Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7,417 results · page 149 of 149
Aug 8, 1999Buffer overflow in ALMail32 POP3 client via From: or To: headers.CVE-1999-0673 · Other software · Crear · reported by MITREMedium 5.1
Buffer overflow in ALMail32 POP3 client via From: or To: headers.
- Product
- Almail32
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Aug 3, 1999Buffer overflow in ToxSoft NextFTP client through CWD command.CVE-1999-0671 · Other software · Toxsoft · reported by MITREMedium 5.1
Buffer overflow in ToxSoft NextFTP client through CWD command.
- Product
- Nextftp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Aug 1, 1999Buffer overflow in Fujitsu Chocoa IRC client via IRC channel topics.CVE-1999-0672 · Other software · Fujitsu · reported by MITREMedium 5.1
Buffer overflow in Fujitsu Chocoa IRC client via IRC channel topics.
- Product
- Chocoa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Aug 1, 1999FTP client in Midnight Commander (mc) before 4.5.11 stores usernames and passwords for visited sites in plaintext in the world-readable history file, which alloCVE-1999-1337 · Other software · Midnight Commander · reported by MITREMedium 4.6
FTP client in Midnight Commander (mc) before 4.5.11 stores usernames and passwords for visited sites in plaintext in the world-readable history file, which allows other local users to gain privileges.
- Product
- Midnight Commander
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 1999Microsoft Outlook client allows remote attackers to cause a denial of service by sending multiple email messages with the same X-UIDL headers, which causes OutlCVE-1999-1164 · Email & office · Microsoft · reported by MITREMedium 5
Microsoft Outlook client allows remote attackers to cause a denial of service by sending multiple email messages with the same X-UIDL headers, which causes Outlook to hang.
- Product
- Outlook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 1999The Windows NT Client Server Runtime Subsystem (CSRSS) can be subjected to a denial of service when all worker threads are waiting for user input.CVE-1999-0723 · Computers, phones & browsers · Microsoft · reported by MITREHigh 7.1
The Windows NT Client Server Runtime Subsystem (CSRSS) can be subjected to a denial of service when all worker threads are waiting for user input.
- Product
- Windows 2000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.microsoft.comciac.org
May 27, 1999Windows NT RRAS and RAS clients cache a user's password even if the user has not selected the "Save password" option.CVE-1999-0755 · Computers, phones & browsers · Microsoft · reported by MITREMedium 5
Windows NT RRAS and RAS clients cache a user's password even if the user has not selected the "Save password" option.
- Product
- Windows 2000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.microsoft.comdocs.microsoft.com
May 20, 1999Buffer overflow in Remote Access Service (RAS) client allows an attacker to execute commands or cause a denial of service via a malformed phonebook entry.CVE-1999-0715 · Computers, phones & browsers · Microsoft · reported by MITREMedium 4.6
Buffer overflow in Remote Access Service (RAS) client allows an attacker to execute commands or cause a denial of service via a malformed phonebook entry.
- Product
- Windows 2000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.microsoft.comdocs.microsoft.com
May 15, 1999Pegasus e-mail client 3.0 and earlier uses weak encryption to store POP3 passwords in the pmail.ini file, which allows local users to easily decrypt the passworCVE-1999-1366 · Other software · David Harris · reported by MITRELow 3.6
Pegasus e-mail client 3.0 and earlier uses weak encryption to store POP3 passwords in the pmail.ini file, which allows local users to easily decrypt the passwords and read e-mail.
- Product
- Pegasus Mail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 1999Microsoft NetMeeting 2.1 allows one client to read the contents of another client's clipboard via a CTRL-C in the chat box when the box is empty.CVE-1999-1097 · Computers, phones & browsers · Microsoft · reported by MITREMedium 6.4
Microsoft NetMeeting 2.1 allows one client to read the contents of another client's clipboard via a CTRL-C in the chat box when the box is empty.
- Product
- Netmeeting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infoexchange.xforce.ibmcloud.com
May 1, 1999The gnapster and knapster clients for Napster do not properly restrict access only to MP3 files, which allows remote attackers to read arbitrary files from the CVE-2000-0412 · Other software · Napster · reported by MITREHigh 7.5
The gnapster and knapster clients for Napster do not properly restrict access only to MP3 files, which allows remote attackers to read arbitrary files from the client by specifying the full pathname for the file.
- Product
- Knapster
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordftp.freebsd.orgarchives.neohapsis.com
Apr 9, 1999Internet Explorer 5.0 allows a remote server to read arbitrary files on the client's file system using the Microsoft Scriptlet Component.CVE-1999-0468 · Computers, phones & browsers · Microsoft · reported by MITREHigh 8.2
Internet Explorer 5.0 allows a remote server to read arbitrary files on the client's file system using the Microsoft Scriptlet Component.
- Product
- Internet Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.microsoft.comdocs.microsoft.com
Apr 7, 1999The rsync command before rsync 2.3.1 may inadvertently change the permissions of the client's working directory to the permissions of the directory being transfCVE-1999-0473 · Other software · Andrew Tridgell · reported by MITRELow 2.1
The rsync command before rsync 2.3.1 may inadvertently change the permissions of the client's working directory to the permissions of the directory being transferred.
- Product
- Rsync
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Apr 1, 1999Internet Explorer 5.0 allows window spoofing, allowing a remote attacker to spoof a legitimate web site and capture information from the client.CVE-1999-0469 · Computers, phones & browsers · Microsoft · reported by MITREMedium 5
Internet Explorer 5.0 allows window spoofing, allowing a remote attacker to spoof a legitimate web site and capture information from the client.
- Product
- Internet Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Mar 1, 1999The Lotus Notes 4.5 client may send a copy of encrypted mail in the clear across the network if the user does not set the "Encrypt Saved Mail" preference.CVE-1999-0429 · Other software · IBM · reported by MITREHigh 7.5
The Lotus Notes 4.5 client may send a copy of encrypted mail in the clear across the network if the user does not set the "Encrypt Saved Mail" preference.
- Product
- Lotus Notes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 1999Buffer overflow in the FTP client in the Debian GNU/Linux netstd package.CVE-1999-0914 · Other software · Debian · reported by MITREHigh 7.2
Buffer overflow in the FTP client in the Debian GNU/Linux netstd package.
- Product
- Debian Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Jan 1, 1999The DCC server command in the Mirc 5.5 client doesn't filter characters from file names properly, allowing remote attackers to place a malicious file in a diffeCVE-1999-0399 · Other software · Khaled Mardam-bey · reported by MITREHigh 7.5
The DCC server command in the Mirc 5.5 client doesn't filter characters from file names properly, allowing remote attackers to place a malicious file in a different location, possibly allowing the attacker to execute commands.
- Product
- Mirc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.