VYPR

CWE-20

Improper Input Validation

ClassStableLikelihood: High

Description

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-10 · CAPEC-101 · CAPEC-104 · CAPEC-108 · CAPEC-109 · CAPEC-110 · CAPEC-120 · CAPEC-13 · CAPEC-135 · CAPEC-136 · CAPEC-14 · CAPEC-153 · CAPEC-182 · CAPEC-209 · CAPEC-22 · CAPEC-23 · CAPEC-230 · CAPEC-231 · CAPEC-24 · CAPEC-250 · CAPEC-261 · CAPEC-267 · CAPEC-28 · CAPEC-3 · CAPEC-31 · CAPEC-42 · CAPEC-43 · CAPEC-45 · CAPEC-46 · CAPEC-47 · CAPEC-473 · CAPEC-52 · CAPEC-53 · CAPEC-588 · CAPEC-63 · CAPEC-64 · CAPEC-664 · CAPEC-67 · CAPEC-7 · CAPEC-71 · CAPEC-72 · CAPEC-73 · CAPEC-78 · CAPEC-79 · CAPEC-8 · CAPEC-80 · CAPEC-81 · CAPEC-83 · CAPEC-85 · CAPEC-88 · CAPEC-9

CVEs mapped to this weakness (8,003)

page 386 of 401
  • CVE-2008-1734Apr 18, 2008
    File Project
    PHP Toolkit
    risk 0.00cvss —epss 0.00

    Interpretation conflict in PHP Toolkit before 1.0.1 on Gentoo Linux might allow local users to cause a denial of service (PHP outage) and read contents of PHP scripts by creating a file with a one-letter lowercase alphabetic name, which triggers interpretation of a certain…

  • CVE-2008-1693Apr 18, 2008
    Poppler (software)
    Poppler
    risk 0.00cvss —epss 0.05

    The CairoFont::create function in CairoFontEngine.cc in Poppler, possibly before 0.8.0, as used in Xpdf, Evince, ePDFview, KWord, and other applications, does not properly handle embedded fonts in PDF files, which allows remote attackers to execute arbitrary code via a crafted…

  • CVE-2008-1835Apr 16, 2008
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.04

    ClamAV before 0.93 allows remote attackers to bypass the scanning enging via a RAR file with an invalid version number, which cannot be parsed by ClamAV but can be extracted by Winrar.

  • CVE-2008-1722Apr 10, 2008
    Openprinting
    Cups
    risk 0.00cvss —epss 0.02

    Multiple integer overflows in (1) filter/image-png.c and (2) filter/image-zoom.c in CUPS 1.3 allow attackers to cause a denial of service (crash) and trigger memory corruption, as demonstrated via a crafted PNG image.

  • CVE-2008-1691Apr 7, 2008
    Slmail
    Slmail
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in SLMail.exe in SLMail Pro 6.3.1.0 and earlier allows remote attackers to cause a denial of service (UDP service outage) via a large packet to UDP port 54. NOTE: some of these details are obtained from third party information.

  • CVE-2008-1014Apr 4, 2008
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.02

    Apple QuickTime before 7.4.5 does not properly handle external URLs in movies, which allows remote attackers to obtain sensitive information.

  • CVE-2008-0555Apr 4, 2008
    Apache SSL
    Apache SSL
    risk 0.00cvss —epss 0.02

    The ExpandCert function in Apache-SSL before apache_1.3.41+ssl_1.59 does not properly handle (1) '/' and (2) '=' characters in a Distinguished Name (DN) in a client certificate, which might allow remote attackers to bypass authentication via a crafted DN that triggers…

  • CVE-2008-1626Apr 2, 2008
    Eggblog
    Eggblog
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in eggBlog before 4.0.1 allows remote attackers to execute arbitrary SQL commands via an unspecified cookie. NOTE: this might overlap CVE-2008-0159.

