CWE-20
Improper Input Validation
Description
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-10 · CAPEC-101 · CAPEC-104 · CAPEC-108 · CAPEC-109 · CAPEC-110 · CAPEC-120 · CAPEC-13 · CAPEC-135 · CAPEC-136 · CAPEC-14 · CAPEC-153 · CAPEC-182 · CAPEC-209 · CAPEC-22 · CAPEC-23 · CAPEC-230 · CAPEC-231 · CAPEC-24 · CAPEC-250 · CAPEC-261 · CAPEC-267 · CAPEC-28 · CAPEC-3 · CAPEC-31 · CAPEC-42 · CAPEC-43 · CAPEC-45 · CAPEC-46 · CAPEC-47 · CAPEC-473 · CAPEC-52 · CAPEC-53 · CAPEC-588 · CAPEC-63 · CAPEC-64 · CAPEC-664 · CAPEC-67 · CAPEC-7 · CAPEC-71 · CAPEC-72 · CAPEC-73 · CAPEC-78 · CAPEC-79 · CAPEC-8 · CAPEC-80 · CAPEC-81 · CAPEC-83 · CAPEC-85 · CAPEC-88 · CAPEC-9
CVEs mapped to this weakness (13,314)
page 665 of 666| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2003-1403 | 0.00 | — | 0.01 | Dec 31, 2003 | foo.php3 in DotBr 0.1 allows remote attackers to obtain sensitive information via a direct request, which calls the phpinfo function. | |||
| CVE-2003-1443 | 0.00 | — | 0.00 | Dec 31, 2003 | Kaspersky Antivirus (KAV) 4.0.9.0 does not detect viruses in files with MS-DOS device names in their filenames, which allows local users to bypass virus protection, as demonstrated using aux.vbs and aux.com. | |||
| CVE-2003-1416 | 0.00 | — | 0.01 | Dec 31, 2003 | BisonFTP Server 4 release 2 allows remote attackers to cause a denial of service (CPU consumption) via a long (1) ls or (2) cwd command. | |||
| CVE-2003-1440 | 0.00 | — | 0.01 | Dec 31, 2003 | SpamProbe 0.8a allows remote attackers to cause a denial of service (crash) via HTML e-mail with newline characters within an href tag, which is not properly handled by certain regular expressions. | |||
| CVE-2003-1441 | 0.00 | — | 0.01 | Dec 31, 2003 | Posadis 0.50.4 through 0.50.8 allows remote attackers to cause a denial of service (crash) via a DNS message without a question section, which triggers null dereference. | |||
| CVE-2003-1444 | 0.00 | — | 0.00 | Dec 31, 2003 | Kaspersky Antivirus (KAV) 4.0.9.0 allows local users to cause a denial of service (CPU consumption or crash) and prevent malicious code from being detected via a file with a long pathname. | |||
| CVE-2003-1471 | 0.00 | — | 0.01 | Dec 31, 2003 | MDaemon POP server 6.0.7 and earlier allows remote authenticated users to cause a denial of service (crash) via a (1) DELE or (2) UIDL with a negative number. | |||
| CVE-2003-1485 | 0.00 | — | 0.01 | Dec 31, 2003 | Clearswift MAILsweeper 4.0 through 4.3.7 allows remote attackers to bypass filtering via a file attachment that contains "multiple extensions combined with large blocks of white space." | |||
| CVE-2003-1490 | 0.00 | — | 0.02 | Dec 31, 2003 | SonicWall Pro running firmware 6.4.0.1 allows remote attackers to cause a denial of service (device reset) via a long HTTP POST to the internal interface, possibly due to a buffer overflow. | |||
| CVE-2003-0367 | 0.00 | — | 0.00 | Jul 2, 2003 | znew in the gzip package allows local users to overwrite arbitrary files via a symlink attack on temporary files. | |||
| CVE-2002-2239 | 0.00 | — | 0.02 | Dec 31, 2002 | The Cisco Optical Service Module (OSM) for the Catalyst 6500 and 7600 series running Cisco IOS 12.1(8)E through 12.1(13.4)E allows remote attackers to cause a denial of service (hang) via a malformed packet. | |||
