Apr 23, 2026
May 13, 2009
N/A· v4
N/A· v3
7.2 HIGH· v2
Array index error in the xnu (Mach) kernel in Apple Mac OS X 10.5 before 10.5.7 allows local users to gain privileges or cause a denial of service (system shutdown) via unspecified vectors related to workqueues.
CVE-2008-6806
17 Shop
17shop
Apr 23, 2026
May 12, 2009
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Unrestricted file upload vulnerability in includes/imageupload.php in 7Shop 1.1 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a dire...Show more
Unrestricted file upload vulnerability in includes/imageupload.php in 7Shop 1.1 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in images/artikel/.Show less
CVE-2009-1609
1Battleblog
1Battle Blog
Apr 23, 2026
May 11, 2009
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Unrestricted file upload vulnerability in admin/uploadform.asp in Battle Blog 1.25 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct reques...Show more
Unrestricted file upload vulnerability in admin/uploadform.asp in Battle Blog 1.25 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file.Show less
CVE-2008-6793
1Dflabs
1Ptk
Apr 23, 2026
May 7, 2009
N/A· v4
N/A· v3
6.8 MEDIUM· v2
The get_file_type function in lib/file_content.php in DFLabs PTK 0.1, 0.2, and 1.0 allows remote attackers to execute arbitrary commands via shell metacharacters after an arg1= sequence in a filename within a forensic im...Show more
The get_file_type function in lib/file_content.php in DFLabs PTK 0.1, 0.2, and 1.0 allows remote attackers to execute arbitrary commands via shell metacharacters after an arg1= sequence in a filename within a forensic image.Show less
CVE-2009-1525
1Directadmin
1Directadmin
Dec 16, 2025
May 5, 2009
N/A· v4
N/A· v3
8.5 HIGH· v2
CMD_DB in JBMC Software DirectAdmin before 1.334 allows remote authenticated users to gain privileges via shell metacharacters in the name parameter during a restore action.
CVE-2009-1491
1Mcafee
1Groupshield
Apr 23, 2026
May 5, 2009
N/A· v4
N/A· v3
9.3 HIGH· v2
McAfee GroupShield for Microsoft Exchange on Exchange Server 2000, and possibly other anti-virus or anti-spam products from McAfee or other vendors, does not scan X- headers for malicious content, which allows remote att...Show more
McAfee GroupShield for Microsoft Exchange on Exchange Server 2000, and possibly other anti-virus or anti-spam products from McAfee or other vendors, does not scan X- headers for malicious content, which allows remote attackers to bypass virus detection via a crafted message, as demonstrated by a message with an X-Testing header and no message body.Show less
CVE-2008-6791
1Klever
1Pumpkin
Apr 23, 2026
May 4, 2009
N/A· v4
N/A· v3
5.0 MEDIUM· v2
PumpKIN TFTP Server 2.7.2.0 allows remote attackers to cause a denial of service via a write request with a long mode field.
CVE-2008-6790
1Minddezign
1Photo Gallery
Apr 23, 2026
May 4, 2009
N/A· v4
N/A· v3
5.1 MEDIUM· v2
The admin module in MindDezign Photo Gallery 2.2 allows remote attackers to add administrative users and gain privileges via a modified username parameter in an edit account action to index.php.
