Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,352 results · page 27 of 28
May 5, 2004Cross-site scripting (XSS) vulnerability in Simple Machines Forum (SMF) 1.0 allows remote attackers to inject arbitrary web script via the size tag.CVE-2004-1996 · Other software · Simple Machines · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Simple Machines Forum (SMF) 1.0 allows remote attackers to inject arbitrary web script via the size tag.
- Product
- SMF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infosecurityfocus.com
Mar 19, 2004Buffer overflow in Terminator 3: War of the Machines 1.0 allows remote attackers to cause a denial of service via a long ServerInfo variable.CVE-2004-1853 · Other software · Atari · reported by MITREMedium 5
Buffer overflow in Terminator 3: War of the Machines 1.0 allows remote attackers to cause a denial of service via a long ServerInfo variable.
- Product
- Terminator 3 WAR Of The Machines
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaluigi.altervista.orgmarc.info
Mar 15, 2004Cross-site scripting (XSS) vulnerability in YaBB 1 Gold(SP1.3) and YaBB SE 1.5.1 Final allows remote attackers to inject arbitrary web script via the backgroundCVE-2004-1827 · Other software · Simple Machines · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in YaBB 1 Gold(SP1.3) and YaBB SE 1.5.1 Final allows remote attackers to inject arbitrary web script via the background:url property in (1) glow or (2) shadow tags.
- Product
- Simple Machines SMF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2003The loadClass method of the sun.applet.AppletClassLoader class in the Java Virtual Machine (JVM) in Sun SDK and JRE 1.4.1_03 and earlier allows remote attackersCVE-2003-0896 · Other software · SUN · reported by MITREHigh 7.5
The loadClass method of the sun.applet.AppletClassLoader class in the Java Virtual Machine (JVM) in Sun SDK and JRE 1.4.1_03 and earlier allows remote attackers to bypass sandbox restrictions and execute arbitrary code via a loaded class name that contains "/" (slash) instead of "." (dot) characters, which bypasses a call to the Security Manager's checkPackageAccess method.
- Product
- JRE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2003PHP remote file inclusion vulnerability in pm/lib.inc.php in pMachine Free and pMachine Pro 2.2 and 2.2.1 allows remote attackers to execute arbitrary PHP code CVE-2003-1086 · Other software · Pmachine · reported by MITREHigh 7.5
PHP remote file inclusion vulnerability in pm/lib.inc.php in pMachine Free and pMachine Pro 2.2 and 2.2.1 allows remote attackers to execute arbitrary PHP code by modifying the pm_path parameter to reference a URL on a remote web server that contains the code.
- Product
- Pmachine Free
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2003The ByteCode Verifier component of Microsoft Virtual Machine (VM) build 5.0.3809 and earlier, as used in Windows and Internet Explorer, allows remote attackers CVE-2003-0111 · Computers, phones & browsers · Microsoft · reported by MITREHigh 7.5
The ByteCode Verifier component of Microsoft Virtual Machine (VM) build 5.0.3809 and earlier, as used in Windows and Internet Explorer, allows remote attackers to bypass security checks and execute arbitrary code via a malicious Java applet, aka "Flaw in Microsoft VM Could Enable System Compromise."
- Product
- Virtual Machine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2002java.security.AccessController in Sun Java Virtual Machine (JVM) in JRE 1.2.2 and 1.3.1 allows remote attackers to cause a denial of service (JVM crash) via a JCVE-2002-2072 · Other software · SUN · reported by MITREMedium 5
java.security.AccessController in Sun Java Virtual Machine (JVM) in JRE 1.2.2 and 1.3.1 allows remote attackers to cause a denial of service (JVM crash) via a Java program that calls the doPrivileged method with a null argument.
- Product
- JRE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordohhara.sarang.netsecuritytracker.com
Dec 31, 2002syslogd on OpenBSD 2.9 through 3.2 does not change the source IP address of syslog packets when the machine's IP addressed is changed without rebooting, e.g.CVE-2002-2280 · Other software · Openbsd · reported by MITRELow 2.1
syslogd on OpenBSD 2.9 through 3.2 does not change the source IP address of syslog packets when the machine's IP addressed is changed without rebooting, e.g. via ifconfig, which can cause incorrect information to be sent to the syslog server.
