Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CVEs (13,695)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2008-6752 1Revou 1Revou Apr 23, 2026 Apr 24, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 adminlogin/password.php in the Twitter Clone (TClone) plugin for ReVou Micro Blogging does not verify the original password before changing passwords, which allows remote attackers to change the administrator's password...Show more adminlogin/password.php in the Twitter Clone (TClone) plugin for ReVou Micro Blogging does not verify the original password before changing passwords, which allows remote attackers to change the administrator's password and gain privileges via a direct request with modified newpass1 and newpass2 parameters in a Change operation.Show less
CVE-2008-6751 1Revou 1Tclone Apr 23, 2026 Apr 24, 2009 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Unrestricted file upload vulnerability in index.php in the Twitter Clone (TClone) plugin for ReVou Micro Blogging allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then a...Show more Unrestricted file upload vulnerability in index.php in the Twitter Clone (TClone) plugin for ReVou Micro Blogging allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in settings/my_photo.Show less
CVE-2008-6750 1China On Site 1Flexphpdirectory Apr 23, 2026 Apr 24, 2009 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Unrestricted file upload vulnerability in add.php in FlexPHPDirectory 0.0.1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to th...Show more Unrestricted file upload vulnerability in add.php in FlexPHPDirectory 0.0.1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in photo/.Show less
CVE-2009-1357 1Sun 1Java System Delegated Administrator Apr 23, 2026 Apr 23, 2009 N/A· v4 N/A· v3 6.8 MEDIUM· v2 CRLF injection vulnerability in da/DA/Login in Sun Java System Delegated Administrator 6.2 through 6.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the HELP_PAG...Show more CRLF injection vulnerability in da/DA/Login in Sun Java System Delegated Administrator 6.2 through 6.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the HELP_PAGE parameter.Show less
CVE-2009-0800 4Apple FoolabsGlyphandcog+1 more 4Cups PopplerXpdf+1 more Apr 23, 2026 Apr 23, 2009 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Multiple "input validation flaws" in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allow remote attackers to execute arbitrary code via a crafted PDF fil...Show more Multiple "input validation flaws" in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allow remote attackers to execute arbitrary code via a crafted PDF file.Show less
CVE-2008-6745 1Blogphp 1Blogphp Apr 23, 2026 Apr 23, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 index.php in BlogPHP 2.0 allows remote attackers to gain administrator privileges via a crafted email parameter in a register2 action.
CVE-2009-1371 1Clamav 1Clamav Apr 23, 2026 Apr 23, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The CLI_ISCONTAINED macro in libclamav/others.h in ClamAV before 0.95.1 allows remote attackers to cause a denial of service (application crash) via a malformed file with UPack encoding.
CVE-2009-1369 1Mozilo 1Mozilocms Apr 23, 2026 Apr 22, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 moziloCMS 1.11 allows remote attackers to obtain sensitive information via the (1) gal[] parameter to gallery.php, (2) page[] and (3) cat[] parameter to index.php, or (4) file[] parameter to download.php, which reveals t...Show more moziloCMS 1.11 allows remote attackers to obtain sensitive information via the (1) gal[] parameter to gallery.php, (2) page[] and (3) cat[] parameter to index.php, or (4) file[] parameter to download.php, which reveals the installation path in an error message.Show less
CVE-2009-1361 1Gscripts 1Dns Tools Apr 23, 2026 Apr 22, 2009 N/A· v4 N/A· v3 10.0 HIGH· v2 dig.php in GScripts.net DNS Tools allows remote attackers to execute arbitrary commands via shell metacharacters in the host parameter. NOTE: the provenance of this information is unknown; the details are obtained solely...Show more dig.php in GScripts.net DNS Tools allows remote attackers to execute arbitrary commands via shell metacharacters in the host parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.Show less
CVE-2009-1307 1Mozilla 3Firefox SeamonkeyThunderbird Apr 23, 2026 Apr 22, 2009 N/A· v4 N/A· v3 6.8 MEDIUM· v2 The view-source: URI implementation in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey does not properly implement the Same Origin Policy, which allows remote attackers to (1) bypass crossdomain.xml restrictions...Show more The view-source: URI implementation in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey does not properly implement the Same Origin Policy, which allows remote attackers to (1) bypass crossdomain.xml restrictions and connect to arbitrary web sites via a Flash file; (2) read, create, or modify Local Shared Objects via a Flash file; or (3) bypass unspecified restrictions and render content via vectors involving a jar: URI.Show less
CVE-2009-1336 1Linux 1Linux Kernel Apr 23, 2026 Apr 22, 2009 N/A· v4 N/A· v3 4.9 MEDIUM· v2 fs/nfs/client.c in the Linux kernel before 2.6.23 does not properly initialize a certain structure member that stores the maximum NFS filename length, which allows local users to cause a denial of service (OOPS) via a lo...Show more fs/nfs/client.c in the Linux kernel before 2.6.23 does not properly initialize a certain structure member that stores the maximum NFS filename length, which allows local users to cause a denial of service (OOPS) via a long filename, related to the encode_lookup function.Show less
CVE-2008-6742 1Gofoxy 1Foxy Apr 23, 2026 Apr 21, 2009 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Foxy P2P software allows remote attackers to cause a denial of service (memory consumption) via a foxy URI with a download action and a large fs value.
