CWE-20— Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.— MITRE CWE catalog

13,761 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-20page 6 of 276

CVE-2007-3711HIGHCVSS v2 7.5EG 7.5
2007-07-11
Unspecified vulnerability in TOS 2.1.x, 2.2.x before 2.2.5, and 2.5.x before 2.5.2 on TippingPoint IPS allows remote attackers to avoid detection by sending certain fragmented packets.
CVE-2007-3715HIGHCVSS v2 9.3EG 9.3
2007-07-11
Sun Java System Application Server and Web Server 7.0 through 9.0 before 20070710 do not properly process XSLT stylesheets in XSLT transforms in XML signatures, which allows context-dependent attackers to execute an arbitrary Java method v…
CVE-2007-3716HIGHCVSS v2 9.3EG 9.3
2007-07-11
The Java XML Digital Signature implementation in Sun JDK and JRE 6 before Update 2 does not properly process XSLT stylesheets in XSLT transforms in XML signatures, which allows context-dependent attackers to execute arbitrary code via a cr…
CVE-2007-3731MEDIUMCVSS v2 4.9EG 4.9
2007-09-17
The Linux kernel 2.6.20 and 2.6.21 does not properly handle an invalid LDT segment selector in %cs (the xcs field) during ptrace single-step operations, which allows local users to cause a denial of service (NULL dereference and OOPS) via …
CVE-2007-3753HIGHCVSS v2 7.5EG 7.5
2007-09-27
Apple iPhone 1.1.1, with Bluetooth enabled, allows physically proximate attackers to cause a denial of service (application termination) and execute arbitrary code via crafted Service Discovery Protocol (SDP) packets, related to insufficie…
CVE-2007-3755MEDIUMCVSS v2 4.3EG 4.3
2007-09-27
Mail in Apple iPhone 1.1.1 allows remote user-assisted attackers to force the iPhone user to make calls to arbitrary telephone numbers via a "tel:" link, which does not prompt the user before dialing the number.
CVE-2007-3757MEDIUMCVSS v2 4.3EG 4.3
2007-09-27
Safari in Apple iPhone 1.1.1 allows remote user-assisted attackers to trick the iPhone user into making calls to arbitrary telephone numbers via a crafted "tel:" link that causes iPhone to display a different number than the number that wi…
CVE-2007-3780MEDIUMCVSS v2 5.0EG 5.0
2007-07-15
MySQL Community Server before 5.0.45 allows remote attackers to cause a denial of service (daemon crash) via a malformed password packet in the connection protocol.
CVE-2007-3799MEDIUMCVSS v2 4.3EG 4.3
2007-07-16
The session_start function in ext/session in PHP 4.x up to 4.4.7 and 5.x up to 5.2.3 allows remote attackers to insert arbitrary attributes into the session cookie via special characters in a cookie that is obtained from (1) PATH_INFO, (2)…
CVE-2007-3806MEDIUMCVSS v2 6.8EG 6.8
2007-07-17
The glob function in PHP 5.2.3 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via an invalid value of the flags parameter, probably related to memory corruption or an invalid read on win…
CVE-2007-3896HIGHCVSS v2 9.3EG 9.3
2007-10-11
The URL handling in Shell32.dll in the Windows shell in Microsoft Windows XP and Server 2003, with Internet Explorer 7 installed, allows remote attackers to execute arbitrary programs via invalid "%" sequences in a mailto: or other URI han…
CVE-2007-3912HIGHCVSS v2 7.2EG 7.2
2007-09-10
checkrestart in debian-goodies before 0.34 allows local users to gain privileges via shell metacharacters in the name of the executable file for a running process.
