Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,929 results · page 39 of 39
Feb 11, 2000The SSH protocol server sshd allows local users without shell access to redirect a TCP connection through a service that uses the standard system password databCVE-2000-0143 · Other software · Openbsd · reported by MITREMedium 4.6
The SSH protocol server sshd allows local users without shell access to redirect a TCP connection through a service that uses the standard system password database for authentication, such as POP or FTP.
- Product
- Openssh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Feb 4, 2000The Finger Server 0.82 allows remote attackers to execute commands via shell metacharacters.CVE-2000-0128 · Other software · Daniel Beckham · reported by MITREHigh 10
The Finger Server 0.82 allows remote attackers to execute commands via shell metacharacters.
- Product
- The Finger Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2000cgiproc CGI script in Nortel Contivity HTTP server allows remote attackers to cause a denial of service via a malformed URL that includes shell metacharacters.CVE-2000-0064 · Other software · Nortel · reported by MITREMedium 5
cgiproc CGI script in Nortel Contivity HTTP server allows remote attackers to cause a denial of service via a malformed URL that includes shell metacharacters.
- Product
- Contivity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgsecurityfocus.com
Jan 4, 2000PHP3 with safe_mode enabled does not properly filter shell metacharacters from commands that are executed by popen, which could allow remote attackers to executCVE-2000-0059 · Websites & servers · PHP · reported by MITREHigh 10
PHP3 with safe_mode enabled does not properly filter shell metacharacters from commands that are executed by popen, which could allow remote attackers to execute commands.
- Product
- PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Dec 31, 1999The (1) rcS and (2) mountall programs in Sun Solaris 2.x, possibly before 2.4, start a privileged shell on the system console if fsck fails while the system is CVE-1999-1585 · Other software · SUN · reported by MITREHigh 7.2
The (1) rcS and (2) mountall programs in Sun Solaris 2.x, possibly before 2.4, start a privileged shell on the system console if fsck fails while the system is booting, which allows attackers with physical access to gain root privileges.
- Product
- Sunos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsunsolve.sun.comsunsolve.sun.com
Dec 31, 1999IRIX soundplayer program allows local users to gain privileges by including shell metacharacters in a .wav file, which is executed via the midikeys program.CVE-2000-0013 · Other software · SGI · reported by MITREHigh 7.2
IRIX soundplayer program allows local users to gain privileges by including shell metacharacters in a .wav file, which is executed via the midikeys program.
- Product
- Irix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Dec 31, 1999The AMaViS virus scanner 0.2.0-pre4 and earlier allows remote attackers to execute arbitrary commands as root via an infected mail message with shell metacharacCVE-1999-1512 · Other software · Amavis · reported by MITREHigh 10
The AMaViS virus scanner 0.2.0-pre4 and earlier allows remote attackers to execute arbitrary commands as root via an infected mail message with shell metacharacters in the reply-to field.
- Product
- Virus Scanner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 1999automatic download option in ncftp 2.4.2 FTP client in Red Hat Linux 5.0 and earlier allows remote attackers to execute arbitrary commands via shell metacharactCVE-1999-1333 · Other software · Redhat · reported by MITREHigh 7.5
automatic download option in ncftp 2.4.2 FTP client in Red Hat Linux 5.0 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the names of files that are to be downloaded.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 1999resend command in Majordomo allows local users to gain privileges via shell metacharacters.CVE-2000-0035 · Other software · Great Circle Associates · reported by MITREMedium 4.6
resend command in Majordomo allows local users to gain privileges via shell metacharacters.
- Product
- Majordomo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infosecurityfocus.com
Dec 26, 1999WebWho+ whois.cgi program allows remote attackers to execute commands via shell metacharacters in the TLD parameter.CVE-2000-0010 · Other software · Tony Greenwood · reported by MITREHigh 10
WebWho+ whois.cgi program allows remote attackers to execute commands via shell metacharacters in the TLD parameter.
- Product
- Webwho+
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Dec 15, 1999classifieds.cgi allows remote attackers to read arbitrary files via shell metacharacters.CVE-1999-0934 · Other software · reported by MITREMedium 5
classifieds.cgi allows remote attackers to read arbitrary files via shell metacharacters.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comexchange.xforce.ibmcloud.com
Dec 9, 1999htdig allows remote attackers to execute commands via filenames with shell metacharacters.CVE-1999-0978 · Other software · Debian · reported by MITREHigh 7.5
htdig allows remote attackers to execute commands via filenames with shell metacharacters.
- Product
- Debian Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Nov 18, 1999Pine before version 4.21 does not properly filter shell metacharacters from URLs, which allows remote attackers to execute arbitrary commands via a malformed URCVE-2000-0352 · Other software · University Of Washington · reported by MITREHigh 10
Pine before version 4.21 does not properly filter shell metacharacters from URLs, which allows remote attackers to execute arbitrary commands via a malformed URL.
- Product
- Pine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordftp.calderasystems.comnovell.com
Nov 9, 1999CC Whois program whois.cgi allows remote attackers to execute commands via shell metacharacters in the domain entry.CVE-1999-0985 · Other software · CC · reported by MITREHigh 7.5
CC Whois program whois.cgi allows remote attackers to execute commands via shell metacharacters in the domain entry.
- Product
- CC Whois
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Nov 9, 1999Matt's Whois program whois.cgi allows remote attackers to execute commands via shell metacharacters in the domain entry.CVE-1999-0984 · Other software · Matts Whois · reported by MITREHigh 7.5
Matt's Whois program whois.cgi allows remote attackers to execute commands via shell metacharacters in the domain entry.