CVE-2009-1432
1Symantec
3Antivirus
Client SecurityEndpoint Protection
Apr 23, 2026
Apr 30, 2009
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Symantec Reporting Server, as used in Symantec AntiVirus (SAV) Corporate Edition 10.1 before 10.1 MR8 and 10.2 before 10.2 MR2, Symantec Client Security (SCS) before 3.1 MR8, and the Symantec Endpoint Protection Manager...Show more
Symantec Reporting Server, as used in Symantec AntiVirus (SAV) Corporate Edition 10.1 before 10.1 MR8 and 10.2 before 10.2 MR2, Symantec Client Security (SCS) before 3.1 MR8, and the Symantec Endpoint Protection Manager (SEPM) component in Symantec Endpoint Protection (SEP) before 11.0 MR2, allows remote attackers to inject arbitrary text into the login screen, and possibly conduct phishing attacks, via vectors involving a URL that is not properly handled.Show less
CVE-2009-1348
1Mcafee
13Active Virus Defense
Active VirusscanEmail Gateway+10 more
Apr 23, 2026
Apr 30, 2009
N/A· v4
N/A· v3
7.6 HIGH· v2
The AV engine before DAT 5600 in McAfee VirusScan, Total Protection, Internet Security, SecurityShield for Microsoft ISA Server, Security for Microsoft Sharepoint, Security for Email Servers, Email Gateway, and Active Vi...Show more
The AV engine before DAT 5600 in McAfee VirusScan, Total Protection, Internet Security, SecurityShield for Microsoft ISA Server, Security for Microsoft Sharepoint, Security for Email Servers, Email Gateway, and Active Virus Defense allows remote attackers to bypass virus detection via (1) an invalid Headflags field in a malformed RAR archive, (2) an invalid Packsize field in a malformed RAR archive, or (3) an invalid Filelength field in a malformed ZIP archive.Show less
CVE-2008-6772
1Peterselie
1Yourplace
Apr 23, 2026
Apr 29, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
login/register_form.php in YourPlace 1.0.2 and earlier does not check that a username already exists when a new account is created, which allows remote attackers to bypass intended access restrictions by registering a ne...Show more
login/register_form.php in YourPlace 1.0.2 and earlier does not check that a username already exists when a new account is created, which allows remote attackers to bypass intended access restrictions by registering a new account with the username of a target user.Show less
CVE-2009-1446
1Elkagroup
1Image Gallery
Apr 23, 2026
Apr 27, 2009
N/A· v4
N/A· v3
6.5 MEDIUM· v2
Unrestricted file upload vulnerability in upload.php in Elkagroup Image Gallery 1.0 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a di...Show more
Unrestricted file upload vulnerability in upload.php in Elkagroup Image Gallery 1.0 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in gallery/pictures/. NOTE: some of these details are obtained from third party information.Show less
CVE-2009-1436
1Freebsd
1Freebsd
Apr 23, 2026
Apr 27, 2009
N/A· v4
N/A· v3
4.9 MEDIUM· v2
The db interface in libc in FreeBSD 6.3, 6.4, 7.0, 7.1, and 7.2-PRERELEASE does not properly initialize memory for Berkeley DB 1.85 database structures, which allows local users to obtain sensitive information by reading...Show more
The db interface in libc in FreeBSD 6.3, 6.4, 7.0, 7.1, and 7.2-PRERELEASE does not properly initialize memory for Berkeley DB 1.85 database structures, which allows local users to obtain sensitive information by reading a database file.Show less
CVE-2009-1189
1Freedesktop
1Dbus
Apr 23, 2026
Apr 27, 2009
N/A· v4
N/A· v3
3.6 LOW· v2
The _dbus_validate_signature_with_reason function (dbus-marshal-validate.c) in D-Bus (aka DBus) before 1.2.14 uses incorrect logic to validate a basic type, which allows remote attackers to spoof a signature via a crafte...Show more
The _dbus_validate_signature_with_reason function (dbus-marshal-validate.c) in D-Bus (aka DBus) before 1.2.14 uses incorrect logic to validate a basic type, which allows remote attackers to spoof a signature via a crafted key. NOTE: this is due to an incorrect fix for CVE-2008-3834.Show less
CVE-2009-0164
1Apple
1Cups
Apr 23, 2026
Apr 24, 2009
N/A· v4
N/A· v3
6.4 MEDIUM· v2
The web interface for CUPS before 1.3.10 does not validate the HTTP Host header in a client request, which makes it easier for remote attackers to conduct DNS rebinding attacks.