Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CVEs (13,695)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2008-6555 1Puppetmaster 1Webutil Apr 23, 2026 Mar 30, 2009 N/A· v4 N/A· v3 10.0 HIGH· v2 cgi-bin/webutil.pl in The Puppet Master WebUtil allows remote attackers to execute arbitrary commands via shell metacharacters in the dig command.
CVE-2008-6547 1Formencode 1Formencode Apr 23, 2026 Mar 30, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 schema.py in FormEncode for Python (python-formencode) 1.0 does not apply the chained_validators feature, which allows attackers to bypass intended access restrictions via unknown vectors.
CVE-2008-6541 2Dnnsoftware Dotnetnuke 2Dotnetnuke Dotnetnuke Apr 24, 2026 Mar 30, 2009 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Unrestricted file upload vulnerability in the file manager module in DotNetNuke before 4.8.2 allows remote administrators to upload arbitrary files and gain privileges to the server via unspecified vectors.
CVE-2008-6538 1Holger Schurig 1Destar Apr 23, 2026 Mar 30, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 DeStar 0.2.2-5 allows remote attackers to add arbitrary users via a direct request to config/add/CfgOptUser.
CVE-2009-0845 1Mit 2Kerberos Kerberos 5 Apr 23, 2026 Mar 27, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The spnego_gss_accept_sec_context function in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3, when SPNEGO is used, allows remote attackers to cause a denial of service (NULL pointer derefe...Show more The spnego_gss_accept_sec_context function in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3, when SPNEGO is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via invalid ContextFlags data in the reqFlags field in a negTokenInit token.Show less
CVE-2008-6534 1Vwsolutions 1Null Ftp Apr 23, 2026 Mar 26, 2009 N/A· v4 N/A· v3 7.1 HIGH· v2 Incomplete blacklist vulnerability in NULL FTP Server Free and Pro 1.1.0.7 allows remote authenticated users to execute arbitrary commands via a custom SITE command containing shell metacharacters such as "&" (ampersand)...Show more Incomplete blacklist vulnerability in NULL FTP Server Free and Pro 1.1.0.7 allows remote authenticated users to execute arbitrary commands via a custom SITE command containing shell metacharacters such as "&" (ampersand) in the middle of an argument.Show less
CVE-2009-1149 1Phpmyadmin 1Phpmyadmin Apr 23, 2026 Mar 26, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 CRLF injection vulnerability in bs_disp_as_mime_type.php in the BLOB streaming feature in phpMyAdmin before 3.1.3.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via...Show more CRLF injection vulnerability in bs_disp_as_mime_type.php in the BLOB streaming feature in phpMyAdmin before 3.1.3.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the (1) c_type and possibly (2) file_type parameters.Show less
CVE-2008-6528 1Tmaxsoft 1Jeus Apr 23, 2026 Mar 26, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 NTFS TmaxSoft JEUS 5 before Fix 26 allows remote attackers to read the source code for scripts by appending ::$DATA to the URL, which accesses the alternate data stream.
CVE-2009-1106 1Sun 2Jdk Jre Apr 23, 2026 Mar 25, 2009 N/A· v4 N/A· v3 6.4 MEDIUM· v2 The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12, 11, and 10 does not properly parse crossdomain.xml files, which allows remote attackers to bypass intended access restrict...Show more The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12, 11, and 10 does not properly parse crossdomain.xml files, which allows remote attackers to bypass intended access restrictions and connect to arbitrary sites via unknown vectors, aka CR 6798948.Show less
CVE-2009-1087 1Pplive 1Pplive Apr 23, 2026 Mar 25, 2009 N/A· v4 N/A· v3 9.3 HIGH· v2 Multiple argument injection vulnerabilities in PPLive.exe in PPLive 1.9.21 and earlier allow remote attackers to execute arbitrary code via a UNC share pathname in the LoadModule argument to the (1) synacast, (2) Play, (...Show more Multiple argument injection vulnerabilities in PPLive.exe in PPLive 1.9.21 and earlier allow remote attackers to execute arbitrary code via a UNC share pathname in the LoadModule argument to the (1) synacast, (2) Play, (3) pplsv, or (4) ppvod URI handler. NOTE: some of these details are obtained from third party information.Show less
