VYPR

CWE-20

Improper Input Validation

ClassStableLikelihood: High

Description

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-10 · CAPEC-101 · CAPEC-104 · CAPEC-108 · CAPEC-109 · CAPEC-110 · CAPEC-120 · CAPEC-13 · CAPEC-135 · CAPEC-136 · CAPEC-14 · CAPEC-153 · CAPEC-182 · CAPEC-209 · CAPEC-22 · CAPEC-23 · CAPEC-230 · CAPEC-231 · CAPEC-24 · CAPEC-250 · CAPEC-261 · CAPEC-267 · CAPEC-28 · CAPEC-3 · CAPEC-31 · CAPEC-42 · CAPEC-43 · CAPEC-45 · CAPEC-46 · CAPEC-47 · CAPEC-473 · CAPEC-52 · CAPEC-53 · CAPEC-588 · CAPEC-63 · CAPEC-64 · CAPEC-664 · CAPEC-67 · CAPEC-7 · CAPEC-71 · CAPEC-72 · CAPEC-73 · CAPEC-78 · CAPEC-79 · CAPEC-8 · CAPEC-80 · CAPEC-81 · CAPEC-83 · CAPEC-85 · CAPEC-88 · CAPEC-9

CVEs mapped to this weakness (13,352)

page 504 of 668
  • CVE-2008-4907Nov 4, 2008
    Dovecot (software)
    Dovecot
    risk 0.03cvss —epss 0.06

    The message parsing feature in Dovecot 1.1.4 and 1.1.5, when using the FETCH ENVELOPE command in the IMAP client, allows remote attackers to cause a denial of service (persistent crash) via an email with a malformed From address, which triggers an assertion error, aka "invalid…

  • CVE-2008-4878Nov 1, 2008
    Mywebcards
    Webcards
    risk 0.03cvss —epss 0.04

    Unrestricted file upload vulnerability in the "Add Image Macro" feature in WebCards 1.3 allows remote authenticated administrators to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the uploaded file.

  • CVE-2008-4767Oct 28, 2008
    PHP-Nuke
    Downloadsplus Module
    risk 0.03cvss —epss 0.04

    Unrestricted file upload vulnerability in the DownloadsPlus module in PHP-Nuke allows remote attackers to execute arbitrary code by uploading a file with (1) .htm, (2) .html, or (3) .txt extensions, then accessing it via a direct request to the file. NOTE: the provenance of…

  • CVE-2008-3834Oct 7, 2008
    Xorg
    Dbus
    risk 0.03cvss —epss 0.05

    The dbus_signature_validate function in the D-bus library (libdbus) before 1.2.4 allows remote attackers to cause a denial of service (application abort) via a message containing a malformed signature, which triggers a failed assertion error.

  • CVE-2008-4380Oct 1, 2008
    Samsung Mobile
    SHR2040
    risk 0.03cvss —epss 0.04

    The web interface in Samsung DVR SHR2040 allows remote attackers to cause a denial of service (crash) via a malformed HTTP request, related to the filter for configuration properties and "/x" characters.

  • CVE-2008-4366Sep 30, 2008
    Camera Life
    Camera Life
    risk 0.03cvss —epss 0.03

    Unrestricted file upload vulnerability in the image upload component in Camera Life 2.6.2b4 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in a user directory under…

  • CVE-2008-4363Sep 30, 2008
    Deslock
    Deslock\+
    risk 0.03cvss —epss 0.01

    DLMFENC.sys 1.0.0.28 in DESlock+ 3.2.7 allows local users to cause a denial of service (system crash) or potentially execute arbitrary code via a certain DLMFENC_IOCTL request to \\.\DLKPFSD_Device that overwrites a pointer, probably related to use of the ProbeForRead function…

  • CVE-2008-4340Sep 30, 2008
    Google
    Chrome
    risk 0.03cvss —epss 0.04

    Google Chrome 0.2.149.29 and 0.2.149.30 allows remote attackers to cause a denial of service (memory consumption) via an HTML document containing a carriage return ("\r\n\r\n") argument to the window.open function.

