Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,282 results · page 26 of 26
Nov 12, 2002The remote management web server for Linksys BEFSR41 EtherFast Cable/DSL Router before firmware 1.42.7 allows remote attackers to cause a denial of service (craCVE-2002-1236 · Network & remote access · Linksys · reported by MITREMedium 5
The remote management web server for Linksys BEFSR41 EtherFast Cable/DSL Router before firmware 1.42.7 allows remote attackers to cause a denial of service (crash) via an HTTP request to Gozila.cgi without any arguments.
- Product
- Befsr41
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.commarc.info
Oct 4, 2002MetaCart2.sql stores the user database under the web document root without access controls, which allows remote attackers to obtain sensitive information such aCVE-2002-0943 · Other software · Metalinks · reported by MITREMedium 6.4
MetaCart2.sql stores the user database under the web document root without access controls, which allows remote attackers to obtain sensitive information such as passwords and credit card numbers via a direct request for metacart.mdb.
- Product
- Metacart2.sql
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comiss.net
Aug 12, 2002bzip2 before 1.0.2 in FreeBSD 4.5 and earlier, OpenLinux 3.1 and 3.1.1, and possibly systems, uses the permissions of symbolic links instead of the actual filesCVE-2002-0761 · Other software · Bzip · reported by MITRELow 2.1
bzip2 before 1.0.2 in FreeBSD 4.5 and earlier, OpenLinux 3.1 and 3.1.1, and possibly systems, uses the permissions of symbolic links instead of the actual files when creating an archive, which could cause the files to be extracted with less restrictive permissions than intended.
- Product
- Bzip2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordftp.caldera.comftp.freebsd.org
Aug 12, 2002VPN Server module in Linksys EtherFast BEFVP41 Cable/DSL VPN Router before 1.40.1 reduces the key lengths for keys that are supplied via manual key entry, whichCVE-2002-0426 · Network & remote access · Linksys · reported by MITREHigh 7.5
VPN Server module in Linksys EtherFast BEFVP41 Cable/DSL VPN Router before 1.40.1 reduces the key lengths for keys that are supplied via manual key entry, which makes it easier for attackers to crack the keys.
- Product
- Befvp41
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordftp.linksys.comonline.securityfocus.com
Jul 3, 2002The admin.html file in StepWeb Search Engine (SWS) 2.5 stores passwords in links to manager.pl, which allows remote attackers who can access the admin.html fileCVE-2002-0537 · Other software · Stepweb · reported by MITREHigh 10
The admin.html file in StepWeb Search Engine (SWS) 2.5 stores passwords in links to manager.pl, which allows remote attackers who can access the admin.html file to gain administrative privileges to SWS.
- Product
- SWS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comiss.net
Apr 1, 2002Check Point Firewall-1 3.0b through 4.0 SP1 follows symlinks and creates a world-writable temporary .cpp file when compiling Policy rules, which could allow locCVE-2001-1171 · Other software · Checkpoint · reported by MITREHigh 7.2
Check Point Firewall-1 3.0b through 4.0 SP1 follows symlinks and creates a world-writable temporary .cpp file when compiling Policy rules, which could allow local users to gain privileges or modify the firewall policy.
- Product
- Firewall-1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comarchives.neohapsis.com
Mar 25, 2002Linksys EtherFast BEFN2PS4, BEFSR41, and BEFSR81 Routers, and possibly other products, allow remote attackers to gain sensitive information and cause a denial oCVE-2002-0109 · Network & remote access · Linksys · reported by MITREMedium 6.4
Linksys EtherFast BEFN2PS4, BEFSR41, and BEFSR81 Routers, and possibly other products, allow remote attackers to gain sensitive information and cause a denial of service via an SNMP query for the default community string "public," which causes the router to change its configuration and send SNMP trap information back to the system that initiated the query.
- Product
- Befn2ps4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2002UNIX news readers tin and rtin create the /tmp/.tin_log file with insecure permissions and follow symlinks, which allows attackers to modify the permissions of CVE-1999-1091 · Other software · Rtin · reported by MITREMedium 5
UNIX news readers tin and rtin create the /tmp/.tin_log file with insecure permissions and follow symlinks, which allows attackers to modify the permissions of files writable by the user via a symlink attack.
- Product
- Rtin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2001WebX stores authentication information in the HTTP_REFERER variable, which is included in URL links within bulletin board messages posted by users, which could CVE-2001-1532 · Other software · Web Crossing · reported by MITREMedium 5
WebX stores authentication information in the HTTP_REFERER variable, which is included in URL links within bulletin board messages posted by users, which could allow remote attackers to hijack user sessions.
