← Back
CWE-20

13,684 CVEs • Abstraction: Class • Likelihood of Exploit: High

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

JSON object

Loading...

CVEs (13,684)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2007-5736
1Seeblick
1Seeblick
Apr 23, 2026
Oct 30, 2007
N/A· v4
N/A· v3
6.4 MEDIUM· v2
Unrestricted file upload vulnerability in upload.php in SeeBlick 1.0 Beta allows remote attackers to upload arbitrary files via unspecified vectors. NOTE: these files are stored with .html extensions, so the scope of th...Show more
Unrestricted file upload vulnerability in upload.php in SeeBlick 1.0 Beta allows remote attackers to upload arbitrary files via unspecified vectors. NOTE: these files are stored with .html extensions, so the scope of the attack might be limited to resource consumption and possibly XSS.Show less
CVE-2007-5734
1Efileman
1Efileman
Apr 23, 2026
Oct 30, 2007
N/A· v4
N/A· v3
6.4 MEDIUM· v2
Unrestricted file upload vulnerability in eFileMan 7.1.0.87-88 allows remote attackers to upload arbitrary files, with "uploads/upload_file." destination filenames, via unspecified vectors to upload.cgi, accessed from up...Show more
Unrestricted file upload vulnerability in eFileMan 7.1.0.87-88 allows remote attackers to upload arbitrary files, with "uploads/upload_file." destination filenames, via unspecified vectors to upload.cgi, accessed from upload.html.Show less
CVE-2007-5733
1Japanese Php Gallery Hosting
1Japanese Php Gallery Hosting
Apr 23, 2026
Oct 30, 2007
N/A· v4
N/A· v3
7.5 HIGH· v2
Unrestricted file upload vulnerability in upload/upload.php in Japanese PHP Gallery Hosting, when Open directory mode is enabled, allows remote attackers to upload and execute arbitrary PHP code via a ServerPath paramete...Show more
Unrestricted file upload vulnerability in upload/upload.php in Japanese PHP Gallery Hosting, when Open directory mode is enabled, allows remote attackers to upload and execute arbitrary PHP code via a ServerPath parameter specifying a filename with a double extension. NOTE: some of these details are obtained from third party information.Show less
CVE-2007-5711
1Massive Entertainment
1World In Conflict
Apr 23, 2026
Oct 30, 2007
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Massive Entertainment World in Conflict 1.001 and earlier allows remote attackers to cause a denial of service (failed assertion and daemon crash) via a large packet to TCP or UDP port 48000.
CVE-2007-4999
1Pidgin
1Pidgin
Apr 23, 2026
Oct 29, 2007
N/A· v4
N/A· v3
4.3 MEDIUM· v2
libpurple in Pidgin 2.1.0 through 2.2.1, when using HTML logging, allows remote attackers to cause a denial of service (NULL dereference and application crash) via a message that contains invalid HTML data, a different v...Show more
libpurple in Pidgin 2.1.0 through 2.2.1, when using HTML logging, allows remote attackers to cause a denial of service (NULL dereference and application crash) via a message that contains invalid HTML data, a different vector than CVE-2007-4996.Show less
CVE-2007-5691
1Mozilla
1Firefox
Apr 23, 2026
Oct 29, 2007
N/A· v4
N/A· v3
4.3 MEDIUM· v2
ParseFTPList.cpp in Mozilla Firefox 2.0.0.7 allows remote FTP servers to cause a denial of service (application crash) via a crafted reply to an unspecified listing command, related to "reading from invalid pointer."
CVE-2007-5340
1Mozilla
3Firefox
SeamonkeyThunderbird
Apr 23, 2026
Oct 21, 2007
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Multiple vulnerabilities in the Javascript engine in Mozilla Firefox before 2.0.0.8, Thunderbird before 2.0.0.8, and SeaMonkey before 1.1.5 allow remote attackers to cause a denial of service (crash) via crafted HTML tha...Show more