  • CVE-2008-1648Apr 2, 2008
    Sympa
    Sympa
    risk 0.00cvss —epss 0.02

    Sympa before 5.4 allows remote attackers to cause a denial of service (daemon crash) via an e-mail message with a malformed value of the Content-Type header and unspecified other headers. NOTE: some of these details are obtained from third party information.

  • CVE-2008-1612Apr 1, 2008
    Squid Cache
    Squid
    risk 0.00cvss —epss 0.02

    The arrayShrink function (lib/Array.c) in Squid 2.6.STABLE17 allows attackers to cause a denial of service (process exit) via unknown vectors that cause an array to shrink to 0 entries, which triggers an assert error. NOTE: this issue is due to an incorrect fix for…

  • CVE-2008-1568Mar 31, 2008
    Comix
    Comix
    risk 0.00cvss —epss 0.02

    comix 3.6.4 allows attackers to execute arbitrary commands via a filename containing shell metacharacters that are not properly sanitized when executing the rar, unrar, or jpegtran programs.

  • CVE-2008-1532Mar 28, 2008
    Perlbal
    Perlbal
    risk 0.00cvss —epss 0.02

    Perlbal before 1.70, when buffered upload is enabled, allows remote attackers to cause a denial of service (crash) via a zero-byte chunked upload.

  • CVE-2008-1012Mar 20, 2008
    Apple Inc.
    Airport Extreme Base Station Firmware
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Apple AirPort Extreme Base Station Firmware 7.3.1 allows remote attackers to cause a denial of service (file sharing hang) via a crafted AFP request, related to "input validation."

  • CVE-2008-1412Mar 20, 2008
    F-Secure
    Internet Security
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in multiple F-Secure anti-virus products, including Internet Security 2006 through 2008, Anti-Virus 2006 through 2008, and others, allows remote attackers to execute arbitrary code or cause a denial of service (hang or crash) via a malformed archive…

  • CVE-2008-0999Mar 18, 2008
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    Apple Mac OS X 10.5.2 allows user-assisted attackers to cause a denial of service (crash) via a crafted Universal Disc Format (UDF) disk image, which triggers a NULL pointer dereference.

  • CVE-2008-0054Mar 18, 2008
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.05

    Foundation in Apple Mac OS X 10.4.11 might allow context-dependent attackers to execute arbitrary code via a malformed selector name to the NSSelectorFromString API, which causes an "unexpected selector" to be used.

  • CVE-2008-1366Mar 17, 2008
    Trend Micro
    Officescan Corporate Edition
    risk 0.00cvss —epss 0.02

    Trend Micro OfficeScan Corporate Edition 8.0 Patch 2 build 1189 and earlier, and 7.3 Patch 3 build 1314 and earlier, allows remote attackers to cause a denial of service (process consumption) via (1) an HTTP request without a Content-Length header or (2) invalid characters in…

  • CVE-2008-1337Mar 14, 2008
    Timbuktu
    Pro
    risk 0.00cvss —epss 0.02

    The instant message service in Timbuktu Pro 8.6.5 RC 229 and earlier for Windows allows remote attackers to cause (1) a denial of service (daemon crash) via an invalid Version field or (2) a denial of service (CPU consumption and daemon termination) via an invalid or partial…

  • CVE-2008-1279Mar 10, 2008
    Acronis
    True Image
    risk 0.00cvss —epss 0.02

    Acronis True Image Group Server 1.5.19.191 and earlier, included in Acronis True Image Enterprise Server 9.5.0.8072 and the other True Image packages, allows remote attackers to cause a denial of service (crash) via a packet with an invalid length field, which causes an…

  • CVE-2008-1280Mar 10, 2008
    Acronis
    True Image
    risk 0.00cvss —epss 0.02

    Acronis True Image Windows Agent 1.0.0.54 and earlier, included in Acronis True Image Enterprise Server 9.5.0.8072 and the other True Image packages, allows remote attackers to cause a denial of service (crash) via a malformed packet to port 9876, which triggers a NULL pointer…