CVE-2009-1082 1Sun 1Java System Identity Manager Apr 23, 2026 Mar 25, 2009 N/A· v4 N/A· v3 9.0 HIGH· v2 Sun Java System Identity Manager (IdM) 7.0 through 8.0 allows remote authenticated users to gain privileges by submitting crafted commands to the Admin Console, as demonstrated by privileges for account creation and othe...Show more Sun Java System Identity Manager (IdM) 7.0 through 8.0 allows remote authenticated users to gain privileges by submitting crafted commands to the Admin Console, as demonstrated by privileges for account creation and other administrative capabilities, related to the saveNoValidate action and saveNoValidateAllowedFormsAndWorkflows IDs.Show less
CVE-2009-1062 1Adobe 3Acrobat Acrobat ReaderReader Apr 23, 2026 Mar 25, 2009 N/A· v4 N/A· v3 9.3 HIGH· v2 Adobe Acrobat Reader 9 before 9.1, 8 before 8.1.4, and 7 before 7.1.1 might allow remote attackers to trigger memory corruption and possibly execute arbitrary code via unknown attack vectors related to JBIG2, a different...Show more Adobe Acrobat Reader 9 before 9.1, 8 before 8.1.4, and 7 before 7.1.1 might allow remote attackers to trigger memory corruption and possibly execute arbitrary code via unknown attack vectors related to JBIG2, a different vulnerability than CVE-2009-0193 and CVE-2009-1061.Show less
CVE-2009-1061 1Adobe 1Acrobat Reader Apr 23, 2026 Mar 25, 2009 N/A· v4 N/A· v3 9.3 HIGH· v2 Unspecified vulnerability in Adobe Acrobat Reader 9 before 9.1, 8 before 8.1.4, and 7 before 7.1.1 might allow remote attackers to execute arbitrary code via unknown attack vectors related to JBIG2 and "input validation,...Show more Unspecified vulnerability in Adobe Acrobat Reader 9 before 9.1, 8 before 8.1.4, and 7 before 7.1.1 might allow remote attackers to execute arbitrary code via unknown attack vectors related to JBIG2 and "input validation," a different vulnerability than CVE-2009-0193 and CVE-2009-1062.Show less
CVE-2008-6511 1Igniterealtime 1Openfire Apr 23, 2026 Mar 23, 2009 N/A· v4 N/A· v3 5.8 MEDIUM· v2 Open redirect vulnerability in login.jsp in Openfire 3.6.0a and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the url parameter.
CVE-2009-1045 1Videolan 1Vlc Media Player Apr 23, 2026 Mar 23, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 requests/status.xml in VLC 0.9.8a allows remote attackers to cause a denial of service (stack consumption and crash) via a long input argument in an in_play action.
CVE-2008-6504 2Apache Opensymphony 2Struts Xwork Apr 23, 2026 Mar 23, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows re...Show more ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute Object-Graph Navigation Language (OGNL) statements and modify server-side context objects, as demonstrated by use of a \u0023 representation for the # character.Show less
CVE-2008-6497 1Tp 1Neostrada Livebox Adsl Router Apr 23, 2026 Mar 20, 2009 N/A· v4 N/A· v3 7.8 HIGH· v2 The Neostrada Livebox ADSL Router allows remote attackers to cause a denial of service (network outage) via multiple HTTP requests for the /- URI.
CVE-2008-6492 1Tizag 1Tizag Countdown Creator Apr 23, 2026 Mar 20, 2009 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Unrestricted file upload vulnerability in process.php in Tizag Countdown Creator 3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension via index.php, then accessing the uplo...Show more Unrestricted file upload vulnerability in process.php in Tizag Countdown Creator 3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension via index.php, then accessing the uploaded file via a direct request to the file in pics/. NOTE: some of these details are obtained from third party information.Show less
CVE-2009-0927 1Adobe 1Acrobat Reader Apr 22, 2026 Mar 19, 2009 N/A· v4 8.8 HIGH· v3 9.3 HIGH· v2 Stack-based buffer overflow in Adobe Reader and Adobe Acrobat 9 before 9.1, 8 before 8.1.3 , and 7 before 7.1.1 allows remote attackers to execute arbitrary code via a crafted argument to the getIcon method of a Collab o...Show more Stack-based buffer overflow in Adobe Reader and Adobe Acrobat 9 before 9.1, 8 before 8.1.3 , and 7 before 7.1.1 allows remote attackers to execute arbitrary code via a crafted argument to the getIcon method of a Collab object, a different vulnerability than CVE-2009-0658.Show less
CVE-2009-0661 1Flashtux 1Weechat Apr 23, 2026 Mar 19, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Wee Enhanced Environment for Chat (WeeChat) 0.2.6 allows remote attackers to cause a denial of service (crash) via an IRC PRIVMSG command containing crafted color codes that trigger an out-of-bounds read.

Previous 1...640641642...685 Next