Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CVEs (13,694)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2007-6146 1Hitachi 1Jp1 File Transmission Server Apr 23, 2026 Nov 27, 2007 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Hitachi JP1/File Transmission Server/FTP 01-00 through 08-10-02 on Windows might allow remote attackers to cause a denial of service (service stop) via a "specific file" argument to an FTP command.
CVE-2007-6133 1Devmass 1Devmass Cart Apr 23, 2026 Nov 27, 2007 N/A· v4 N/A· v3 5.8 MEDIUM· v2 PHP remote file inclusion vulnerability in admin/kfm/initialise.php in DevMass Shopping Cart 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the kfm_base_path parameter.
CVE-2007-6129 1Amber Script 1Amber Script Apr 23, 2026 Nov 26, 2007 N/A· v4 N/A· v3 5.8 MEDIUM· v2 Directory traversal vulnerability in scripts/include/show_content.php in Amber Script 1.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the id parameter. NOTE: in some enviro...Show more Directory traversal vulnerability in scripts/include/show_content.php in Amber Script 1.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the id parameter. NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp, ftps, or ssh2.sftp URL.Show less
CVE-2007-6122 1Irc Services 1Irc Services Apr 23, 2026 Nov 26, 2007 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The default_encrypt function in encrypt.c in IRC Services before 5.0.63, and 5.1.x before 5.1.7, allows remote attackers to cause a denial of service (daemon crash) via a long password. NOTE: some of these details are o...Show more The default_encrypt function in encrypt.c in IRC Services before 5.0.63, and 5.1.x before 5.1.7, allows remote attackers to cause a denial of service (daemon crash) via a long password. NOTE: some of these details are obtained from third party information.Show less
CVE-2007-6121 2Ethereal Group Wireshark 2Ethereal Wireshark Apr 23, 2026 Nov 23, 2007 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Wireshark (formerly Ethereal) 0.8.16 to 0.99.6 allows remote attackers to cause a denial of service (crash) via a malformed RPC Portmap packet.
CVE-2007-6103 1Ihu 1I Hear U Apr 23, 2026 Nov 23, 2007 N/A· v4 N/A· v3 5.0 MEDIUM· v2 I Hear U (IHU) 0.5.6 and earlier allows remote attackers to cause (1) a denial of service (infinite loop) via a packet that contains zero in the size field in its header, which is improperly handled by the Receiver::proc...Show more I Hear U (IHU) 0.5.6 and earlier allows remote attackers to cause (1) a denial of service (infinite loop) via a packet that contains zero in the size field in its header, which is improperly handled by the Receiver::processPacket function; and (2) a denial of service (daemon crash) via an (a) IHU_INFO_INIT or a (b) IHU_INFO_RING packet that does not specify the mode, which is improperly handled by the Player::ring function in Player.cpp.Show less
CVE-2007-6101 1Code Crafters 1Ability Mail Server Apr 23, 2026 Nov 23, 2007 N/A· v4 N/A· v3 4.0 MEDIUM· v2 Ability Mail Server before 2.61 allows remote authenticated users to cause a denial of service (daemon crash) via (1) malformed number list ranges in unspecified IMAP commands, and possibly (2) a blank string in unspecif...Show more Ability Mail Server before 2.61 allows remote authenticated users to cause a denial of service (daemon crash) via (1) malformed number list ranges in unspecified IMAP commands, and possibly (2) a blank string in unspecified messages.Show less
CVE-2007-6094 1Ingate 2Ingate Firewall Ingate Siparator Apr 23, 2026 Nov 22, 2007 N/A· v4 N/A· v3 4.3 MEDIUM· v2 The IPsec module in the VPN component in Ingate Firewall before 4.6.0 and SIParator before 4.6.0 allows remote attackers to cause a denial of service (module crash) via an IPsec Phase 2 proposal that lacks Perfect Forwar...Show more The IPsec module in the VPN component in Ingate Firewall before 4.6.0 and SIParator before 4.6.0 allows remote attackers to cause a denial of service (module crash) via an IPsec Phase 2 proposal that lacks Perfect Forward Secrecy (PFS).Show less
CVE-2007-6093 1Ingate 2Ingate Firewall Ingate Siparator Apr 23, 2026 Nov 22, 2007 N/A· v4 N/A· v3 7.1 HIGH· v2 The SRTP implementation in Ingate Firewall before 4.6.0 and SIParator before 4.6.0 allows remote attackers to cause a denial of service (kernel crash) via an RTCP index that is "much more than expected."
CVE-2007-6062 1Ngircd 1Ngircd Apr 23, 2026 Nov 20, 2007 N/A· v4 N/A· v3 5.0 MEDIUM· v2 irc-channel.c in ngIRCd before 0.10.3 allows remote attackers to cause a denial of service (crash) via a JOIN command without a channel argument.
