Browse CVE records published in January 2000, with severity, affected products, CWE, KEV, and source-backed vulnerability context.
Showing 50 of 232 matching CVEs · Page 3 of 5.
The NSAPI plugins for TGA and the Java Servlet proxy in HP-UX VVOS 10.24 and 11.04 allows an attacker to cause a denial of service (high CPU utilization).
Published Jan 22, 2001 · Updated Aug 8, 2024
Format string vulnerability in AOL Instant Messenger (AIM) 4.1.2010 allows remote attackers to cause a denial of service and possibly execute arbitrary commands by transferring a file whose name includes format characters.
Published Jan 22, 2001 · Updated Aug 8, 2024
MySQL Database Engine uses a weak authentication method which leaks information that could be used by a remote attacker to recover the password.
Published Jan 22, 2001 · Updated Aug 8, 2024
GnuPG (gpg) 1.0.3 does not properly check all signatures of a file containing multiple documents, which allows an attacker to modify contents of all documents but the first without detection.
Published Jan 22, 2001 · Updated Aug 8, 2024
Buffer overflow in Intel InBusiness eMail Station 1.04.87 POP service allows remote attackers to cause a denial of service and possibly execute commands via a long username.
Published Jan 22, 2001 · Updated Aug 8, 2024
Microsoft NetMeeting with Remote Desktop Sharing enabled allows remote attackers to cause a denial of service (CPU utilization) via a sequence of null bytes to the NetMeeting port, aka the "NetMeeting Desktop Sharing" vulnerability.
Published Jan 22, 2001 · Updated Aug 8, 2024
mailfile.cgi CGI program in MailFile 1.10 allows remote attackers to read arbitrary files by specifying the target file name in the "filename" parameter in a POST request, which is then sent by email to the address specified in the "email" parameter.
Published Jan 22, 2001 · Updated Aug 8, 2024
WQuinn QuotaAdvisor 4.1 allows users to list directories and files by running a report on the targeted shares.
Published Jan 22, 2001 · Updated Aug 8, 2024
Buffer overflow in Hilgraeve, Inc. HyperTerminal client on Windows 98, ME, and 2000 allows remote attackers to execute arbitrary commands via a long telnet URL, aka the "HyperTerminal Buffer Overflow" vulnerability.
Published Jan 22, 2001 · Updated Aug 8, 2024
BrowseGate 2.80 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via long Authorization or Referer MIME headers in the HTTP request.
Published Jan 22, 2001 · Updated Aug 8, 2024
GnoRPM before 0.95 allows local users to modify arbitrary files via a symlink attack.
Published Jan 22, 2001 · Updated Aug 8, 2024
bbd server in Big Brother System and Network Monitor before 1.5c2 allows remote attackers to execute arbitrary commands via the "&" shell metacharacter.
Published Jan 22, 2001 · Updated Aug 8, 2024
Internet Explorer before 5.5 forwards cached user credentials for a secure web site to insecure pages on the same web site, which could allow remote attackers to obtain the credentials by monitoring connections to the web server, aka the "Cached Web Credentials" vulnerability.
Published Jan 22, 2001 · Updated Aug 8, 2024
Buffer overflows in lpspooler in the fileset PrinterMgmt.LP-SPOOL of HP-UX 11.0 and earlier allows local users to gain privileges.
Published Jan 22, 2001 · Updated Aug 8, 2024
The CiWebHitsFile component in Microsoft Indexing Services for Windows 2000 allows remote attackers to conduct a cross site scripting (CSS) attack via a CiRestriction parameter in a .htw request, aka the "Indexing Services Cross Site Scripting" vulnerability.
Published Jan 22, 2001 · Updated Aug 8, 2024
The IPSEC implementation in OpenBSD 2.7 does not properly handle empty AH/ESP packets, which allows remote attackers to cause a denial of service.
Published Jan 22, 2001 · Updated Aug 8, 2024
PHP 3 and 4 do not properly cleanse user-injected format strings, which allows remote attackers to execute arbitrary commands by triggering error messages that are improperly written to the error logs.
Published Jan 22, 2001 · Updated Aug 8, 2024
Directory traversal vulnerability in BOA web server 0.94.8.2 and earlier allows remote attackers to read arbitrary files via a modified .. (dot dot) attack in the GET HTTP request that uses a "%2E" instead of a "."
Published Jan 22, 2001 · Updated Aug 8, 2024
cyrus-sasl before 1.5.24 in Red Hat Linux 7.0 does not properly verify the authorization for a local user, which could allow the users to bypass specified access restrictions.
Published Jan 22, 2001 · Updated Aug 8, 2024
Samba Web Administration Tool (SWAT) in Samba 2.0.7 does not log login attempts in which the username is correct but the password is wrong, which allows remote attackers to conduct brute force password guessing attacks.
Published Jan 22, 2001 · Updated Aug 8, 2024
MultiHTML CGI script allows remote attackers to read arbitrary files and possibly execute arbitrary commands by specifying the file name to the "multi" parameter.
Published Jan 22, 2001 · Updated Aug 8, 2024
HotJava Browser 3.0 allows remote attackers to access the DOM of a web page by opening a javascript: URL in a named window.
Published Jan 22, 2001 · Updated Aug 8, 2024
Format string vulnerability in cfd daemon in GNU CFEngine before 1.6.0a11 allows attackers to execute arbitrary commands via format characters in the CAUTH command.
Published Jan 22, 2001 · Updated Aug 8, 2024
fingerd in FreeBSD 4.1.1 allows remote attackers to read arbitrary files by specifying the target file name instead of a regular user name.
Published Jan 22, 2001 · Updated Aug 8, 2024
Buffer overflow in curl earlier than 6.0-1.1, and curl-ssl earlier than 6.0-1.2, allows remote attackers to execute arbitrary commands by forcing a long error message to be generated.
Published Jan 22, 2001 · Updated Aug 8, 2024
File and Print Sharing service in Windows 95, Windows 98, and Windows Me does not properly check the password for a file share, which allows remote attackers to bypass share access controls by sending a 1-byte password that matches the first character of the real password, aka the "Share Level Password" vulnerability.
Published Jan 22, 2001 · Updated Aug 8, 2024
Buffer overflow in bftp daemon (bftpd) 1.0.11 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long USER command.
Published Jan 22, 2001 · Updated Aug 8, 2024
MAILsweeper for SMTP 3.x does not properly handle corrupt CDA documents in a ZIP file and hangs, which allows remote attackers to cause a denial of service.
Published Jan 22, 2001 · Updated Aug 8, 2024
Vulnerability in Microsoft Windows NT 4.0 allows remote attackers to cause a denial of service in IIS by sending it a series of malformed requests which cause INETINFO.EXE to fail, aka the "Invalid URL" vulnerability.
Published Jan 22, 2001 · Updated Aug 8, 2024
Samba Web Administration Tool (SWAT) in Samba 2.0.7 supplies a different error message when a valid username is provided versus an invalid name, which allows remote attackers to identify valid users on the server.
Published Jan 22, 2001 · Updated Aug 8, 2024
Buffer overflow in IMAP server in Netscape Messaging Server 4.15 Patch 2 allows local users to execute arbitrary commands via a long LIST command.
Published Jan 22, 2001 · Updated Aug 8, 2024
HP-UX 11.00 crontab allows local users to read arbitrary files via the -e option by creating a symlink to the target file during the crontab session, quitting the session, and reading the error messages that crontab generates.
Published Jan 22, 2001 · Updated Aug 8, 2024
authenticate.cgi CGI program in Aplio PRO allows remote attackers to execute arbitrary commands via shell metacharacters in the password parameter.
Published Jan 22, 2001 · Updated Aug 8, 2024
The Input Method Editor (IME) in the Simplified Chinese version of Windows 2000 does not disable access to privileged functionality that should normally be restricted, which allows local users to gain privileges, aka the "Simplified Chinese IME State Recognition" vulnerability.
Published Jan 22, 2001 · Updated Aug 8, 2024
Compaq Easy Access Keyboard software 1.3 does not properly disable access to custom buttons when the screen is locked, which could allow an attacker to gain privileges or execute programs without authorization.
Published Jan 22, 2001 · Updated Aug 8, 2024
Buffer overflow in Half Life dedicated server before build 3104 allows remote attackers to execute arbitrary commands via a long rcon command.
Published Jan 22, 2001 · Updated Aug 8, 2024
glibc2 does not properly clear the LD_DEBUG_OUTPUT and LD_DEBUG environmental variables when a program is spawned from a setuid program, which could allow local users to overwrite files via a symlink attack.
Published Jan 22, 2001 · Updated Aug 8, 2024
Glint in Red Hat Linux 5.2 allows local users to overwrite arbitrary files and cause a denial of service via a symlink attack.
Published Jan 22, 2001 · Updated Aug 8, 2024
A misconfiguration in IIS 5.0 with Index Server enabled and the Index property set allows remote attackers to list directories in the web root via a Web Distributed Authoring and Versioning (WebDAV) search.
Published Jan 22, 2001 · Updated Aug 8, 2024
Shambala Server 4.5 allows remote attackers to cause a denial of service by opening then closing a connection.
Published Jan 22, 2001 · Updated Aug 8, 2024
The pluggable authentication module for mysql (pam_mysql) before 0.4.7 does not properly cleanse user input when constructing SQL statements, which allows attackers to obtain plaintext passwords or hashes.
Published Jan 22, 2001 · Updated Aug 8, 2024
OpenBSD 2.6 and earlier allows remote attackers to cause a denial of service by flooding the server with ARP requests.
Published Jan 22, 2001 · Updated Aug 8, 2024
The POP3 server in Netscape Messaging Server 4.15p1 generates different error messages for incorrect user names versus incorrect passwords, which allows remote attackers to determine valid users on the system and harvest email addresses for spam abuse.
Published Jan 22, 2001 · Updated Aug 8, 2024
IMP 2.2 and earlier allows attackers to read and delete arbitrary files by modifying the attachment_name hidden form variable, which causes IMP to send the file to the attacker as an attachment.
Published Jan 22, 2001 · Updated Aug 8, 2024
Directory traversal vulnerability in ssi CGI program in thttpd 2.19 and earlier allows remote attackers to read arbitrary files via a "%2e%2e" string, a variation of the .. (dot dot) attack.
Published Jan 22, 2001 · Updated Aug 8, 2024
Directory traversal vulnerability in PHPix Photo Album 1.0.2 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) attack.
Published Jan 22, 2001 · Updated Aug 8, 2024
IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary commands, via malformed URLs that contain UNICODE encoded characters, aka the "Web Server Folder Traversal" vulnerability.
Published Jan 22, 2001 · Updated Aug 8, 2024
Samba Web Administration Tool (SWAT) in Samba 2.0.7 installs the cgi.log logging file with world readable permissions, which allows local users to read sensitive information such as user names and passwords.
Published Jan 22, 2001 · Updated Aug 8, 2024
IIS 5.0 allows remote attackers to execute arbitrary commands via a malformed request for an executable file whose name is appended with operating system commands, aka the "Web Server File Request Parsing" vulnerability.
Published Jan 22, 2001 · Updated Aug 8, 2024
CGI Script Center News Update 1.1 does not properly validate the original news administration password during a password change operation, which allows remote attackers to modify the password without knowing the original password.
Published Jan 22, 2001 · Updated Aug 8, 2024
