Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,888 results · page 38 of 38
Oct 28, 2002Buffer overflow in the embedded HTTP server for Cisco Catalyst switches running CatOS 5.4 through 7.3 allows remote attackers to cause a denial of service (reseCVE-2002-1222 · Network & remote access · Cisco · reported by MITREHigh 7.1
Buffer overflow in the embedded HTTP server for Cisco Catalyst switches running CatOS 5.4 through 7.3 allows remote attackers to cause a denial of service (reset) via a long HTTP request.
- Product
- Catos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2002Cross-site scripting vulnerability in phpBB 1.4.4 and earlier allows remote attackers to execute arbitrary Javascript on web clients by embedding the script witCVE-2002-0475 · Websites & servers · Phpbb Group · reported by MITREMedium 5.1
Cross-site scripting vulnerability in phpBB 1.4.4 and earlier allows remote attackers to execute arbitrary Javascript on web clients by embedding the script within an IMG image tag while editing a message.
- Product
- Phpbb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2002The Macro Security Model in Microsoft Excel 2000 and 2002 for Windows allows remote attackers to execute code in the Local Computer zone by embedding HTML scripCVE-2002-0618 · Email & office · Microsoft · reported by MITREHigh 7.5
The Macro Security Model in Microsoft Excel 2000 and 2002 for Windows allows remote attackers to execute code in the Local Computer zone by embedding HTML scripts within an Excel workbook that contains an XSL stylesheet, aka "Excel XSL Stylesheet Script Execution".
- Product
- Excel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2002Cross-site scripting vulnerability in functions-inc.asp for ASP-Nuke RC1 allows remote attackers to execute script as other ASP-Nuke users by embedding it withiCVE-2002-0520 · Other software · Asp-nuke · reported by MITREHigh 7.5
Cross-site scripting vulnerability in functions-inc.asp for ASP-Nuke RC1 allows remote attackers to execute script as other ASP-Nuke users by embedding it within an IMG tag.
- Product
- Asp-nuke
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordonline.securityfocus.comasp-nuke.com
Aug 12, 2002Cross-site scripting vulnerability in ZeroForum allows remote attackers to execute arbitrary Javascript on web clients by embedding the script within IMG image CVE-2002-0474 · Other software · Zeroforum · reported by MITREMedium 5.1
Cross-site scripting vulnerability in ZeroForum allows remote attackers to execute arbitrary Javascript on web clients by embedding the script within IMG image tag.
- Product
- Zeroforum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiss.netsecurityfocus.com
Apr 22, 2002Cross-site scripting vulnerability in Help File search facility for Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to embed scripts CVE-2002-0074 · Computers, phones & browsers · Microsoft · reported by MITREHigh 7.5
Cross-site scripting vulnerability in Help File search facility for Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to embed scripts into another user's session.
- Product
- Internet Information Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2002The zone determination function in Microsoft Internet Explorer 5.5 and 6.0 allows remote attackers to run scripts in the Local Computer zone by embedding the scCVE-2002-0078 · Computers, phones & browsers · Microsoft · reported by MITREHigh 7.5
The zone determination function in Microsoft Internet Explorer 5.5 and 6.0 allows remote attackers to run scripts in the Local Computer zone by embedding the script in a cookie, aka the "Cookie-based Script Execution" vulnerability.
- Product
- Internet Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2001A cross-site scripting vulnerability in Caucho Technology Resin before 1.2.4 allows a malicious webmaster to embed Javascript in a hyperlink that ends in a .jspCVE-2001-0828 · Other software · Caucho Technology · reported by MITREMedium 5.1
A cross-site scripting vulnerability in Caucho Technology Resin before 1.2.4 allows a malicious webmaster to embed Javascript in a hyperlink that ends in a .jsp extension, which causes an error message that does not properly quote the Javascript.
- Product
- Resin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchive.cert.uni-stuttgart.decaucho.com
Dec 6, 2001A cross-site scripting vulnerability in Apache Tomcat 3.2.1 allows a malicious webmaster to embed Javascript in a request for a .JSP file, which causes the JavaCVE-2001-0829 · Websites & servers · Apache · reported by MITREMedium 5.1
A cross-site scripting vulnerability in Apache Tomcat 3.2.1 allows a malicious webmaster to embed Javascript in a request for a .JSP file, which causes the Javascript to be inserted into an error message.