CVE-2007-3913HIGHCVSS v2 7.5EG 7.5
2007-09-06
SQL injection vulnerability in Gforge before 3.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2007-3998MEDIUMCVSS v2 5.0EG 5.0
2007-09-04
The wordwrap function in PHP 4 before 4.4.8, and PHP 5 before 5.2.4, does not properly use the breakcharlen variable, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash, or infinite loop)…
CVE-2007-4130HIGHCVSS v2 7.2EG 7.2
2008-02-05
The Linux kernel 2.6.9 before 2.6.9-67 in Red Hat Enterprise Linux (RHEL) 4 on Itanium (ia64) does not properly handle page faults during NUMA memory access, which allows local users to cause a denial of service (panic) via invalid argumen…
CVE-2007-4216HIGHCVSS v2 7.2EG 7.2
2007-08-21
vsdatant.sys 6.5.737.0 in Check Point Zone Labs ZoneAlarm before 7.0.362 allows local users to gain privileges via a crafted Interrupt Request Packet (Irp) in a METHOD_NEITHER (1) IOCTL 0x8400000F or (2) IOCTL 0x84000013 request, which can…
CVE-2007-4218HIGHCVSS v2 10.0EG 10.0
2007-08-22
Multiple buffer overflows in the ServerProtect service (SpntSvc.exe) in Trend Micro ServerProtect for Windows before 5.58 Security Patch 4 allow remote attackers to execute arbitrary code via certain RPC requests to certain TCP ports that …
CVE-2007-4344HIGHCVSS v2 9.3EG 9.3
2007-11-15
Multiple input validation errors in ACD ACDSee Photo Manager 9.0 build 108, Pro Photo Manager 8.1 build 99, and Photo Editor 4.0 build 195 allow user-assisted remote attackers to execute arbitrary code via a long section string in (1) a PS…
CVE-2007-4391HIGHCVSS v2 9.3EG 9.3
2007-08-17
Heap-based buffer overflow in Kakadu kdu_v32m.dll in Yahoo! Messenger 8.1.0.413 allows remote attackers to cause a denial of service (application crash) via a certain length field in JPEG2000 data, as demonstrated by sending an "invite to …
CVE-2007-4430MEDIUMCVSS v2 5.0EG 5.0
2007-08-20
Unspecified vulnerability in Cisco IOS 12.0 through 12.4 allows context-dependent attackers to cause a denial of service (device restart and BGP routing table rebuild) via certain regular expressions in a "show ip bgp regexp" command. NOT…
CVE-2007-4450MEDIUMCVSS v2 5.0EG 5.0
2007-08-21
The server in Toribash 2.71 and earlier does not properly handle long commands, which allows remote attackers to trigger a protocol violation in which data is sent to other clients without a required LF character, as demonstrated by a SAY …
CVE-2007-4459HIGHCVSS v2 7.1EG 7.1
2007-08-21
Cisco IP Phone 7940 and 7960 with P0S3-08-6-00 firmware, and other SIP firmware before 8.7(0), allows remote attackers to cause a denial of service (device reboot) via (1) a certain sequence of 10 invalid SIP INVITE and OPTIONS messages; o…
CVE-2007-4467HIGHCVSS v2 9.3EG 9.3
2007-08-31
Multiple stack-based buffer overflows in the Oracle JInitiator ActiveX control (beans.ocx) 1.1.8.16 and earlier, as used by Oracle Forms applications from Oracle and third parties, allow remote attackers to execute arbitrary code via unspe…
CVE-2007-4516MEDIUMCVSS v2 4.3EG 4.3
2008-02-21
The Volume Manager Scheduler Service (aka VxSchedService.exe) in Symantec Veritas Storage Foundation 5.0 for Windows allows remote attackers to cause a denial of service (daemon crash or hang) via malformed packets.
CVE-2007-4561HIGHCVSS v2 10.0EG 10.0
2007-08-28
Heap-based buffer overflow in the RTSP service in Helix DNA Server before 11.1.4 allows remote attackers to execute arbitrary code via an RSTP command containing multiple Require headers.
CVE-2007-4567HIGHCVSS v2 7.8EG 7.8
2007-12-21
The ipv6_hop_jumbo function in net/ipv6/exthdrs.c in the Linux kernel before 2.6.22 does not properly validate the hop-by-hop IPv6 extended header, which allows remote attackers to cause a denial of service (NULL pointer dereference and ke…
CVE-2007-4570LOWCVSS v2 1.9EG 1.9
2007-11-10
Algorithmic complexity vulnerability in the MCS translation daemon in mcstrans 0.2.3 allows local users to cause a denial of service (temporary daemon outage) via a large range of compartments in sensitivity labels.
CVE-2007-4612MEDIUMCVSS v2 4.3EG 4.3
2007-08-31
CRLF injection vulnerability in contact.php in Moonware (aka Dale Mooney Gallery) allows remote attackers to add arbitrary mail headers via CRLF sequences in the subject parameter. NOTE: this can be leveraged for spam by adding To or Cc h…
CVE-2007-4635MEDIUMCVSS v2 5.0EG 5.0
2007-08-31
Yahoo! Messenger 8.1.0.209 and 8.1.0.402 allows remote attackers to cause a denial of service (application crash) via certain file-transfer packets, possibly involving a buffer overflow, as demonstrated by ym8bug.exe. NOTE: this might be …
CVE-2007-4636HIGHCVSS v2 7.5EG 7.5
2007-08-31
Multiple PHP remote file inclusion vulnerabilities in phpBG 0.9.1 allow remote attackers to execute arbitrary PHP code via a URL in the rootdir parameter to (1) intern/admin/other/backup.php, (2) intern/admin/, (3) intern/clan/member_add.p…
CVE-2007-4664HIGHCVSS v2 7.5EG 7.5
2007-09-04
Unspecified vulnerability in the (1) attach database and (2) create database functionality in Firebird before 2.0.2, when a filename exceeds MAX_PATH_LEN, has unknown impact and attack vectors, aka CORE-1405.
CVE-2007-4671MEDIUMCVSS v2 6.8EG 6.8
2007-09-27
Unspecified vulnerability in Safari in Apple iPhone 1.1.1, and Safari 3 before Beta Update 3.0.4 on Windows and Mac OS X 10.4 through 10.4.10, allows remote attackers to "alter or access" HTTPS content via an HTTP session with a crafted we…
CVE-2007-4695MEDIUMCVSS v2 4.3EG 4.3
2007-11-15
Unspecified "input validation" vulnerability in WebCore in Apple Mac OS X 10.4 through 10.4.10 allows remote attackers to modify form field values via unknown vectors related to file uploads.