CVE-2007-6060 1Ahnlab 1V3 Internet Security Apr 23, 2026 Nov 20, 2007 N/A· v4 N/A· v3 9.3 HIGH· v2 AhnLab Antivirus 3 Internet Security 2008 Platinum appends data to a filename string at a location indicated by the "Filename length" field in a ZIP header, which allows remote attackers to cause a denial of service (mac...Show more AhnLab Antivirus 3 Internet Security 2008 Platinum appends data to a filename string at a location indicated by the "Filename length" field in a ZIP header, which allows remote attackers to cause a denial of service (machine crash) and possibly execute arbitrary code via a ZIP file in which this field's value is larger than the actual number of bytes in the filename.Show less
CVE-2007-6039 1Php 1Php Apr 23, 2026 Nov 20, 2007 N/A· v4 N/A· v3 2.1 LOW· v2 PHP 5.2.5 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a long string in (1) the domain parameter to the dgettext function, the message parameter to the (2) dcgettext...Show more PHP 5.2.5 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a long string in (1) the domain parameter to the dgettext function, the message parameter to the (2) dcgettext or (3) gettext function, the msgid1 parameter to the (4) dngettext or (5) ngettext function, or (6) the classname parameter to the stream_wrapper_register function. NOTE: this might not be a vulnerability in most web server environments that support multiple threads, unless this issue can be demonstrated for code execution.Show less
CVE-2007-6036 1Live555 1Media Server Apr 23, 2026 Nov 20, 2007 N/A· v4 N/A· v3 7.1 HIGH· v2 The parseRTSPRequestString function in LIVE555 Media Server 2007.11.01 and earlier allows remote attackers to cause a denial of service (daemon crash) via a short RTSP query, which causes a negative number to be used dur...Show more The parseRTSPRequestString function in LIVE555 Media Server 2007.11.01 and earlier allows remote attackers to cause a denial of service (daemon crash) via a short RTSP query, which causes a negative number to be used during memory allocation.Show less
CVE-2007-6010 1Pioneers 1Pioneers Apr 23, 2026 Nov 15, 2007 N/A· v4 N/A· v3 7.8 HIGH· v2 Unspecified vulnerability in pioneers (formerly gnocatan) 0.11.3 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors that trigger an assert error. NOTE: this issue reportedly exis...Show more Unspecified vulnerability in pioneers (formerly gnocatan) 0.11.3 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors that trigger an assert error. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2007-5933.Show less
CVE-2007-4344 1Acdsee 3Photo Editor Photo ManagerPro Photo Manager Apr 23, 2026 Nov 15, 2007 N/A· v4 N/A· v3 9.3 HIGH· v2 Multiple input validation errors in ACD ACDSee Photo Manager 9.0 build 108, Pro Photo Manager 8.1 build 99, and Photo Editor 4.0 build 195 allow user-assisted remote attackers to execute arbitrary code via a long section...Show more Multiple input validation errors in ACD ACDSee Photo Manager 9.0 build 108, Pro Photo Manager 8.1 build 99, and Photo Editor 4.0 build 195 allow user-assisted remote attackers to execute arbitrary code via a long section string in (1) a PSP image to the ID_PSP.apl plug-in or (2) an LHA archive to the AM_LHA.apl plug-in, resulting in a heap-based buffer overflow.Show less
CVE-2007-4695 1Apple 2Mac Os X Mac Os X Server Apr 23, 2026 Nov 15, 2007 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Unspecified "input validation" vulnerability in WebCore in Apple Mac OS X 10.4 through 10.4.10 allows remote attackers to modify form field values via unknown vectors related to file uploads.
CVE-2007-5984 1Justin Hagstrom 1Autoindex Php Script Apr 23, 2026 Nov 15, 2007 N/A· v4 N/A· v3 7.8 HIGH· v2 classes/Url.php in Justin Hagstrom AutoIndex PHP Script before 2.2.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via a %00 sequence in the dir parameter to index.php, which triggers...Show more classes/Url.php in Justin Hagstrom AutoIndex PHP Script before 2.2.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via a %00 sequence in the dir parameter to index.php, which triggers an erroneous "recursive calculation."Show less
CVE-2007-5667 1Novell 1Client Apr 23, 2026 Nov 14, 2007 N/A· v4 N/A· v3 7.2 HIGH· v2 NWFILTER.SYS in Novell Client 4.91 SP 1 through SP 4 for Windows 2000, XP, and Server 2003 makes the \.\nwfilter device available for arbitrary user-mode input via METHOD_NEITHER IOCTLs, which allows local users to gain...Show more NWFILTER.SYS in Novell Client 4.91 SP 1 through SP 4 for Windows 2000, XP, and Server 2003 makes the \.\nwfilter device available for arbitrary user-mode input via METHOD_NEITHER IOCTLs, which allows local users to gain privileges by passing a kernel address as an argument and overwriting kernel memory locations.Show less
CVE-2007-5933 1Pioneers 1Pioneers Apr 23, 2026 Nov 13, 2007 N/A· v4 N/A· v3 7.8 HIGH· v2 Pioneers (formerly gnocatan) before 0.11.3 allows remote attackers to cause a denial of service (crash) by triggering a delete operation while the Session object is still being used, as demonstrated by causing a "Broken...Show more Pioneers (formerly gnocatan) before 0.11.3 allows remote attackers to cause a denial of service (crash) by triggering a delete operation while the Session object is still being used, as demonstrated by causing a "Broken pipe" error.Show less
CVE-2007-5928 1Openbase International Ltd 1Openbase Apr 23, 2026 Nov 10, 2007 N/A· v4 8.1 HIGH· v3 9.0 HIGH· v2 OpenBase 10.0.5 and earlier allows remote authenticated users to trigger a free of an arbitrary memory location via long strings in a SELECT statement. NOTE: this might be a buffer overflow, but it is not clear.

Previous 1...666667668...685 Next