  • CVE-2008-4329Sep 30, 2008
    Openengine
    Openengine
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in cms/system/openengine.php in openEngine 2.0 beta4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the oe_classpath parameter.

  • CVE-2008-4137Sep 24, 2008
    PHP Crawler
    PHP Crawler
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in footer.php in PHP-Crawler 0.8 allows remote attackers to execute arbitrary PHP code via a URL in the footer_file parameter.

  • CVE-2008-4136Sep 24, 2008
    Michael Roth Software
    Personal FTP Server
    risk 0.03cvss —epss 0.03

    Michael Roth Software Personal FTP Server (PFT) 6.0f allows remote attackers to cause a denial of service (service crash) via multiple RETR commands, possibly involving long filenames.

  • CVE-2008-4133Sep 19, 2008
    Dlink
    Dir 100
    risk 0.03cvss —epss 0.04

    The web proxy service on the D-Link DIR-100 with firmware 1.12 and earlier does not properly filter web requests with large URLs, which allows remote attackers to bypass web restriction filters.

  • CVE-2008-4049Sep 11, 2008
    Friendly Technologies
    Friendly Pppoe Client
    risk 0.03cvss —epss 0.04

    A certain ActiveX control in fwRemoteCfg.dll 3.3.3.1 in Friendly Technologies FriendlyPPPoE Client 3.0.0.57 allows remote attackers to execute arbitrary programs via arguments to the RunApp method.

  • CVE-2008-4041Sep 11, 2008
    Softalk
    Mail Server
    risk 0.03cvss —epss 0.02

    The IMAP server in Softalk Mail Server (formerly WorkgroupMail) 8.5.1.431 allows remote authenticated users to cause a denial of service (resource consumption and daemon crash) via a long IMAP APPEND command with certain repeated parameters.

  • CVE-2008-3007Sep 11, 2008
    Microsoft
    Office
    risk 0.03cvss —epss 0.32

    Argument injection vulnerability in a URI handler in Microsoft Office XP SP3, 2003 SP2 and SP3, 2007 Office System Gold and SP1, and Office OneNote 2007 Gold and SP1 allow remote attackers to execute arbitrary code via a crafted onenote:// URL, aka "Uniform Resource Locator…

  • CVE-2008-3879Sep 2, 2008
    Ultrashareware
    Ultra Office Control
    risk 0.03cvss —epss 0.04

    The Ultra.OfficeControl ActiveX control in OfficeCtrl.ocx 2.0.2008.801 and earlier in Ultra Shareware Ultra Office Control allows remote attackers to force the download of arbitrary files onto a client system via a URL in the first argument to the Open method, in conjunction…

  • CVE-2008-3761Aug 21, 2008
    VMware
    Workstation
    risk 0.03cvss —epss 0.01

    hcmon.sys in VMware Workstation 6.5.1 and earlier, VMware Player 2.5.1 and earlier, VMware ACE 2.5.1 and earlier, and VMware Server 1.0.x before 1.0.9 build 156507 and 2.0.x before 2.0.1 build 156745 uses the METHOD_NEITHER communication method for IOCTLs, which allows local…

  • CVE-2008-3763Aug 21, 2008
    Turnkey
    PHP Live Helper
    risk 0.03cvss —epss 0.03

    Variable overwrite vulnerability in libsecure.php in Turnkey PHP Live Helper 2.0.1 and earlier, when register_globals is enabled, allows remote attackers to overwrite arbitrary variables related to the db config file. NOTE: this can be leveraged for code injection by…

  • CVE-2008-3676Aug 14, 2008
    Hmailserver
    Hmailserver
    risk 0.03cvss —epss 0.03

    Unspecified vulnerability in the IMAP server in hMailServer 4.4.1 allows remote authenticated users to cause a denial of service (resource exhaustion or daemon crash) via a long series of IMAP commands.

  • CVE-2008-1457Aug 13, 2008
    Microsoft
    Windows 2000
    risk 0.03cvss —epss 0.36

    The Event System in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 does not properly validate per-user subscriptions, which allows remote authenticated users to execute arbitrary code via a crafted event subscription…