- Product
- Webx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiss.netsecurityfocus.com
Nov 15, 2001Opera 6.0 and earlier allows remote attackers to access sensitive information such as cookies and links for other domains via Javascript that uses setTimeout toCVE-2001-0898 · Computers, phones & browsers · Opera Software · reported by MITREMedium 5
Opera 6.0 and earlier allows remote attackers to access sensitive information such as cookies and links for other domains via Javascript that uses setTimeout to (1) access data after a new window to the domain has been opened or (2) access data via about:cache.
- Product
- Opera Web Browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2001Linux kernel 2.2.1 through 2.2.19, and 2.4.1 through 2.4.10, allows local users to cause a denial of service via a series of deeply nested symlinks, which causeCVE-2001-0907 · Computers, phones & browsers · Linux · reported by MITRELow 2.1
Linux kernel 2.2.1 through 2.2.19, and 2.4.1 through 2.4.10, allows local users to cause a denial of service via a series of deeply nested symlinks, which causes the kernel to spend extra time when trying to access the link.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordftp.caldera.comdownload.immunix.org
Aug 10, 2001LinkSys EtherFast BEFSR41 Cable/DSL routers running firmware before 1.39.3 Beta allows a remote attacker to view administration and user passwords by connectingCVE-2001-1117 · Network & remote access · Linksys · reported by MITREMedium 5
LinkSys EtherFast BEFSR41 Cable/DSL routers running firmware before 1.39.3 Beta allows a remote attacker to view administration and user passwords by connecting to the router and viewing the HTML source for (1) index.htm and (2) Password.htm.
- Product
- Befsr41
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordftp.linksys.comosvdb.org
Jul 21, 2001SNMP service in Atmel 802.11b VNET-B Access Point 1.3 and earlier, as used in Netgear ME102 and Linksys WAP11, accepts arbitrary community strings with requesteCVE-2001-0514 · Other software · Atmel · reported by MITREHigh 7.5
SNMP service in Atmel 802.11b VNET-B Access Point 1.3 and earlier, as used in Netgear ME102 and Linksys WAP11, accepts arbitrary community strings with requested MIB modifications, which allows remote attackers to obtain sensitive information such as WEP keys, cause a denial of service, or gain access to the network.
- Product
- 802.11b Vnet-b Access Point
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comxforce.iss.net
Jul 19, 2001Vulnerability in The Web Information Gateway (TWIG) 2.7.1, possibly related to incorrect security rights and/or the generation of mailto links.CVE-2001-1361 · Other software · Twig Development Team · reported by MITREHigh 7.5
Vulnerability in The Web Information Gateway (TWIG) 2.7.1, possibly related to incorrect security rights and/or the generation of mailto links.
- Product
- Twig
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comtwig.screwdriver.net
Jun 27, 2001Microsoft Word before Word 2002 allows attackers to automatically execute macros without warning the user via a Rich Text Format (RTF) document that links to a CVE-2001-0240 · Email & office · Microsoft · reported by MITREMedium 4.6
Microsoft Word before Word 2002 allows attackers to automatically execute macros without warning the user via a Rich Text Format (RTF) document that links to a template with the embedded macro.
- Product
- Word
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comdocs.microsoft.com
Mar 12, 2001The kernel in FreeBSD 3.2 follows symbolic links when it creates core dump files, which allows local attackers to modify arbitrary files.CVE-2000-0375 · Other software · Freebsd · reported by MITRELow 2.1
The kernel in FreeBSD 3.2 follows symbolic links when it creates core dump files, which allows local attackers to modify arbitrary files.
- Product
- Freebsd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2001Interscan VirusWall 3.6.x and earlier follows symbolic links when uninstalling the product, which allows local users to overwrite arbitrary files via a symlink CVE-2001-0132 · Other software · Trend Micro · reported by MITRELow 1.2
Interscan VirusWall 3.6.x and earlier follows symbolic links when uninstalling the product, which allows local users to overwrite arbitrary files via a symlink attack.
- Product
- Interscan Viruswall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecurityfocus.com
Jan 9, 2001Joe text editor follows symbolic links when creating a rescue copy called DEADJOE during an abnormal exit, which allows local users to overwrite the files of otCVE-2000-1178 · Other software · Joseph Allen · reported by MITREMedium 5.5
Joe text editor follows symbolic links when creating a rescue copy called DEADJOE during an abnormal exit, which allows local users to overwrite the files of other users whose joe session crashes.
- Product
- JOE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comdistro.conectiva.com.br
Jan 9, 2001Multiple shell programs on various Unix systems, including (1) tcsh, (2) csh, (3) sh, and (4) bash, follow symlinks when processing << redirects (aka here-documCVE-2000-1134 · Other software · Immunix · reported by MITREHigh 7.2
Multiple shell programs on various Unix systems, including (1) tcsh, (2) csh, (3) sh, and (4) bash, follow symlinks when processing << redirects (aka here-documents or in-here documents), which allows local users to overwrite files of other users via a symlink attack.
- Product
- Immunix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordftp.freebsd.orgpatches.sgi.com
Jan 9, 2001StarOffice 5.2 follows symlinks and sets world-readable permissions for the /tmp/soffice.tmp directory, which allows a local user to read files of the user who CVE-2000-1156 · Other software · SUN · reported by MITRELow 3.6
StarOffice 5.2 follows symlinks and sets world-readable permissions for the /tmp/soffice.tmp directory, which allows a local user to read files of the user who is using StarOffice.
- Product
- Staroffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecurityfocus.com
May 10, 2000Netscape 4.73 and earlier follows symlinks when it imports a new certificate, which allows local users to overwrite files of the user importing the certificate.CVE-2000-0409 · Other software · Netscape · reported by MITRELow 3.7
Netscape 4.73 and earlier follows symlinks when it imports a new certificate, which allows local users to overwrite files of the user importing the certificate.
- Product
- Communicator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecurityfocus.com
Mar 5, 2000The installation of Oracle 8.1.5.x on Linux follows symlinks and creates the orainstRoot.sh file with world-writeable permissions, which allows local users to gCVE-2000-0206 · Other software · Oracle · reported by MITREMedium 6.2
The installation of Oracle 8.1.5.x on Linux follows symlinks and creates the orainstRoot.sh file with world-writeable permissions, which allows local users to gain privileges.
- Product
- Oracle8i
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecurityfocus.com
Feb 21, 2000The lit program in Sun Flex License Manager (FlexLM) follows symlinks, which allows local users to modify arbitrary files.CVE-2000-0210 · Other software · SUN · reported by MITRELow 1.2
The lit program in Sun Flex License Manager (FlexLM) follows symlinks, which allows local users to modify arbitrary files.
- Product
- Workshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Feb 1, 2000GNU make follows symlinks when it reads a Makefile from stdin, which allows other local users to execute commands.CVE-2000-0151 · Other software · GNU · reported by MITREMedium 6.2
GNU make follows symlinks when it reads a Makefile from stdin, which allows other local users to execute commands.
- Product
- Make
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Dec 31, 1999Perl 5.004_04 and earlier follows symbolic links when running with the -e option, which allows local users to overwrite arbitrary files via a symlink attack on CVE-1999-1386 · Other software · Perl · reported by MITREMedium 5.5
Perl 5.004_04 and earlier follows symbolic links when running with the -e option, which allows local users to overwrite arbitrary files via a symlink attack on the /tmp/perl-eaXXXXX file.
- Product
- Perl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 1999dump in Debian GNU/Linux 2.1 does not properly restore symlinks, which allows a local user to modify the ownership of arbitrary files.CVE-2000-0366 · Other software · Debian · reported by MITRELow 2.1
dump in Debian GNU/Linux 2.1 does not properly restore symlinks, which allows a local user to modify the ownership of arbitrary files.
- Product
- Debian Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddebian.orgsecurityfocus.com
Sep 28, 1999mknod in Linux 2.2 follows symbolic links, which could allow local users to overwrite files or gain privileges.CVE-1999-1352 · Computers, phones & browsers · Linux · reported by MITREMedium 4.6
mknod in Linux 2.2 follows symbolic links, which could allow local users to overwrite files or gain privileges.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 1999The SSH authentication agent follows symlinks via a UNIX domain socket.CVE-1999-0787 · Other software · SSH · reported by MITRELow 2.1
The SSH authentication agent follows symlinks via a UNIX domain socket.
- Product
- SSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 1999Trn allows local users to overwrite other users' files via symlinks.CVE-1999-0743 · Other software · Debian · reported by MITRELow 2.1
Trn allows local users to overwrite other users' files via symlinks.
- Product
- Debian Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Aug 19, 1999The logging facility of the Debian smtp-refuser package allows local users to delete arbitrary files using symbolic links.CVE-1999-0732 · Other software · Debian · reported by MITRELow 2.1
The logging facility of the Debian smtp-refuser package allows local users to delete arbitrary files using symbolic links.
- Product
- Debian Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Feb 11, 1999Lynx allows a local user to overwrite sensitive files through /tmp symlinks.CVE-1999-0371 · Other software · University Of Kansas · reported by MITRELow 1.2
Lynx allows a local user to overwrite sensitive files through /tmp symlinks.
- Product
- Lynx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Jan 2, 1999wget 1.5.3 follows symlinks to change permissions of the target file instead of the symlink itself.CVE-1999-0402 · Other software · GNU · reported by MITREMedium 5
wget 1.5.3 follows symlinks to change permissions of the target file instead of the symlink itself.
- Product
- Wget
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.