Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CVEs (13,694)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2008-0527 1Cisco 2Session Initiation Protocol (sip) Firmware Skinny Client Control Protocol (sccp) Firmware Apr 23, 2026 Feb 15, 2008 N/A· v4 N/A· v3 7.8 HIGH· v2 The HTTP server in Cisco Unified IP Phone 7935 and 7936 running SCCP firmware allows remote attackers to cause a denial of service (reboot) via a crafted HTTP request.
CVE-2008-0526 1Cisco 2Session Initiation Protocol (sip) Firmware Skinny Client Control Protocol (sccp) Firmware Apr 23, 2026 Feb 15, 2008 N/A· v4 N/A· v3 7.8 HIGH· v2 Cisco Unified IP Phone 7940, 7940G, 7960, and 7960G running SCCP firmware allows remote attackers to cause a denial of service (reboot) via a long ICMP echo request (ping) packet.
CVE-2008-0105 1Microsoft 2Office Works Apr 23, 2026 Feb 12, 2008 N/A· v4 N/A· v3 9.3 HIGH· v2 Microsoft Works 6 File Converter, as used in Office 2003 SP2 and SP3, Works 8.0, and Works Suite 2005, allows remote attackers to execute arbitrary code via a .wps file with crafted section header index table information...Show more Microsoft Works 6 File Converter, as used in Office 2003 SP2 and SP3, Works 8.0, and Works Suite 2005, allows remote attackers to execute arbitrary code via a .wps file with crafted section header index table information, aka "Microsoft Works File Converter Index Table Vulnerability."Show less
CVE-2007-0216 1Microsoft 2Office Works Apr 23, 2026 Feb 12, 2008 N/A· v4 N/A· v3 9.3 HIGH· v2 wkcvqd01.dll in Microsoft Works 6 File Converter, as used in Office 2003 SP2, Works 8.0, and Works Suite 2005, allows remote attackers to execute arbitrary code via a .wps file with crafted section length headers, aka "M...Show more wkcvqd01.dll in Microsoft Works 6 File Converter, as used in Office 2003 SP2, Works 8.0, and Works Suite 2005, allows remote attackers to execute arbitrary code via a .wps file with crafted section length headers, aka "Microsoft Works File Converter Input Validation Vulnerability."Show less
CVE-2008-0088 1Microsoft 3Windows 2000 Windows 2003 ServerWindows Xp Apr 23, 2026 Feb 12, 2008 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Unspecified vulnerability in Active Directory on Microsoft Windows 2000 and Windows Server 2003, and Active Directory Application Mode (ADAM) on XP and Server 2003, allows remote attackers to cause a denial of service (h...Show more Unspecified vulnerability in Active Directory on Microsoft Windows 2000 and Windows Server 2003, and Active Directory Application Mode (ADAM) on XP and Server 2003, allows remote attackers to cause a denial of service (hang and restart) via a crafted LDAP request.Show less
CVE-2008-0010 1Linux 1Linux Kernel Apr 23, 2026 Feb 12, 2008 N/A· v4 N/A· v3 2.1 LOW· v2 The copy_from_user_mmap_sem function in fs/splice.c in the Linux kernel 2.6.22 through 2.6.24 does not validate a certain userspace pointer before dereference, which allow local users to read from arbitrary kernel memory...Show more The copy_from_user_mmap_sem function in fs/splice.c in the Linux kernel 2.6.22 through 2.6.24 does not validate a certain userspace pointer before dereference, which allow local users to read from arbitrary kernel memory locations.Show less
CVE-2008-0009 1Linux 1Linux Kernel Apr 23, 2026 Feb 12, 2008 N/A· v4 N/A· v3 2.1 LOW· v2 The vmsplice_to_user function in fs/splice.c in the Linux kernel 2.6.22 through 2.6.24 does not validate a certain userspace pointer before dereference, which might allow local users to access arbitrary kernel memory loc...Show more The vmsplice_to_user function in fs/splice.c in the Linux kernel 2.6.22 through 2.6.24 does not validate a certain userspace pointer before dereference, which might allow local users to access arbitrary kernel memory locations.Show less
CVE-2008-0718 1Sun 1Solaris Apr 23, 2026 Feb 12, 2008 N/A· v4 N/A· v3 4.7 MEDIUM· v2 Unspecified vulnerability in the USB Mouse STREAMS module (usbms) in Sun Solaris 9 and 10, when 64-bit mode is enabled, allows local users to cause a denial of service (panic) via unspecified vectors.
