← Back
CWE-20

13,694 CVEs • Abstraction: Class • Likelihood of Exploit: High

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

JSON object

Loading...

CVEs (13,694)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2008-0008
1Pulseaudio
1Pulseaudio
Apr 23, 2026
Jan 29, 2008
N/A· v4
N/A· v3
7.2 HIGH· v2
The pa_drop_root function in PulseAudio 0.9.8, and a certain 0.9.9 build, does not check return values from (1) setresuid, (2) setreuid, (3) setuid, and (4) seteuid calls when attempting to drop privileges, which might a...Show more
The pa_drop_root function in PulseAudio 0.9.8, and a certain 0.9.9 build, does not check return values from (1) setresuid, (2) setreuid, (3) setuid, and (4) seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail via attacks such as resource exhaustion.Show less
CVE-2008-0373
1Php
1F1 Maxs File Uploader
Apr 23, 2026
Jan 22, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
Unrestricted file upload vulnerability in PHP F1 Max's File Uploader allows remote attackers to upload and execute arbitrary PHP files.
CVE-2008-0172
1Boost
1Boost
Apr 23, 2026
Jan 17, 2008
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The get_repeat_type function in basic_regex_creator.hpp in the Boost regex library (aka Boost.Regex) in Boost 1.33 and 1.34 allows context-dependent attackers to cause a denial of service (NULL dereference and crash) via...Show more
The get_repeat_type function in basic_regex_creator.hpp in the Boost regex library (aka Boost.Regex) in Boost 1.33 and 1.34 allows context-dependent attackers to cause a denial of service (NULL dereference and crash) via an invalid regular expression.Show less
CVE-2008-0171
1Boost
2Boost
Boost Regex Library
Apr 23, 2026
Jan 17, 2008
N/A· v4
N/A· v3
5.0 MEDIUM· v2
regex/v4/perl_matcher_non_recursive.hpp in the Boost regex library (aka Boost.Regex) in Boost 1.33 and 1.34 allows context-dependent attackers to cause a denial of service (failed assertion and crash) via an invalid regu...Show more
regex/v4/perl_matcher_non_recursive.hpp in the Boost regex library (aka Boost.Regex) in Boost 1.33 and 1.34 allows context-dependent attackers to cause a denial of service (failed assertion and crash) via an invalid regular expression.Show less
CVE-2008-0331
1Funkwerk
1System Software
Apr 23, 2026
Jan 17, 2008
N/A· v4
N/A· v3
7.8 HIGH· v2
Unspecified vulnerability in Funkwerk System Software before 7.4.1 PATCH 9 for certain Funkwerk Router / VPN devices allows remote attackers to cause a denial of service (panic and reboot) via unspecified DNS requests.
CVE-2007-6689
1Menalto
1Gallery
Apr 23, 2026
Jan 17, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
Menalto Gallery before 2.2.4 does not properly check for malicious file extensions during file uploads, which allows attackers to execute arbitrary code via the (1) Core application or (2) MIME module.
CVE-2007-6684
1Videolan
1Vlc
Apr 23, 2026
Jan 17, 2008
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The RTSP module in VideoLAN VLC 0.8.6d allows remote attackers to cause a denial of service (crash) via a request without a Transport parameter, which triggers a NULL pointer dereference.
CVE-2008-0298
1Apple
1Safari
Apr 23, 2026
Jan 16, 2008
N/A· v4
N/A· v3
4.3 MEDIUM· v2
KHTML WebKit as used in Apple Safari 2.x allows remote attackers to cause a denial of service (browser crash) via a crafted web page, possibly involving a STYLE attribute of a DIV element.
CVE-2007-5658
1Tibco
3Enterprise Message Service
RtworksSmartsockets Rtserver
Apr 23, 2026
Jan 16, 2008
N/A· v4
N/A· v3
10.0 HIGH· v2
Heap-based buffer overflow in TIBCO SmartSockets RTserver 6.8.0 and earlier, RTworks before 4.0.4, and Enterprise Message Service (EMS) 4.0.0 through 4.4.1 allows remote attackers to execute arbitrary code via crafted re...Show more
Heap-based buffer overflow in TIBCO SmartSockets RTserver 6.8.0 and earlier, RTworks before 4.0.4, and Enterprise Message Service (EMS) 4.0.0 through 4.4.1 allows remote attackers to execute arbitrary code via crafted requests containing size and copy-length values that trigger the overflow.Show less
CVE-2007-5657
1Tibco
3Enterprise Message Service
RtworksSmartsockets Rtserver
Apr 23, 2026
Jan 16, 2008
N/A· v4
N/A· v3
10.0 HIGH· v2