CVE-2007-4732MEDIUMCVSS v2 4.9EG 4.9
2007-09-06
Unspecified vulnerability in the strfreectty function in the Special File System (SPECFS) in Sun Solaris 8 through 10 allows local users to cause a denial of service (system panic), related to passing a NULL pointer to the pgsignal functio…
CVE-2007-4738HIGHCVSS v2 7.5EG 7.5
2007-09-06
Multiple PHP remote file inclusion vulnerabilities in SpeedTech PHP Library (STPHPLibrary) 0.8.0 allow remote attackers to execute arbitrary PHP code via a URL in the (1) db_conf or (2) ADODB_DIR parameter to utils/stphpimage_show.php; or …
CVE-2007-4742MEDIUMCVSS v2 4.3EG 4.3
2007-09-06
Claroline before 1.8.6 allows remote authenticated administrators to obtain sensitive information via an invalid value in the sort parameter to admin/adminusers.php, which reveals the path in an error message in some circumstances, as demo…
CVE-2007-4744MEDIUMCVSS v2 6.8EG 6.8
2007-09-06
PHP remote file inclusion vulnerability in environment.php in AnyInventory 1.9.1 and 2.0, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the DIR_PREFIX parameter.
CVE-2007-4752HIGHCVSS v2 7.5EG 7.5
2007-09-12
ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and uses a trusted X11 cookie instead, which allows attackers to violate intended policy and gain privileges by causing an X client to be treated…
CVE-2007-4755MEDIUMCVSS v2 5.0EG 5.0
2007-09-08
Alien Arena 2007 6.10 and earlier allows remote attackers to cause a denial of service (client disconnect) by sending a client_connect command in a forged packet from the server to a client. NOTE: client IP addresses are available via pro…
CVE-2007-4757HIGHCVSS v2 7.5EG 7.5
2007-09-08
PHP remote file inclusion vulnerability in menu.php in phpMytourney allows remote attackers to execute arbitrary PHP code via a URL in the functions_file parameter.
CVE-2007-4761HIGHCVSS v2 7.5EG 7.5
2007-09-08
Unrestricted file upload vulnerability in upload.php in Barbo91 1.1 allows remote attackers to upload and execute arbitrary code via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely…
CVE-2007-4780MEDIUMCVSS v2 6.8EG 6.8
2007-09-10
Joomla! 1.5 before RC2 (aka Endeleo) allows remote attackers to obtain sensitive information (the full path) via unspecified vectors, probably involving direct requests to certain PHP scripts in tmpl/ directories.
CVE-2007-4781MEDIUMCVSS v2 6.6EG 6.6
2007-09-10
administrator/index.php in the installer component (com_installer) in Joomla! 1.5 Beta1, Beta2, and RC1 allows remote authenticated administrators to upload arbitrary files to tmp/ via the "Upload Package File" functionality, which is acce…
CVE-2007-4783MEDIUMCVSS v2 5.0EG 5.0
2007-09-10
The iconv_substr function in PHP 5.2.4 and earlier allows context-dependent attackers to cause (1) a denial of service (application crash) via a long string in the charset parameter, probably also requiring a long string in the str paramet…
CVE-2007-4784MEDIUMCVSS v2 5.0EG 5.0
2007-09-10
The setlocale function in PHP before 5.2.4 allows context-dependent attackers to cause a denial of service (application crash) via a long string in the locale parameter. NOTE: this might not be a vulnerability in most web server environme…
CVE-2007-4787MEDIUMCVSS v2 5.0EG 5.0
2007-09-10
The virus detection engine in Sophos Anti-Virus before 2.49.0 does not properly process malformed (1) CAB, (2) LZH, and (3) RAR files with modified headers, which might allow remote attackers to bypass malware detection.
CVE-2007-4840MEDIUMCVSS v2 5.0EG 5.0
2007-09-12
PHP 5.2.4 and earlier allows context-dependent attackers to cause a denial of service (application crash) via (1) a long string in the out_charset parameter to the iconv function; or a long string in the charset parameter to the (2) iconv_…
CVE-2007-4841HIGHCVSS v2 9.3EG 9.3
2007-09-12
Mozilla Firefox before 2.0.0.8, Thunderbird before 2.0.0.8, and SeaMonkey before 1.1.5 allows remote attackers to execute arbitrary commands via a (1) mailto, (2) nntp, (3) news, or (4) snews URI with invalid "%" encoding, related to impro…
CVE-2007-4844MEDIUMCVSS v2 4.3EG 4.3
2007-09-12
X-Diesel Unreal Commander 0.92 build 565 and 573 does not properly react to an FTP server's behavior after sending a "CWD /" command, which allows remote FTP servers to cause a denial of service (infinite loop) by (1) repeatedly sending a …
CVE-2007-4887MEDIUMCVSS v2 4.3EG 4.3
2007-09-14
The dl function in PHP 5.2.4 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a long string in the library parameter. NOTE: there are limited usage scenarios under which this would be a v…

Map vulnerabilities like CWE-20 to your infrastructure

EchelonGraph correlates every CVE — across CWE-20 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →