Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,705 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2000-0119 | Not scored | The default configurations for McAfee Virus Scan and Norton Anti-Virus virus checkers do not check files in the RECYCLED folder that is used by the Windows Recycle Bin utility, which allows attackers to store malicious code without… | Feb 8, 2000 |
| CVE-2000-0118 | Not scored | The Red Hat Linux su program does not log failed password guesses if the su process is killed before it times out, which allows local attackers to conduct brute force password guessing. | Feb 8, 2000 |
| CVE-2000-0115 | Not scored | IIS allows local users to cause a denial of service via invalid regular expressions in a Visual Basic script in an ASP page. | Feb 8, 2000 |
| CVE-2000-0114 | Not scored | Frontpage Server Extensions allows remote attackers to determine the name of the anonymous account via an RPC POST request to shtml.dll in the /_vti_bin/ virtual directory. | Feb 8, 2000 |
| CVE-2000-0110 | Not scored | The WebSiteTool shopping cart application allows remote users to modify sensitive purchase information via hidden form fields. | Feb 8, 2000 |
| CVE-2000-0109 | Not scored | The mcsp Client Site Processor system (MultiCSP) in Standard and Poor's ComStock is installed with several accounts that have no passwords or easily guessable default passwords. | Feb 8, 2000 |
| CVE-2000-0108 | Not scored | The Intellivend shopping cart application allows remote users to modify sensitive purchase information via hidden form fields. | Feb 8, 2000 |
| CVE-2000-0106 | Not scored | The EasyCart shopping cart application allows remote users to modify sensitive purchase information via hidden form fields. | Feb 8, 2000 |
| CVE-2000-0105 | Not scored | Outlook Express 5.01 and Internet Explorer 5.01 allow remote attackers to view a user's email messages via a script that accesses a variable that references subsequent email messages that are read by the client. | Feb 8, 2000 |
| CVE-2000-0104 | Not scored | The Shoptron shopping cart application allows remote users to modify sensitive purchase information via hidden form fields. | Feb 8, 2000 |
| CVE-2000-0103 | Not scored | The SmartCart shopping cart application allows remote users to modify sensitive purchase information via hidden form fields. | Feb 8, 2000 |
| CVE-2000-0102 | Not scored | The SalesCart shopping cart application allows remote users to modify sensitive purchase information via hidden form fields. | Feb 8, 2000 |
| CVE-2000-0101 | Not scored | The Make-a-Store OrderPage shopping cart application allows remote users to modify sensitive purchase information via hidden form fields. | Feb 8, 2000 |
| CVE-2000-0096 | Not scored | Buffer overflow in qpopper 3.0 beta versions allows local users to gain privileges via a long LIST command. | Feb 8, 2000 |
| CVE-2000-0093 | Not scored | An installation of Red Hat uses DES password encryption with crypt() for the initial password, instead of md5. | Feb 8, 2000 |
| CVE-2000-0086 | Not scored | Netopia Timbuktu Pro sends user IDs and passwords in cleartext, which allows remote attackers to obtain them via sniffing. | Feb 4, 2000 |
| CVE-2000-0085 | Not scored | Hotmail does not properly filter JavaScript code from a user's mailbox, which allows a remote attacker to execute code via the LOWSRC or DYNRC parameters in the IMG tag. | Feb 4, 2000 |
| CVE-2000-0084 | Not scored | CuteFTP uses weak encryption to store password information in its tree.dat file. | Feb 4, 2000 |
| CVE-2000-0082 | Not scored | WebTV email client allows remote attackers to force the client to send email without the user's knowledge via HTML. | Feb 4, 2000 |
| CVE-2000-0081 | Not scored | Hotmail does not properly filter JavaScript code from a user's mailbox, which allows a remote attacker to execute the code by using hexadecimal codes to specify the javascript: protocol, e.g. jAvascript. | Feb 4, 2000 |
| CVE-2000-0079 | Not scored | The W3C CERN httpd HTTP server allows remote attackers to determine the real pathnames of some commands via a request for a nonexistent URL. | Feb 4, 2000 |
| CVE-2000-0078 | Not scored | The June 1999 version of the HP-UX aserver program allows local users to gain privileges by specifying an alternate PATH which aserver uses to find the awk command. | Feb 4, 2000 |
| CVE-2000-0077 | Not scored | The October 1998 version of the HP-UX aserver program allows local users to gain privileges by specifying an alternate PATH which aserver uses to find the ps and grep commands. | Feb 4, 2000 |