- Product
- Tomcat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchive.cert.uni-stuttgart.dejakarta.apache.org
Oct 18, 2001The #sinclude directive in Embedded Perl (ePerl) 2.2.14 and earlier allows a remote attacker to execute arbitrary code by modifying the 'sinclude' file to pointCVE-2001-0733 · Other software · Ralf S. Engelschall · reported by MITREHigh 7.5
The #sinclude directive in Embedded Perl (ePerl) 2.2.14 and earlier allows a remote attacker to execute arbitrary code by modifying the 'sinclude' file to point to another file that contains a #include directive that references a file that contains the code.
- Product
- Eperl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Sep 12, 2001Outlook Express 6.00 allows remote attackers to execute arbitrary script by embedding SCRIPT tags in a message whose MIME content type is text/plain, contrary tCVE-2001-0999 · Email & office · Microsoft · reported by MITREHigh 7.5
Outlook Express 6.00 allows remote attackers to execute arbitrary script by embedding SCRIPT tags in a message whose MIME content type is text/plain, contrary to the expected behavior that text/plain messages will not run script.
- Product
- Outlook Express
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Aug 14, 2001Aladdin eSafe Gateway versions 3.0 and earlier allows a remote attacker to circumvent filtering of SCRIPT tags by embedding the scripts within certain HTML tagsCVE-2001-0520 · Other software · Aladdin Knowledge Systems · reported by MITREHigh 7.5
Aladdin eSafe Gateway versions 3.0 and earlier allows a remote attacker to circumvent filtering of SCRIPT tags by embedding the scripts within certain HTML tags including (1) onload in the BODY tag, (2) href in the A tag, (3) the BUTTON tag, (4) the INPUT tag, or (5) any other tag in which scripts can be defined.
- Product
- Esafe Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comexchange.xforce.ibmcloud.com
Jul 21, 2001Microsoft Word 2002 and earlier allows attackers to automatically execute macros without warning the user by embedding the macros in a manner that escapes detecCVE-2001-0501 · Email & office · Microsoft · reported by MITREMedium 4.6
Microsoft Word 2002 and earlier allows attackers to automatically execute macros without warning the user by embedding the macros in a manner that escapes detection by the security scanner.
- Product
- Word
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infosecurityfocus.com
Jul 2, 2001Cross-site scripting vulnerability in Allaire JRun 3.0 and 2.3.3 allows a malicious webmaster to embed Javascript in a request for a .JSP, .shtml, .jsp10, .jrunCVE-2001-1084 · Other software · Macromedia · reported by MITREHigh 7.5
Cross-site scripting vulnerability in Allaire JRun 3.0 and 2.3.3 allows a malicious webmaster to embed Javascript in a request for a .JSP, .shtml, .jsp10, .jrun, or .thtml file that does not exist, which causes the Javascript to be inserted into an error message.
- Product
- Jrun
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchive.cert.uni-stuttgart.dekb.cert.org
Jun 27, 2001Buffer overflow in Embedded Support Partner (ESP) daemon (rpc.espd) in IRIX 6.5.8 and earlier allows remote attackers to execute arbitrary commands.CVE-2001-0331 · Other software · SGI · reported by MITREHigh 7.5
Buffer overflow in Embedded Support Partner (ESP) daemon (rpc.espd) in IRIX 6.5.8 and earlier allows remote attackers to execute arbitrary commands.
- Product
- Irix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpatches.sgi.comkb.cert.org
Jun 18, 2001vim (aka gvim) processes VIM control codes that are embedded in a file, which could allow attackers to execute arbitrary commands when another user opens a fileCVE-2001-0408 · Other software · VIM Development Group · reported by MITREMedium 5.1
vim (aka gvim) processes VIM control codes that are embedded in a file, which could allow attackers to execute arbitrary commands when another user opens a file containing malicious VIM control codes.
- Product
- VIM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infocalderasystems.com
May 24, 2001The (1) FTP and (2) Telnet services in Beck GmbH IPC@Chip are shipped with a default password, which allows remote attackers to gain unauthorized access.CVE-2001-1428 · Other software · Beck IPC Gmbh · reported by MITREHigh 7.5
The (1) FTP and (2) Telnet services in Beck GmbH IPC@Chip are shipped with a default password, which allows remote attackers to gain unauthorized access.
- Product
- IPC AT Chip Embedded-webserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
May 24, 2001The Beck GmbH IPC@Chip embedded web server installs the chipcfg.cgi program by default, which allows remote attackers to obtain sensitive network information viCVE-2001-1341 · Other software · Beck IPC Gmbh · reported by MITREMedium 5
The Beck GmbH IPC@Chip embedded web server installs the chipcfg.cgi program by default, which allows remote attackers to obtain sensitive network information via a request to the program.