- Product
- Openbsd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecurityfocus.com
Dec 31, 2002NT Virtual DOS Machine (NTVDM.EXE) in Windows 2000, NT and XP does not verify user execution permissions for 16-bit executable files, which allows local users tCVE-2002-2401 · Computers, phones & browsers · Microsoft · reported by MITRELow 3.6
NT Virtual DOS Machine (NTVDM.EXE) in Windows 2000, NT and XP does not verify user execution permissions for 16-bit executable files, which allows local users to bypass the loader and execute arbitrary programs.
- Product
- Windows 2000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsupport.microsoft.com
Dec 23, 2002Two vulnerabilities in Microsoft Virtual Machine (VM) up to and including build 5.0.3805, as used in Internet Explorer and other applications, allow remote attaCVE-2002-1258 · Computers, phones & browsers · Microsoft · reported by MITREMedium 5
Two vulnerabilities in Microsoft Virtual Machine (VM) up to and including build 5.0.3805, as used in Internet Explorer and other applications, allow remote attackers to read files via a Java applet with a spoofed location in the CODEBASE parameter in the APPLET tag, possibly due to a parsing error.
- Product
- Windows 2000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.microsoft.comoval.cisecurity.org
Dec 23, 2002Microsoft Virtual Machine (VM) build 5.0.3805 and earlier allows remote attackers to determine a local user's username via a Java applet that accesses the user.CVE-2002-1325 · Computers, phones & browsers · Microsoft · reported by MITREMedium 5
Microsoft Virtual Machine (VM) build 5.0.3805 and earlier allows remote attackers to determine a local user's username via a Java applet that accesses the user.dir system property, aka "User.dir Exposure Vulnerability."
- Product
- Windows 2000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comdocs.microsoft.com
Dec 23, 2002The Java Database Connectivity (JDBC) APIs in Microsoft Virtual Machine (VM) 5.0.3805 and earlier allow remote attackers to bypass security checks and access daCVE-2002-1260 · Computers, phones & browsers · Microsoft · reported by MITREHigh 7.5
The Java Database Connectivity (JDBC) APIs in Microsoft Virtual Machine (VM) 5.0.3805 and earlier allow remote attackers to bypass security checks and access database contents via an untrusted Java applet.
- Product
- Windows 2000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordciac.orgsecurityfocus.com
Dec 23, 2002Microsoft Virtual Machine (VM) up to and including build 5.0.3805 allows remote attackers to execute arbitrary code by including a Java applet that invokes COM CVE-2002-1257 · Computers, phones & browsers · Microsoft · reported by MITREHigh 10
Microsoft Virtual Machine (VM) up to and including build 5.0.3805 allows remote attackers to execute arbitrary code by including a Java applet that invokes COM (Component Object Model) objects in a web site or an HTML mail.
- Product
- Windows 2000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comdocs.microsoft.com
Nov 29, 2002The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to steal cookies and execute script in a different security context viaCVE-2002-1286 · Computers, phones & browsers · Microsoft · reported by MITREHigh 7.5
The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to steal cookies and execute script in a different security context via a URL that contains a colon in the domain portion, which is not properly parsed and loads an applet from a malicious site within the security context of the site that is being visited by the user.
- Product
- Java Virtual Machine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2002Stack-based buffer overflow in the Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to cause a denial of service via a long CVE-2002-1287 · Computers, phones & browsers · Microsoft · reported by MITREMedium 5
Stack-based buffer overflow in the Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to cause a denial of service via a long class name through (1) Class.forName or (2) ClassLoader.loadClass.
- Product
- Java Virtual Machine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2002The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to determine the current directory of the Internet Explorer process viaCVE-2002-1288 · Computers, phones & browsers · Microsoft · reported by MITREMedium 5
The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to determine the current directory of the Internet Explorer process via the getAbsolutePath() method in a File() call.
- Product
- Java Virtual Machine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2002The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to read restricted process memory, cause a denial of service (crash), aCVE-2002-1289 · Computers, phones & browsers · Microsoft · reported by MITREHigh 7.5
The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to read restricted process memory, cause a denial of service (crash), and possibly execute arbitrary code via the getNativeServices function, which creates an instance of the com.ms.awt.peer.INativeServices (INativeServices) class, whose methods do not verify the memory addresses that are passed as parameters.
- Product
- Java Virtual Machine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2002The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to read and modify the contents of the Clipboard via an applet that accCVE-2002-1290 · Computers, phones & browsers · Microsoft · reported by MITREMedium 6.4
The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to read and modify the contents of the Clipboard via an applet that accesses the (1) ClipBoardGetText and (2) ClipBoardSetText methods of the INativeServices class.
- Product
- Java Virtual Machine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2002The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to read arbitrary local files and network shares via an applet tag withCVE-2002-1291 · Computers, phones & browsers · Microsoft · reported by MITREMedium 5
The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to read arbitrary local files and network shares via an applet tag with a codebase set to a "file://%00" (null character) URL.
- Product
- Java Virtual Machine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2002The Microsoft Java virtual machine (VM) build 5.0.3805 and earlier, as used in Internet Explorer, allows remote attackers to extend the Standard Security ManageCVE-2002-1292 · Computers, phones & browsers · Microsoft · reported by MITREHigh 7.5
The Microsoft Java virtual machine (VM) build 5.0.3805 and earlier, as used in Internet Explorer, allows remote attackers to extend the Standard Security Manager (SSM) class (com.ms.security.StandardSecurityManager) and bypass intended StandardSecurityManager restrictions by modifying the (1) deniedDefinitionPackages or (2) deniedAccessPackages settings, causing a denial of service by adding Java applets to the list of applets that are prevented from running.
- Product
- Java Virtual Machine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2002The Microsoft Java implementation, as used in Internet Explorer, provides a public load0() method for the CabCracker class (com.ms.vm.loader.CabCracker), which CVE-2002-1293 · Computers, phones & browsers · Microsoft · reported by MITREHigh 7.5
The Microsoft Java implementation, as used in Internet Explorer, provides a public load0() method for the CabCracker class (com.ms.vm.loader.CabCracker), which allows remote attackers to bypass the security checks that are performed by the load() method.
- Product
- Java Virtual Machine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2002The Microsoft Java implementation, as used in Internet Explorer, can provide HTML object references to applets via Javascript, which allows remote attackers to CVE-2002-1294 · Computers, phones & browsers · Microsoft · reported by MITREHigh 7.5
The Microsoft Java implementation, as used in Internet Explorer, can provide HTML object references to applets via Javascript, which allows remote attackers to cause a denial of service (crash due to illegal memory accesses) and possibly conduct other unauthorized activities via an applet that uses those references to access proprietary Microsoft methods.
- Product
- Java Virtual Machine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2002The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to cause a denial of service (crash) and possibly conduct other unauthoCVE-2002-1295 · Computers, phones & browsers · Microsoft · reported by MITREHigh 7.5
The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to cause a denial of service (crash) and possibly conduct other unauthorized activities via applet tags in HTML that bypass Java class restrictions (such as private constructors) by providing the class name in the code parameter, aka "Incomplete Java Object Instantiation Vulnerability."
- Product
- Java Virtual Machine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2002Microsoft Virtual Machine (VM) up to and including build 5.0.3805 allows remote attackers to cause a denial of service (crash) in Internet Explorer via invalid CVE-2002-0867 · Computers, phones & browsers · Microsoft · reported by MITREMedium 5
Microsoft Virtual Machine (VM) up to and including build 5.0.3805 allows remote attackers to cause a denial of service (crash) in Internet Explorer via invalid handle data in a Java applet, aka "Handle Validation Flaw."
- Product
- Virtual Machine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2002A certain class that supports XML (Extensible Markup Language) in Microsoft Virtual Machine (VM) 5.0.3805 and earlier, probably com.ms.osp.ospmrshl, exposes cerCVE-2002-0865 · Computers, phones & browsers · Microsoft · reported by MITREHigh 7.5
A certain class that supports XML (Extensible Markup Language) in Microsoft Virtual Machine (VM) 5.0.3805 and earlier, probably com.ms.osp.ospmrshl, exposes certain unsafe methods, which allows remote attackers to execute unsafe code via a Java applet, aka "Inappropriate Methods Exposed in XML Support Classes."