- Product
- Matts Whois
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Nov 9, 1999Whois Internic Lookup program whois.cgi allows remote attackers to execute commands via shell metacharacters in the domain entry.CVE-1999-0983 · Other software · Internic · reported by MITREHigh 7.5
Whois Internic Lookup program whois.cgi allows remote attackers to execute commands via shell metacharacters in the domain entry.
- Product
- Whois Lookup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Nov 2, 1999AN-HTTPd provides example CGI scripts test.bat, input.bat, input2.bat, and envout.bat, which allow remote attackers to execute commands via shell metacharactersCVE-1999-0947 · Other software · AN · reported by MITREHigh 7.5
AN-HTTPd provides example CGI scripts test.bat, input.bat, input2.bat, and envout.bat, which allow remote attackers to execute commands via shell metacharacters.
- Product
- An-httpd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infosecurityfocus.com
Oct 23, 1999ypserv allows a local user to modify the GECOS and login shells of other users.CVE-1999-0901 · Computers, phones & browsers · Linux-nis · reported by MITREHigh 7.2
ypserv allows a local user to modify the GECOS and login shells of other users.
- Product
- Ypserv
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Oct 4, 1999RPMMail before 1.4 allows remote attackers to execute commands via an e-mail message with shell metacharacters in the "MAIL FROM" command.CVE-1999-1542 · Other software · Redhat · reported by MITREHigh 10
RPMMail before 1.4 allows remote attackers to execute commands via an e-mail message with shell metacharacters in the "MAIL FROM" command.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 1999shell-lock in Cactus Software Shell Lock allows local users to read or modify decoded shell files before they are executed, via a symlink attack on a temporary CVE-1999-1541 · Other software · Cactus Software · reported by MITREHigh 7.2
shell-lock in Cactus Software Shell Lock allows local users to read or modify decoded shell files before they are executed, via a symlink attack on a temporary file.
- Product
- Shell-lock
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 1999shell-lock in Cactus Software Shell Lock uses weak encryption (trivial encoding) which allows attackers to easily decrypt and obtain the source code.CVE-1999-1540 · Other software · Cactus Software · reported by MITRELow 2.1
shell-lock in Cactus Software Shell Lock uses weak encryption (trivial encoding) which allows attackers to easily decrypt and obtain the source code.
- Product
- Shell-lock
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 1999The Microsoft Jet database engine allows an attacker to execute commands via a database query, aka the "VBA Shell" vulnerability.CVE-2000-0325 · Computers, phones & browsers · Microsoft · reported by MITREHigh 7.2
The Microsoft Jet database engine allows an attacker to execute commands via a database query, aka the "VBA Shell" vulnerability.
- Product
- JET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comdocs.microsoft.com
Aug 5, 1999dfire.cgi script in Dragon-Fire IDS allows remote users to execute commands via shell metacharacters.CVE-1999-0913 · Other software · Network Security Wizards · reported by MITREHigh 10
dfire.cgi script in Dragon-Fire IDS allows remote users to execute commands via shell metacharacters.
- Product
- Dragon-fire IDS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infosecurityfocus.com
Jun 28, 1999MBone SDR Package allows remote attackers to execute commands via shell metacharacters in Session Initiation Protocol (SIP) messages.CVE-1999-0938 · Other software · University College London · reported by MITREHigh 7.5
MBone SDR Package allows remote attackers to execute commands via shell metacharacters in Session Initiation Protocol (SIP) messages.
- Product
- SDR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Jun 1, 1999CDomain whois_raw.cgi whois CGI script allows remote attackers to execute arbitrary commands via shell metacharacters in the fqdn parameter.CVE-1999-1063 · Other software · Cdomain · reported by MITREHigh 10
CDomain whois_raw.cgi whois CGI script allows remote attackers to execute arbitrary commands via shell metacharacters in the fqdn parameter.
- Product
- Cdomainfree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Feb 25, 1999Files created from interactive shell sessions in Cobalt RaQ microservers (e.g.CVE-1999-0408 · Other software · SUN · reported by MITREHigh 10
Files created from interactive shell sessions in Cobalt RaQ microservers (e.g. .bash_history) are world readable, and thus are accessible from the web server.
- Product
- Cobalt RAQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Feb 16, 1999O'Reilly WebSite 1.1e and Website Pro 2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in an argument to (1) args.cmd or (2) aCVE-1999-1180 · Other software · Oreilly · reported by MITREMedium 5
O'Reilly WebSite 1.1e and Website Pro 2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in an argument to (1) args.cmd or (2) args.bat.
- Product
- Website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordoliver.efri.hrtryc.on.ca
Feb 4, 1999The metamail package allows remote command execution using shell metacharacters that are not quoted in a mailcap entry.CVE-1999-0365 · Other software · Metainfo · reported by MITREHigh 7.5
The metamail package allows remote command execution using shell metacharacters that are not quoted in a mailcap entry.
- Product
- Metaip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Jan 29, 1999The debug option in Caldera Linux smail allows remote attackers to execute commands via shell metacharacters in the -D option for the rmail command.CVE-2000-0370 · Other software · Caldera · reported by MITREHigh 10
The debug option in Caldera Linux smail allows remote attackers to execute commands via shell metacharacters in the -D option for the rmail command.
- Product
- Openlinux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordftp.calderasystems.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.