- Product
- IPC AT Chip Embedded-webserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.uni-stuttgart.deiss.net
May 24, 2001Beck IPC GmbH IPC@CHIP Embedded-Webserver allows remote attackers to read arbitrary files via a webserver root directory set to system root.CVE-2001-0749 · Other software · Beck IPC Gmbh · reported by MITREHigh 7.5
Beck IPC GmbH IPC@CHIP Embedded-Webserver allows remote attackers to read arbitrary files via a webserver root directory set to system root.
- Product
- IPC AT Chip Embedded-webserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
May 21, 2001Beck IPC GmbH IPC@CHIP Embedded-Webserver allows remote attackers to cause a denial of service via a long HTTP request.CVE-2001-1337 · Other software · Beck IPC Gmbh · reported by MITREMedium 5
Beck IPC GmbH IPC@CHIP Embedded-Webserver allows remote attackers to cause a denial of service via a long HTTP request.
- Product
- IPC AT Chip Embedded-webserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiss.netsecurityfocus.com
May 3, 2001Buffer overflow in QuickTime Player plugin 4.1.2 (Japanese) allows remote attackers to execute arbitrary commands via a long HREF parameter in an EMBED tag.CVE-2001-0198 · Computers, phones & browsers · Apple · reported by MITREHigh 7.6
Buffer overflow in QuickTime Player plugin 4.1.2 (Japanese) allows remote attackers to execute arbitrary commands via a long HREF parameter in an EMBED tag.
- Product
- Quicktime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infoexploit-db.com
Jan 10, 2001Crystal Reports, when displaying data for a password protected database using HTML pages, embeds the username and password in cleartext in the HTML page and theCVE-2001-1464 · Other software · Businessobjects · reported by MITREHigh 7.5
Crystal Reports, when displaying data for a password protected database using HTML pages, embeds the username and password in cleartext in the HTML page and the URL, which allows remote attackers to obtain passwords.
- Product
- Crystal Reports
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgexchange.xforce.ibmcloud.com
Jan 9, 2001The ixsso.query ActiveX Object is marked as safe for scripting, which allows malicious web site operators to embed a script that remotely determines the existenCVE-2000-1105 · Computers, phones & browsers · Microsoft · reported by MITREMedium 4.3
The ixsso.query ActiveX Object is marked as safe for scripting, which allows malicious web site operators to embed a script that remotely determines the existence of files on visiting Windows 2000 systems that have Indexing Services enabled.
- Product
- Indexing Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecurityfocus.com
Jan 9, 2001Variant of the "IIS Cross-Site Scripting" vulnerability as originally discussed in MS:MS00-060 (CVE-2000-0746) allows a malicious web site operator to embed scrCVE-2000-1104 · Computers, phones & browsers · Microsoft · reported by MITREHigh 7.5
Variant of the "IIS Cross-Site Scripting" vulnerability as originally discussed in MS:MS00-060 (CVE-2000-0746) allows a malicious web site operator to embed scripts in a link to a trusted site, which are returned without quoting in an error message back to the client. The client then executes those scripts in the same context as the trusted site.
- Product
- Internet Information Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.microsoft.comdocs.microsoft.com
Jan 1, 2001WinCE 3.0.9348 generates predictable TCP Initial Sequence Numbers (ISNs), which allows remote attackers to spoof or hijack TCP connections.CVE-2001-0162 · Computers, phones & browsers · Microsoft · reported by MITREHigh 7.5
WinCE 3.0.9348 generates predictable TCP Initial Sequence Numbers (ISNs), which allows remote attackers to spoof or hijack TCP connections.
- Product
- Windows Embedded Compact
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2000QNX Embedded Resource Manager in Voyager web server 2.01B in the demo disks for QNX 405 allows remote attackers to read sensitive system statistics information CVE-2000-0905 · Other software · QNX · reported by MITREMedium 5
QNX Embedded Resource Manager in Voyager web server 2.01B in the demo disks for QNX 405 allows remote attackers to read sensitive system statistics information via the embedded.html web page.
- Product
- Voyager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Dec 19, 2000Microsoft Windows Media Player 7 allows attackers to cause a denial of service in RTF-enabled email clients via an embedded OCX control that is not closed propeCVE-2000-0929 · Computers, phones & browsers · Microsoft · reported by MITREMedium 5
Microsoft Windows Media Player 7 allows attackers to cause a denial of service in RTF-enabled email clients via an embedded OCX control that is not closed properly, aka the "OCX Attachment" vulnerability.