Multiple vulnerabilities in the Javascript engine in Mozilla Firefox before 2.0.0.8, Thunderbird before 2.0.0.8, and SeaMonkey before 1.1.5 allow remote attackers to cause a denial of service (crash) via crafted HTML that triggers memory corruption.Show less
CVE-2007-5339
1Mozilla
3Firefox
SeamonkeyThunderbird
Apr 23, 2026
Oct 21, 2007
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Multiple vulnerabilities in Mozilla Firefox before 2.0.0.8, Thunderbird before 2.0.0.8, and SeaMonkey before 1.1.5 allow remote attackers to cause a denial of service (crash) via crafted HTML that triggers memory corrupt...Show more
Multiple vulnerabilities in Mozilla Firefox before 2.0.0.8, Thunderbird before 2.0.0.8, and SeaMonkey before 1.1.5 allow remote attackers to cause a denial of service (crash) via crafted HTML that triggers memory corruption or assert errors.Show less
CVE-2007-5570
1Cisco
1Firewall Services Module
Apr 23, 2026
Oct 18, 2007
N/A· v4
N/A· v3
7.8 HIGH· v2
Cisco Firewall Services Module (FWSM) 3.2(1), and 3.1(5) and earlier, allows remote attackers to cause a denial of service (device reload) via a crafted HTTPS request, aka CSCsi77844.
CVE-2007-5569
1Cisco
3Adaptive Security Appliance
Adaptive Security Appliance SoftwarePix 500
Apr 23, 2026
Oct 18, 2007
N/A· v4
N/A· v3
7.1 HIGH· v2
Cisco PIX and ASA appliances with 7.1 and 7.2 software, when configured for TLS sessions to the device, allow remote attackers to cause a denial of service (device reload) via a crafted TLS packet, aka CSCsg43276 and CSC...Show more
Cisco PIX and ASA appliances with 7.1 and 7.2 software, when configured for TLS sessions to the device, allow remote attackers to cause a denial of service (device reload) via a crafted TLS packet, aka CSCsg43276 and CSCsh97120.Show less
CVE-2007-5568
1Cisco
2Adaptive Security Appliance Software
Firewall Services Module
Apr 23, 2026
Oct 18, 2007
N/A· v4
N/A· v3
7.1 HIGH· v2
Cisco PIX and ASA appliances with 7.0 through 8.0 software, and Cisco Firewall Services Module (FWSM) 3.1(5) and earlier, allow remote attackers to cause a denial of service (device reload) via a crafted MGCP packet, aka...Show more
Cisco PIX and ASA appliances with 7.0 through 8.0 software, and Cisco Firewall Services Module (FWSM) 3.1(5) and earlier, allow remote attackers to cause a denial of service (device reload) via a crafted MGCP packet, aka CSCsi90468 (appliance) and CSCsi00694 (FWSM).Show less
CVE-2007-5563
1Virtuemart
1Virtuemart
Apr 23, 2026
Oct 18, 2007
N/A· v4
N/A· v3
7.5 HIGH· v2
Unspecified vulnerability in VirtueMart before 1.0.13 allows remote attackers to execute arbitrary PHP code via unspecified vectors.
CVE-2007-5557
1Nec
1Mobile Handset
Apr 23, 2026
Oct 18, 2007
N/A· v4
N/A· v3
7.8 HIGH· v2
Unspecified vulnerability in the NEC mobile handset allows remote attackers to cause a denial of service (reboot) via crafted packets. NOTE: as of 20071016, the only disclosure is a vague pre-advisory with no actionable...Show more
Unspecified vulnerability in the NEC mobile handset allows remote attackers to cause a denial of service (reboot) via crafted packets. NOTE: as of 20071016, the only disclosure is a vague pre-advisory with no actionable information. However, since it is from a well-known researcher, it is being assigned a CVE identifier for tracking purposes.Show less
CVE-2007-5556
1Avaya
1Voip Handset
Apr 23, 2026
Oct 18, 2007
N/A· v4
N/A· v3
7.8 HIGH· v2
Unspecified vulnerability in the Avaya VoIP Handset allows remote attackers to cause a denial of service (reboot) via crafted packets. NOTE: as of 20071016, the only disclosure is a vague pre-advisory with no actionable...Show more