- Product
- Virtual Machine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2002Java Database Connectivity (JDBC) classes in Microsoft Virtual Machine (VM) up to and including 5.0.3805 allow remote attackers to load and execute DLLs (dynamiCVE-2002-0866 · Computers, phones & browsers · Microsoft · reported by MITREHigh 7.5
Java Database Connectivity (JDBC) classes in Microsoft Virtual Machine (VM) up to and including 5.0.3805 allow remote attackers to load and execute DLLs (dynamic link libraries) via a Java applet that calls the constructor for com.ms.jdbc.odbc.JdbcOdbc with the desired DLL terminated by a null string, aka "DLL Execution via JDBC Classes."
- Product
- Virtual Machine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comiss.net
Sep 24, 2002The Java logging feature for the Java Virtual Machine in Internet Explorer writes output from functions such as System.out.println to a known pathname, which caCVE-2002-0979 · Computers, phones & browsers · Microsoft · reported by MITREHigh 7.5
The Java logging feature for the Java Virtual Machine in Internet Explorer writes output from functions such as System.out.println to a known pathname, which can be used to execute arbitrary code.
- Product
- Virtual Machine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2002ISS RealSecure for Nokia devices before IPSO build 6.0.2001.141d is configured to allow a user "skank" on a machine "starscream" to become a key manager when thCVE-2002-0480 · Other software · ISS · reported by MITREHigh 10
ISS RealSecure for Nokia devices before IPSO build 6.0.2001.141d is configured to allow a user "skank" on a machine "starscream" to become a key manager when the "first time connection" feature is enabled and before any legitimate administrators have connected, which could allow remote attackers to gain access to the device during installation.
- Product
- Realsecure Nokia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2002Vulnerability in Java Runtime Environment (JRE) allows remote malicious web sites to hijack or sniff a web client's sessions, when an HTTP proxy is being used, CVE-2002-0058 · Computers, phones & browsers · Microsoft · reported by MITREMedium 5
Vulnerability in Java Runtime Environment (JRE) allows remote malicious web sites to hijack or sniff a web client's sessions, when an HTTP proxy is being used, via a Java applet that redirects the session to another server, as seen in (1) Netscape 6.0 through 6.1 and 4.79 and earlier, (2) Microsoft VM build 3802 and earlier as used in Internet Explorer 4.x and 5.x, and possibly other implementations that use vulnerable versions of SDK or JDK.
- Product
- Virtual Machine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infosunsolve.sun.com
Nov 26, 2001Internet Explorer 5.50.4134.0100 on Windows ME with "Prompt to allow cookies to be stored on your machine" enabled does not warn a user when a cookie is set usiCVE-2001-0919 · Computers, phones & browsers · Microsoft · reported by MITREMedium 5.1
Internet Explorer 5.50.4134.0100 on Windows ME with "Prompt to allow cookies to be stored on your machine" enabled does not warn a user when a cookie is set using Javascript.
- Product
- Internet Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2001Buffer overflow in IrDA driver providing infrared data exchange on Windows 2000 allows attackers who are physically close to the machine to cause a denial of seCVE-2001-0659 · Computers, phones & browsers · Microsoft · reported by MITREMedium 5
Buffer overflow in IrDA driver providing infrared data exchange on Windows 2000 allows attackers who are physically close to the machine to cause a denial of service (reboot) via a malformed IrDA packet.
- Product
- Windows 2000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordonline.securityfocus.comsecurityfocus.com
May 3, 2001Oracle Java Virtual Machine (JVM ) for Oracle 8.1.7 and Oracle Application Server 9iAS Release 1.0.2.0.1 allows remote attackers to read arbitrary files via theCVE-2001-0326 · Other software · Oracle · reported by MITREHigh 7.5
Oracle Java Virtual Machine (JVM ) for Oracle 8.1.7 and Oracle Application Server 9iAS Release 1.0.2.0.1 allows remote attackers to read arbitrary files via the .jsp and .sqljsp file extensions when the server is configured to use the <<ALL FILES>> FilePermission.