- Product
- Windows Media Player
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infosecurityfocus.com
Dec 19, 2000Pegasus Mail 3.12 allows remote attackers to read arbitrary files via an embedded URL that calls the mailto: protocol with a -F switch.CVE-2000-0930 · Other software · David Harris · reported by MITREMedium 5
Pegasus Mail 3.12 allows remote attackers to read arbitrary files via an embedded URL that calls the mailto: protocol with a -F switch.
- Product
- Pegasus Mail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comarchives.neohapsis.com
Oct 20, 2000Buffer overflow in the HTML interpreter in Microsoft Office 2000 allows an attacker to execute arbitrary commands via a long embedded object tag, aka the "MicroCVE-2000-0765 · Email & office · Microsoft · reported by MITREMedium 5.1
Buffer overflow in the HTML interpreter in Microsoft Office 2000 allows an attacker to execute arbitrary commands via a long embedded object tag, aka the "Microsoft Office HTML Object Tag" vulnerability.
- Product
- Excel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comdocs.microsoft.com
Oct 20, 2000xpdf PDF viewer client earlier than 0.91 does not properly launch a web browser for embedded URL's, which allows an attacker to execute arbitrary commands via aCVE-2000-0727 · Other software · Xpdf · reported by MITREHigh 7.6
xpdf PDF viewer client earlier than 0.91 does not properly launch a web browser for embedded URL's, which allows an attacker to execute arbitrary commands via a URL that contains shell metacharacters.
- Product
- Xpdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2000xterm, Eterm, and rxvt allow an attacker to cause a denial of service by embedding certain escape characters which force the window to be resized.CVE-2000-0476 · Other software · Michael Jennings · reported by MITREMedium 5
xterm, Eterm, and rxvt allow an attacker to cause a denial of service by embedding certain escape characters which force the window to be resized.
- Product
- Eterm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comarchives.neohapsis.com
Apr 16, 2000Buffer overflow in Star Office 5.1 allows attackers to cause a denial of service by embedding a long URL within a document.CVE-2000-0291 · Other software · SUN · reported by MITREMedium 4.6
Buffer overflow in Star Office 5.1 allows attackers to cause a denial of service by embedding a long URL within a document.
- Product
- Staroffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecurityfocus.com
Mar 31, 2000fcheck allows local users to gain privileges by embedding shell metacharacters into file names that are processed by fcheck.CVE-2000-0296 · Other software · Michael A. Gumienny · reported by MITREHigh 7.2
fcheck allows local users to gain privileges by embedding shell metacharacters into file names that are processed by fcheck.
- Product
- Fcheck
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecurityfocus.com
Jan 4, 2000Buffer overflow in Internet Explorer 4.0 via EMBED tag.CVE-1999-0876 · Computers, phones & browsers · Microsoft · reported by MITREHigh 10
Buffer overflow in Internet Explorer 4.0 via EMBED tag.
- Product
- IE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.microsoft.comsupport.microsoft.com
Nov 11, 1999A Microsoft ActiveX control allows a remote attacker to execute a malicious cabinet file via an attachment and an embedded script in an HTML mail, aka the "ActiCVE-2000-0329 · Computers, phones & browsers · Microsoft · reported by MITREMedium 5.1
A Microsoft ActiveX control allows a remote attacker to execute a malicious cabinet file via an attachment and an embedded script in an HTML mail, aka the "Active Setup Control" vulnerability.
- Product
- IE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.microsoft.comdocs.microsoft.com
Nov 2, 1999Buffer overflow in Yamaha MidiPlug via a Text variable in an EMBED tag.CVE-1999-0946 · Other software · Yamaha · reported by MITREMedium 5.1
Buffer overflow in Yamaha MidiPlug via a Text variable in an EMBED tag.
- Product
- Midiplug
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infosecurityfocus.com
Sep 2, 1999Buffer overflow in Netscape Communicator via EMBED tags in the pluginspage option.CVE-1999-0685 · Other software · Netscape · reported by MITREMedium 5.1
Buffer overflow in Netscape Communicator via EMBED tags in the pluginspage option.
- Product
- Communicator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
May 24, 1999When Javascript is embedded within the TITLE tag, Netscape Communicator allows a remote attacker to use the "about" protocol to gain access to browser informatiCVE-1999-0762 · Other software · Netscape · reported by MITRELow 2.6
When Javascript is embedded within the TITLE tag, Netscape Communicator allows a remote attacker to use the "about" protocol to gain access to browser information.
- Product
- Communicator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.