Unspecified vulnerability in the Avaya VoIP Handset allows remote attackers to cause a denial of service (reboot) via crafted packets. NOTE: as of 20071016, the only disclosure is a vague pre-advisory with no actionable information. However, since it is from a well-known researcher, it is being assigned a CVE identifier for tracking purposes.Show less
CVE-2007-5541
1Opera
1Opera Browser
Apr 23, 2026
Oct 18, 2007
N/A· v4
N/A· v3
9.3 HIGH· v2
Unspecified vulnerability in Opera before 9.24, when using an "external" newsgroup or e-mail client, allows remote attackers to execute arbitrary commands via unknown vectors.
CVE-2007-5540
1Opera
1Opera Browser
Apr 23, 2026
Oct 18, 2007
N/A· v4
N/A· v3
7.5 HIGH· v2
Unspecified vulnerability in Opera before 9.24 allows remote attackers to overwrite functions on pages from other domains and bypass the same-origin policy via unknown vectors.
CVE-2007-5507
1Oracle
1Database Server
Apr 23, 2026
Oct 17, 2007
N/A· v4
N/A· v3
6.4 MEDIUM· v2
The GIOP service in TNS Listener in the Oracle Net Services component in Oracle Database 9.0.1.5+, 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 allows remote attackers to cause a denial of service (crash) or read potential...Show more
The GIOP service in TNS Listener in the Oracle Net Services component in Oracle Database 9.0.1.5+, 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 allows remote attackers to cause a denial of service (crash) or read potentially sensitive memory via a connect GIOP packet with an invalid data size, which triggers a buffer over-read, aka DB22.Show less
CVE-2007-5462
1Sun
1Solaris
Apr 23, 2026
Oct 15, 2007
N/A· v4
N/A· v3
7.8 HIGH· v2
Unspecified vulnerability in the Sun Solaris RPC services library (librpcsvc) on Solaris 8 through 10 allows remote attackers to cause a denial of service (mountd crash) via unspecified packets to a server that exports m...Show more
Unspecified vulnerability in the Sun Solaris RPC services library (librpcsvc) on Solaris 8 through 10 allows remote attackers to cause a denial of service (mountd crash) via unspecified packets to a server that exports many filesystems, and allows local users to cause a denial of service (automountd crash) via unspecified requests to mount filesystems from a server that exports many filesystems.Show less
CVE-2007-5448
1Madwifi
1Madwifi
Apr 23, 2026
Oct 14, 2007
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Madwifi 0.9.3.2 and earlier allows remote attackers to cause a denial of service (panic) via a beacon frame with a large length value in the extended supported rates (xrates) element, which triggers an assertion error, r...Show more
Madwifi 0.9.3.2 and earlier allows remote attackers to cause a denial of service (panic) via a beacon frame with a large length value in the extended supported rates (xrates) element, which triggers an assertion error, related to net80211/ieee80211_scan_ap.c and net80211/ieee80211_scan_sta.c.Show less
CVE-2007-5440
1Crs Manager
1Crs Manager
Apr 23, 2026
Oct 14, 2007
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple PHP remote file inclusion vulnerabilities in CRS Manager allow remote attackers to execute arbitrary PHP code via a URL in the DOCUMENT_ROOT parameter to (1) index.php or (2) login.php. NOTE: this issue is disp...Show more
Multiple PHP remote file inclusion vulnerabilities in CRS Manager allow remote attackers to execute arbitrary PHP code via a URL in the DOCUMENT_ROOT parameter to (1) index.php or (2) login.php. NOTE: this issue is disputed by CVE, since DOCUMENT_ROOT cannot be modified by an attackerShow less