| CVE-2000-0074 | Not scored | PowerScripts PlusMail CGI program allows remote attackers to execute commands via a password file with improper permissions. | Feb 4, 2000 |
| CVE-2000-0071 | Not scored | IIS 4.0 allows a remote attacker to obtain the real pathname of the document root by requesting non-existent files with .ida or .idq extensions. | Feb 4, 2000 |
| CVE-2000-0069 | Not scored | The recover program in Solstice Backup allows local users to restore sensitive files. | Feb 4, 2000 |
| CVE-2000-0068 | Not scored | daynad program in Intel InBusiness E-mail Station does not require authentication, which allows remote attackers to modify its configuration, delete files, or read mail. | Feb 4, 2000 |
| CVE-2000-0067 | Not scored | CyberCash Merchant Connection Kit (MCK) allows local users to modify files via a symlink attack. | Feb 4, 2000 |
| CVE-2000-0066 | Not scored | WebSite Pro allows remote attackers to determine the real pathname of webdirectories via a malformed URL request. | Feb 4, 2000 |
| CVE-2000-0061 | Not scored | Internet Explorer 5 does not modify the security zone for a document that is being loaded into a window until after the document has been loaded, which could allow remote attackers to execute Javascript in a different security context… | Feb 4, 2000 |
| CVE-2000-0059 | Not scored | PHP3 with safe_mode enabled does not properly filter shell metacharacters from commands that are executed by popen, which could allow remote attackers to execute commands. | Feb 4, 2000 |
| CVE-2000-0058 | Not scored | Network HotSync program in Handspring Visor does not have authentication, which allows remote attackers to retrieve email and files. | Feb 4, 2000 |
| CVE-2000-0055 | Not scored | Buffer overflow in Solaris chkperm command allows local users to gain root access via a long -n option. | Feb 4, 2000 |
| CVE-2000-0054 | Not scored | search.cgi in the SolutionScripts Home Free package allows remote attackers to view directories via a .. (dot dot) attack. | Feb 4, 2000 |
| CVE-2000-0049 | Not scored | Buffer overflow in Winamp client allows remote attackers to execute commands via a long entry in a .pls file. | Feb 4, 2000 |
| CVE-2000-0047 | Not scored | Buffer overflow in Yahoo Pager/Messenger client allows remote attackers to cause a denial of service via a long URL within a message. | Feb 4, 2000 |
| CVE-2000-0046 | Not scored | Buffer overflow in ICQ 99b 1.1.1.1 client allows remote attackers to execute commands via a malformed URL within an ICQ message. | Feb 4, 2000 |
| CVE-2000-0038 | Not scored | glFtpD includes a default glftpd user account with a default password and a UID of 0. | Feb 4, 2000 |
| CVE-2000-0035 | Not scored | resend command in Majordomo allows local users to gain privileges via shell metacharacters. | Feb 4, 2000 |
| CVE-2000-0028 | Not scored | Internet Explorer 5.0 and 5.01 allows remote attackers to bypass the cross frame security policy and read files via the external.NavigateAndFind function. | Feb 4, 2000 |
| CVE-2000-0021 | Not scored | Lotus Domino HTTP server allows remote attackers to determine the real path of the server via a request to a non-existent script in /cgi-bin. | Feb 4, 2000 |
| CVE-2000-0019 | Not scored | IMail POP3 daemon uses weak encryption, which allows local users to read files. | Feb 4, 2000 |
| CVE-2000-0017 | Not scored | Buffer overflow in Linux linuxconf package allows remote attackers to gain root privileges via a long parameter. | Feb 4, 2000 |
| CVE-2000-0016 | Not scored | Buffer overflow in Internet Anywhere POP3 Mail Server allows remote attackers to cause a denial of service or execute commands via a long username. | Feb 4, 2000 |
| CVE-2000-0008 | Not scored | FTPPro allows local users to read sensitive information, which is stored in plain text. | Feb 4, 2000 |
| CVE-2000-0005 | Not scored | HP-UX aserver program allows local users to gain privileges via a symlink attack. | Feb 4, 2000 |
| CVE-1999-1009 | Not scored | The Disney Go Express Search allows remote attackers to access and modify search information for users by connecting to an HTTP server on the user's system. | Feb 4, 2000 |
| CVE-1999-1006 | Not scored | Groupwise web server GWWEB.EXE allows remote attackers to determine the real path of the web server via the HELP parameter. | Feb 4, 2000 |
| CVE-1999-1003 | Not scored | War FTP Daemon 1.70 allows remote attackers to cause a denial of service by flooding it with connections. | Feb 4, 2000 |
| CVE-1999-1002 | Not scored | Netscape Navigator uses weak encryption for storing a user's Netscape mail password. | Feb 4, 2000 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.