CVE-2008-0672 1Tintin 2Tintin++ Wintin++ Apr 23, 2026 Feb 12, 2008 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The process_chat_input function in TinTin++ 1.97.9 and WinTin++ 1.97.9 allows remote attackers to cause a denial of service (application crash) via a YES message without a newline character, which triggers a NULL derefer...Show more The process_chat_input function in TinTin++ 1.97.9 and WinTin++ 1.97.9 allows remote attackers to cause a denial of service (application crash) via a YES message without a newline character, which triggers a NULL dereference.Show less
CVE-2008-0414 1Mozilla 2Firefox Seamonkey Apr 23, 2026 Feb 8, 2008 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Mozilla Firefox before 2.0.0.12 and SeaMonkey before 1.1.8 allows user-assisted remote attackers to trick the user into uploading arbitrary files via label tags that shift focus to a file input field, aka "focus spoofing...Show more Mozilla Firefox before 2.0.0.12 and SeaMonkey before 1.1.8 allows user-assisted remote attackers to trick the user into uploading arbitrary files via label tags that shift focus to a file input field, aka "focus spoofing."Show less
CVE-2008-0656 1Emc 2Documentum Administrator Documentum Webtop Apr 23, 2026 Feb 7, 2008 N/A· v4 N/A· v3 10.0 HIGH· v2 Unrestricted file upload vulnerability in dmclTrace.jsp in EMC Documentum Administrator 5.3.0.313 and Webtop 5.3.0.317 allows remote attackers to overwrite arbitrary files via the filename attribute.
CVE-2008-0457 1Symantec 1Backupexec System Recovery Apr 23, 2026 Feb 7, 2008 N/A· v4 N/A· v3 10.0 HIGH· v2 Unrestricted file upload vulnerability in the FileUpload class running on the Symantec LiveState Apache Tomcat server, as used by Symantec Backup Exec System Recovery Manager 7.0 and 7.0.1, allows remote attackers to upl...Show more Unrestricted file upload vulnerability in the FileUpload class running on the Symantec LiveState Apache Tomcat server, as used by Symantec Backup Exec System Recovery Manager 7.0 and 7.0.1, allows remote attackers to upload and execute arbitrary JSP files via unknown vectors.Show less
CVE-2008-0631 1Afterlogic 1Mailbee Objects Apr 23, 2026 Feb 6, 2008 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Multiple ActiveX controls in MailBee.dll in MailBee Objects 5.5 allow remote attackers to (1) overwrite arbitrary files via the SaveToDisk method, or (2) modify files via the AddStringToFile method.
CVE-2008-0570 1Drupal 1Openid Apr 23, 2026 Feb 5, 2008 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The OpenID 5.x-1.0 and earlier module for Drupal does not properly verify the claimed_id returned by an OpenID provider, which allows remote OpenID providers to spoof OpenID authentication for domains associated with oth...Show more The OpenID 5.x-1.0 and earlier module for Drupal does not properly verify the claimed_id returned by an OpenID provider, which allows remote OpenID providers to spoof OpenID authentication for domains associated with other providers.Show less
CVE-2007-4130 1Redhat 2Enterprise Linux Enterprise Linux Desktop Apr 23, 2026 Feb 5, 2008 N/A· v4 N/A· v3 7.2 HIGH· v2 The Linux kernel 2.6.9 before 2.6.9-67 in Red Hat Enterprise Linux (RHEL) 4 on Itanium (ia64) does not properly handle page faults during NUMA memory access, which allows local users to cause a denial of service (panic)...Show more The Linux kernel 2.6.9 before 2.6.9-67 in Red Hat Enterprise Linux (RHEL) 4 on Itanium (ia64) does not properly handle page faults during NUMA memory access, which allows local users to cause a denial of service (panic) via invalid arguments to set_mempolicy in an MPOL_BIND operation.Show less
CVE-2008-0386 1Gentoo 1Xdg Utils Apr 23, 2026 Feb 4, 2008 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Xdg-utils 1.0.2 and earlier allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a URL argument to (1) xdg-open or (2) xdg-email.
CVE-2008-0506 1Coppermine 1Coppermine Photo Gallery Apr 23, 2026 Jan 31, 2008 N/A· v4 N/A· v3 6.8 MEDIUM· v2 include/imageObjectIM.class.php in Coppermine Photo Gallery (CPG) before 1.4.15, when the ImageMagick picture processing method is configured, allows remote attackers to execute arbitrary commands via shell metacharacter...Show more include/imageObjectIM.class.php in Coppermine Photo Gallery (CPG) before 1.4.15, when the ImageMagick picture processing method is configured, allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) quality, (2) angle, or (3) clipval parameter to picEditor.php.Show less
CVE-2008-0475 1Manageengine 1Applications Manager Apr 23, 2026 Jan 29, 2008 N/A· v4 N/A· v3 5.0 MEDIUM· v2 ManageEngine Applications Manager 8.1 build 8100 allows remote attackers to obtain sensitive information ( Home->Summary) via an invalid URI, as demonstrated by the "/-" URI. NOTE: the provenance of this information is...Show more ManageEngine Applications Manager 8.1 build 8100 allows remote attackers to obtain sensitive information ( Home->Summary) via an invalid URI, as demonstrated by the "/-" URI. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.Show less
CVE-2008-0473 1Web Wiz 1Rich Text Editor Apr 23, 2026 Jan 29, 2008 N/A· v4 N/A· v3 6.4 MEDIUM· v2 RTE_popup_save_file.asp in Web Wiz Rich Text Editor 4.0 allows remote attackers to upload (1) .html and (2) .htm files via unspecified vectors.
CVE-2008-0406 1Hfs 1Http File Server Apr 23, 2026 Jan 29, 2008 N/A· v4 N/A· v3 5.0 MEDIUM· v2 HTTP File Server (HFS) before 2.2c, when account names are used as log filenames, allows remote attackers to cause a denial of service (daemon crash) via a long account name.

Previous 1...662663664...685 Next