- Product
- Application Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comosvdb.org
Jan 9, 2001The Extended Control List (ECL) feature of the Java Virtual Machine (JVM) in Lotus Notes Client R5 allows malicious web site operators to determine the existencCVE-2000-1117 · Other software · IBM · reported by MITREMedium 5
The Extended Control List (ECL) feature of the Java Virtual Machine (JVM) in Lotus Notes Client R5 allows malicious web site operators to determine the existence of files on the client by measuring delays in the execution of the getSystemResource method.
- Product
- Lotus Notes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecurityfocus.com
Dec 11, 2000Microsoft Virtual Machine (VM) in Internet Explorer 4.x and 5.x allows an unsigned applet to create and use ActiveX controls, which allows a remote attacker to CVE-2000-1061 · Computers, phones & browsers · Microsoft · reported by MITREMedium 5.1
Microsoft Virtual Machine (VM) in Internet Explorer 4.x and 5.x allows an unsigned applet to create and use ActiveX controls, which allows a remote attacker to bypass Internet Explorer's security settings and execute arbitrary commands via a malicious web page or email, aka the "Microsoft VM ActiveX Component" vulnerability.
- Product
- IE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.microsoft.comexchange.xforce.ibmcloud.com
Oct 20, 2000The Microsoft Outlook mail client identifies the physical path of the sender's machine within a winmail.dat attachment to Rich Text Format (RTF) files.CVE-2000-0753 · Email & office · Microsoft · reported by MITREMedium 5
The Microsoft Outlook mail client identifies the physical path of the sender's machine within a winmail.dat attachment to Rich Text Format (RTF) files.
- Product
- Outlook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Oct 20, 2000Netscape Communicator does not properly prevent a ServerSocket object from being created by untrusted entities, which allows remote attackers to create a serverCVE-2000-0711 · Computers, phones & browsers · Microsoft · reported by MITREHigh 7.5
Netscape Communicator does not properly prevent a ServerSocket object from being created by untrusted entities, which allows remote attackers to create a server on the victim's system via a malicious applet, as demonstrated by Brown Orifice.
- Product
- Virtual Machine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.orgsecurityfocus.com
Oct 20, 2000The URLConnection function in MacOS Runtime Java (MRJ) 2.1 and earlier and the Microsoft virtual machine (VM) for MacOS allows a malicious web site operator to CVE-2000-0563 · Computers, phones & browsers · Apple · reported by MITREHigh 10
The URLConnection function in MacOS Runtime Java (MRJ) 2.1 and earlier and the Microsoft virtual machine (VM) for MacOS allows a malicious web site operator to connect to arbitrary hosts using a HTTP redirection, in violation of the Java security model.
- Product
- MAC OS Runtime For Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecurityfocus.com
Feb 18, 2000The Microsoft virtual machine (VM) in Internet Explorer 4.x and 5.x allows a remote attacker to read files via a malicious Java applet that escapes the Java sanCVE-2000-0162 · Computers, phones & browsers · Microsoft · reported by MITREMedium 5.1
The Microsoft virtual machine (VM) in Internet Explorer 4.x and 5.x allows a remote attacker to read files via a malicious Java applet that escapes the Java sandbox, aka the "VM File Reading" vulnerability.
- Product
- IE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.microsoft.comdocs.microsoft.com
Jan 31, 2000Microsoft Java Virtual Machine allows remote attackers to read files via the getSystemResourceAsStream function.CVE-2000-0132 · Computers, phones & browsers · Microsoft · reported by MITRELow 2.6
Microsoft Java Virtual Machine allows remote attackers to read files via the getSystemResourceAsStream function.
- Product
- Virtual Machine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Dec 31, 1999Internet Explorer 4.0 allows remote attackers to read arbitrary text and HTML files on the user's machine via a small IFRAME that uses Dynamic HTML (DHTML) to sCVE-1999-1472 · Computers, phones & browsers · Microsoft · reported by MITREMedium 5
Internet Explorer 4.0 allows remote attackers to read arbitrary text and HTML files on the user's machine via a small IFRAME that uses Dynamic HTML (DHTML) to send the data to the attacker, aka the Freiburg text-viewing issue.