| CVE-2002-2322 | 0.00 | — | 0.01 | Dec 31, 2002 | Ultimate PHP Board (UPB) 1.0b stores the users.dat data file under the web root with insufficient access control, which allows remote attackers to obtain usernames and passwords. | |||
| CVE-2002-2237 | 0.00 | — | 0.02 | Dec 31, 2002 | tftp32 TFTP server 2.21 and earlier allows remote attackers to cause a denial of service via a GET request with a DOS device name such as com1 or aux. | |||
| CVE-2002-2236 | 0.00 | — | 0.05 | Dec 31, 2002 | Format string vulnerability in the awp_log function in apt-www-proxy 0.1 allows remote attackers to execute arbitrary code. | |||
| CVE-2002-2329 | 0.00 | — | 0.02 | Dec 31, 2002 | ICQ client 2001b, 2002a and 2002b allows remote attackers to cause a denial of service (CPU consumption or crash) via a message with a large number of emoticons. | |||
| CVE-2002-2228 | 0.00 | — | 0.01 | Dec 31, 2002 | MailScanner before 4.0 5-1 and before 3.2 6-1 allows remote attackers to bypass protection via attachments with a filename with (1) extra leading spaces, (2) extra trailing spaces, or (3) alternate character encodings that cannot be processed by MailScanner. | |||
| CVE-2002-2354 | 0.00 | — | 0.02 | Dec 31, 2002 | Netgear FM114P firmware 1.3 wireless firewall allows remote attackers to cause a denial of service (crash or hang) via a large number of TCP connection requests. | |||
| CVE-2002-2365 | 0.00 | — | 0.03 | Dec 31, 2002 | Simple WAIS (SWAIS) 1.11 allows remote attackers to execute arbitrary commands via the shell metacharacters in the search field, as demonstrated using the "|" (pipe) character. | |||
| CVE-2002-2371 | 0.00 | — | 0.02 | Dec 31, 2002 | Linksys WET11 firmware 1.31 and 1.32 allows remote attackers to cause a denial of service (crash) via a packet containing the device's hardware address as the source MAC address in the DLC header. | |||
| CVE-2002-2393 | 0.00 | — | 0.03 | Dec 31, 2002 | Serv-U FTP server 3.0, 3.1 and 4.0.0.4 does not accept new connections while validating user folder access rights, which allows remote attackers to cause a denial of service (no new connections) via a series of MKD commands. |
- CVE-2003-1403Dec 31, 2003risk 0.00cvss —epss 0.01
foo.php3 in DotBr 0.1 allows remote attackers to obtain sensitive information via a direct request, which calls the phpinfo function.
- CVE-2003-1443Dec 31, 2003risk 0.00cvss —epss 0.00
Kaspersky Antivirus (KAV) 4.0.9.0 does not detect viruses in files with MS-DOS device names in their filenames, which allows local users to bypass virus protection, as demonstrated using aux.vbs and aux.com.
- CVE-2003-1416Dec 31, 2003risk 0.00cvss —epss 0.01
BisonFTP Server 4 release 2 allows remote attackers to cause a denial of service (CPU consumption) via a long (1) ls or (2) cwd command.
- CVE-2003-1440Dec 31, 2003risk 0.00cvss —epss 0.01
SpamProbe 0.8a allows remote attackers to cause a denial of service (crash) via HTML e-mail with newline characters within an href tag, which is not properly handled by certain regular expressions.
- CVE-2003-1441Dec 31, 2003risk 0.00cvss —epss 0.01
Posadis 0.50.4 through 0.50.8 allows remote attackers to cause a denial of service (crash) via a DNS message without a question section, which triggers null dereference.