TIBCO SmartSockets RTserver 6.8.0 and earlier, RTworks before 4.0.4, and Enterprise Message Service (EMS) 4.0.0 through 4.4.1 allows remote attackers to execute arbitrary code via crafted requests containing values that...Show more
TIBCO SmartSockets RTserver 6.8.0 and earlier, RTworks before 4.0.4, and Enterprise Message Service (EMS) 4.0.0 through 4.4.1 allows remote attackers to execute arbitrary code via crafted requests containing values that are used as pointer offsets.Show less
CVE-2008-0277
1Drupal
1Fileshare Module
Apr 23, 2026
Jan 15, 2008
N/A· v4
N/A· v3
8.5 HIGH· v2
Unspecified vulnerability in the Fileshare module for Drupal allows remote authenticated users with node-creation privileges to execute arbitrary code via unspecified vectors.
CVE-2008-0264
1Drupal
1Meta Tags Module
Apr 23, 2026
Jan 15, 2008
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Unspecified vulnerability in the Meta Tags (aka Nodewords) 5.x-1.6 module for Drupal, when images are permitted in node bodies, allows remote authenticated users to execute arbitrary code via unspecified vectors involvin...Show more
Unspecified vulnerability in the Meta Tags (aka Nodewords) 5.x-1.6 module for Drupal, when images are permitted in node bodies, allows remote authenticated users to execute arbitrary code via unspecified vectors involving creation of a node.Show less
CVE-2008-0260
1Minimal Design
1Minimal Gallery
Apr 23, 2026
Jan 15, 2008
N/A· v4
N/A· v3
5.0 MEDIUM· v2
minimal Gallery 0.8 allows remote attackers to obtain configuration information via a direct request to php_info.php, which calls the phpinfo function.
CVE-2008-0251
1Photopost
1Photopost Vbgallery
Apr 23, 2026
Jan 12, 2008
N/A· v4
N/A· v3
10.0 HIGH· v2
Unrestricted file upload vulnerability in PhotoPost vBGallery before 2.4.2 allows remote attackers to upload and execute arbitrary files via unknown vectors.
CVE-2008-0244
1Sap
1Maxdb
Apr 23, 2026
Jan 12, 2008
N/A· v4
N/A· v3
10.0 HIGH· v2
SAP MaxDB 7.6.03 build 007 and earlier allows remote attackers to execute arbitrary commands via "&&" and other shell metacharacters in exec_sdbinfo and other unspecified commands, which are executed when MaxDB invokes c...Show more
SAP MaxDB 7.6.03 build 007 and earlier allows remote attackers to execute arbitrary commands via "&&" and other shell metacharacters in exec_sdbinfo and other unspecified commands, which are executed when MaxDB invokes cons.exe.Show less
CVE-2008-0241
1Sun
1Java System Identity Manager
Apr 23, 2026
Jan 11, 2008
N/A· v4
N/A· v3
5.8 MEDIUM· v2
Open redirect vulnerability in /idm/user/login.jsp in Sun Java System Identity Manager 6.0 SP1 through SP3, 7.0, and 7.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a...Show more
Open redirect vulnerability in /idm/user/login.jsp in Sun Java System Identity Manager 6.0 SP1 through SP3, 7.0, and 7.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the nextPage parameter.Show less
CVE-2008-0237
1Microsoft
1Rich Textbox Control
Apr 23, 2026
Jan 11, 2008
N/A· v4
N/A· v3
6.8 MEDIUM· v2
The Microsoft Rich Textbox ActiveX Control (RICHTX32.OCX) 6.1.97.82 allows remote attackers to execute arbitrary commands by invoking the insecure SaveFile method.
CVE-2008-0209
1Snitz Communications
1Snitz Forums 2000
Apr 23, 2026
Jan 10, 2008
N/A· v4
N/A· v3
5.8 MEDIUM· v2
Open redirect vulnerability in Forums/login.asp in Snitz Forums 2000 3.4.06 and earlier allows remote attackers to redirect users to arbitrary web sites via a URL in the target parameter.
CVE-2008-0199
1Pro Search
1Pro Search
Apr 23, 2026
Jan 10, 2008
N/A· v4
N/A· v3
5.0 MEDIUM· v2
PRO-Search 0.17 and earlier allows remote attackers to cause a denial of service via certain values of the show_page and time parameters to the default URI.
CVE-2007-0012
1Sun
1Jre
Apr 23, 2026
Jan 9, 2008
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Sun JRE 5.0 before update 14 allows remote attackers to cause a denial of service (Internet Explorer crash) via an object tag with an encoded applet and an undefined name attribute, which triggers a NULL pointer derefere...Show more
Sun JRE 5.0 before update 14 allows remote attackers to cause a denial of service (Internet Explorer crash) via an object tag with an encoded applet and an undefined name attribute, which triggers a NULL pointer dereference in jpiexp32.dll when the applet is decoded and passed to the JVM.Show less