- Product
- Internet Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infosupport.microsoft.com
Oct 21, 1999The Microsoft Java Virtual Machine allows a malicious Java applet to execute arbitrary commands outside of the sandbox environment.CVE-1999-0766 · Computers, phones & browsers · Microsoft · reported by MITREHigh 9.3
The Microsoft Java Virtual Machine allows a malicious Java applet to execute arbitrary commands outside of the sandbox environment.
- Product
- Java Virtual Machine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.microsoft.comsecurityfocus.com
Oct 21, 1999Microsoft Virtual Machine (VM) allows remote attackers to escape the Java sandbox and execute commands via an applet containing an illegal cast operation, aka tCVE-2000-0327 · Computers, phones & browsers · Microsoft · reported by MITREHigh 7.6
Microsoft Virtual Machine (VM) allows remote attackers to escape the Java sandbox and execute commands via an applet containing an illegal cast operation, aka the "Virtual Machine Verifier" vulnerability.
- Product
- Virtual Machine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infodocs.microsoft.com
Oct 4, 1999Macromedia "The Matrix" screen saver on Windows 95 with the "Password protected" option enabled allows attackers with physical access to the machine to bypass tCVE-1999-1454 · Other software · Macromedia · reported by MITREMedium 4.6
Macromedia "The Matrix" screen saver on Windows 95 with the "Password protected" option enabled allows attackers with physical access to the machine to bypass the password prompt by pressing the ESC (Escape) key.
- Product
- Matrix Screen Saver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 1999The Economist screen saver 1999 with the "Password Protected" option enabled allows users with physical access to the machine to bypass the screen saver and reaCVE-1999-1400 · Other software · The Economist · reported by MITRELow 2.1
The Economist screen saver 1999 with the "Password Protected" option enabled allows users with physical access to the machine to bypass the screen saver and read files by running Internet Explorer while the screen is still locked.
- Product
- The Economist 1999 Screen Saver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.indenial.comarchives.indenial.com
May 21, 1999Control Panel "Password Security" option for Apple Powerbooks allows attackers with physical access to the machine to bypass the security by booting it with an CVE-1999-1393 · Computers, phones & browsers · Apple · reported by MITREMedium 4.6
Control Panel "Password Security" option for Apple Powerbooks allows attackers with physical access to the machine to bypass the security by booting it with an emergency startup disk and using a disk editor to modify the on/off toggle or password in the aaaaaaaAPWD file, which is normally inaccessible.
- Product
- Macos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfreaky.staticusers.netsecurityfocus.com
Apr 12, 1999Remote attackers can perform a denial of service in Windows machines using malicious ARP packets, forcing a message box display for each packet or filling up loCVE-1999-0444 · Computers, phones & browsers · Microsoft · reported by MITREMedium 5
Remote attackers can perform a denial of service in Windows machines using malicious ARP packets, forcing a message box display for each packet or filling up log files.
- Product
- Windows 95
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 1999The byte code verifier component of the Java Virtual Machine (JVM) allows remote execution through malicious web pages.CVE-1999-0440 · Other software · Netscape · reported by MITREHigh 7.5
The byte code verifier component of the Java Virtual Machine (JVM) allows remote execution through malicious web pages.
- Product
- Communicator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 1999Process table attack in Unix systems allows a remote attacker to perform a denial of service by filling a machine's process tables through multiple connections CVE-1999-0377 · Other software · Unix · reported by MITREMedium 5
Process table attack in Unix systems allows a remote attacker to perform a denial of service by filling a machine's process tables through multiple connections to network services.
- Product
- Unix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritytracker.comsecuritytracker.com
Feb 22, 1999Remote attackers can perform a denial of service in WinGate machines using a buffer overflow in the Winsock Redirector Service.CVE-1999-0441 · Other software · Qbik · reported by MITREMedium 5
Remote attackers can perform a denial of service in WinGate machines using a buffer overflow in the Winsock Redirector Service.
- Product
- Wingate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordeeye.comsecurityfocus.com
Feb 22, 1999Microsoft Taskpads allows remote web sites to execute commands on the visiting user's machine via certain methods that are marked as Safe for Scripting.CVE-1999-0379 · Email & office · Microsoft · reported by MITREHigh 7.5
Microsoft Taskpads allows remote web sites to execute commands on the visiting user's machine via certain methods that are marked as Safe for Scripting.
- Product
- Backoffice Resource KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.