- CVE-2003-1444Dec 31, 2003risk 0.00cvss —epss 0.00
Kaspersky Antivirus (KAV) 4.0.9.0 allows local users to cause a denial of service (CPU consumption or crash) and prevent malicious code from being detected via a file with a long pathname.
- CVE-2003-1471Dec 31, 2003risk 0.00cvss —epss 0.01
MDaemon POP server 6.0.7 and earlier allows remote authenticated users to cause a denial of service (crash) via a (1) DELE or (2) UIDL with a negative number.
- CVE-2003-1485Dec 31, 2003risk 0.00cvss —epss 0.01
Clearswift MAILsweeper 4.0 through 4.3.7 allows remote attackers to bypass filtering via a file attachment that contains "multiple extensions combined with large blocks of white space."
- CVE-2003-1490Dec 31, 2003risk 0.00cvss —epss 0.02
SonicWall Pro running firmware 6.4.0.1 allows remote attackers to cause a denial of service (device reset) via a long HTTP POST to the internal interface, possibly due to a buffer overflow.
- CVE-2003-0367Jul 2, 2003risk 0.00cvss —epss 0.00
znew in the gzip package allows local users to overwrite arbitrary files via a symlink attack on temporary files.
- CVE-2002-2239Dec 31, 2002risk 0.00cvss —epss 0.02
The Cisco Optical Service Module (OSM) for the Catalyst 6500 and 7600 series running Cisco IOS 12.1(8)E through 12.1(13.4)E allows remote attackers to cause a denial of service (hang) via a malformed packet.
- CVE-2002-2322Dec 31, 2002risk 0.00cvss —epss 0.01
Ultimate PHP Board (UPB) 1.0b stores the users.dat data file under the web root with insufficient access control, which allows remote attackers to obtain usernames and passwords.
- CVE-2002-2237Dec 31, 2002risk 0.00cvss —epss 0.02
tftp32 TFTP server 2.21 and earlier allows remote attackers to cause a denial of service via a GET request with a DOS device name such as com1 or aux.
- CVE-2002-2236Dec 31, 2002risk 0.00cvss —epss 0.05
Format string vulnerability in the awp_log function in apt-www-proxy 0.1 allows remote attackers to execute arbitrary code.
- CVE-2002-2329Dec 31, 2002risk 0.00cvss —epss 0.02
ICQ client 2001b, 2002a and 2002b allows remote attackers to cause a denial of service (CPU consumption or crash) via a message with a large number of emoticons.
- CVE-2002-2228Dec 31, 2002risk 0.00cvss —epss 0.01
MailScanner before 4.0 5-1 and before 3.2 6-1 allows remote attackers to bypass protection via attachments with a filename with (1) extra leading spaces, (2) extra trailing spaces, or (3) alternate character encodings that cannot be processed by MailScanner.
- CVE-2002-2354Dec 31, 2002risk 0.00cvss —epss 0.02
Netgear FM114P firmware 1.3 wireless firewall allows remote attackers to cause a denial of service (crash or hang) via a large number of TCP connection requests.
- CVE-2002-2365Dec 31, 2002risk 0.00cvss —epss 0.03
Simple WAIS (SWAIS) 1.11 allows remote attackers to execute arbitrary commands via the shell metacharacters in the search field, as demonstrated using the "|" (pipe) character.
- CVE-2002-2371Dec 31, 2002risk 0.00cvss —epss 0.02
Linksys WET11 firmware 1.31 and 1.32 allows remote attackers to cause a denial of service (crash) via a packet containing the device's hardware address as the source MAC address in the DLC header.
- CVE-2002-2393Dec 31, 2002risk 0.00cvss —epss 0.03
Serv-U FTP server 3.0, 3.1 and 4.0.0.4 does not accept new connections while validating user folder access rights, which allows remote attackers to cause a denial of service (no new connections) via a series of MKD commands.