CVE-2009-1350 1Novell 1Netidentity Client1.2.3 Apr 23, 2026 Apr 21, 2009 N/A· v4 N/A· v3 10.0 HIGH· v2 Unspecified vulnerability in xtagent.exe in Novell NetIdentity Client before 1.2.4 allows remote attackers to execute arbitrary code by establishing an IPC$ connection to the XTIERRPCPIPE named pipe, and sending RPC mess...Show more Unspecified vulnerability in xtagent.exe in Novell NetIdentity Client before 1.2.4 allows remote attackers to execute arbitrary code by establishing an IPC$ connection to the XTIERRPCPIPE named pipe, and sending RPC messages that trigger a dereference of an arbitrary pointer.Show less
CVE-2008-6731 1China On Site 1Flexphplink Apr 23, 2026 Apr 20, 2009 N/A· v4 N/A· v3 9.3 HIGH· v2 Unrestricted file upload vulnerability in submitlink.php in FlexPHPLink Pro 0.0.7 allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct req...Show more Unrestricted file upload vulnerability in submitlink.php in FlexPHPLink Pro 0.0.7 allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request to the renamed file in linkphoto/.Show less
CVE-2009-1300 1Debian 1Advanced Package Tool Apr 23, 2026 Apr 16, 2009 N/A· v4 N/A· v3 10.0 HIGH· v2 apt 0.7.20 does not check when the date command returns an "invalid date" error, which can prevent apt from loading security updates in time zones for which DST occurs at midnight.
CVE-2009-0681 1Pgp 1Desktop Apr 23, 2026 Apr 15, 2009 N/A· v4 N/A· v3 7.2 HIGH· v2 PGP Desktop before 9.10 allows local users to (1) cause a denial of service (crash) via a crafted IOCTL request to pgpdisk.sys, and (2) cause a denial of service (crash) and execute arbitrary code via a crafted IRP in an...Show more PGP Desktop before 9.10 allows local users to (1) cause a denial of service (crash) via a crafted IOCTL request to pgpdisk.sys, and (2) cause a denial of service (crash) and execute arbitrary code via a crafted IRP in an IOCTL request to pgpwded.sys.Show less
CVE-2009-0089 1Microsoft 5Windows 2000 Windows Server 2003Windows Server 2008+2 more Apr 23, 2026 Apr 15, 2009 N/A· v4 N/A· v3 5.8 MEDIUM· v2 Windows HTTP Services (aka WinHTTP) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, and Vista Gold allows remote web servers to impersonate arbitrary https web sites by using DNS spoofing to "forw...Show more Windows HTTP Services (aka WinHTTP) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, and Vista Gold allows remote web servers to impersonate arbitrary https web sites by using DNS spoofing to "forward a connection" to a different https web site that has a valid certificate matching its own domain name, but not a certificate matching the domain name of the host requested by the user, aka "Windows HTTP Services Certificate Name Mismatch Vulnerability."Show less
CVE-2009-0088 1Microsoft 5Office Converter Pack Office WordWindows 2000+2 more Apr 23, 2026 Apr 15, 2009 N/A· v4 N/A· v3 9.3 HIGH· v2 The WordPerfect 6.x Converter (WPFT632.CNV, 1998.1.27.0) in Microsoft Office Word 2000 SP3 and Microsoft Office Converter Pack does not properly validate the length of an unspecified string, which allows remote attackers...Show more The WordPerfect 6.x Converter (WPFT632.CNV, 1998.1.27.0) in Microsoft Office Word 2000 SP3 and Microsoft Office Converter Pack does not properly validate the length of an unspecified string, which allows remote attackers to execute arbitrary code via a crafted WordPerfect 6.x file, related to an unspecified counter and control structures on the stack, aka "Word 2000 WordPerfect 6.x Converter Stack Corruption Vulnerability."Show less
CVE-2009-1268 1Wireshark 1Wireshark Apr 23, 2026 Apr 13, 2009 N/A· v4 N/A· v3 4.3 MEDIUM· v2 The Check Point High-Availability Protocol (CPHAP) dissector in Wireshark 0.9.6 through 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted FWHA_MY_STATE packet.
CVE-2008-6702 1Stalker Game 1S.t.a.l.k.e.r.\ Apr 23, 2026 Apr 10, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 S.T.A.L.K.E.R.: Shadow of Chernobyl 1.0006 and earlier allows remote attackers to cause a denial of service (crash) via a long nickname, which triggers an exception.

Previous 1...638639640...685 Next