Critical security advisoryCriticalFlagged by our vulnerability database: PHP2Shell is on CISA’s exploited list. Most WordPress hosting runs PHP. See if your site is affectedFlagged by our vulnerability database: PHP2Shell is being exploited. DetailsExploited: PHP2Shell. Check your site
HuttenlocherTechnologies
Updated 20 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list
33added in the last 30 days
547new WordPress flaws this week
391,964entries in the database

3,796 results · page 76 of 76

  • Jun 5, 2000Microsoft Outlook and Outlook Express allow remote attackers to cause a denial of service by sending email messages with blank fields such as BCC, Reply-To, RetCVE-2000-0524 · Email & office · Microsoft · reported by MITREMedium 5

    Microsoft Outlook and Outlook Express allow remote attackers to cause a denial of service by sending email messages with blank fields such as BCC, Reply-To, Return-Path, or From.

    Product
    Exchange Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 5, 2000Buffer overflow in the web interface for Cmail 2.4.7 allows remote attackers to cause a denial of service by sending a large user name to the user dialog runninCVE-2000-0556 · Other software · Computalynx · reported by MITREMedium 5

    Buffer overflow in the web interface for Cmail 2.4.7 allows remote attackers to cause a denial of service by sending a large user name to the user dialog running on port 8002.

    Product
    Cmail
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • May 25, 2000The CIFS Computer Browser service on Windows NT 4.0 allows a remote attacker to cause a denial of service by sending a large number of host announcement requestCVE-2000-0403 · Computers, phones & browsers · Microsoft · reported by MITREMedium 5

    The CIFS Computer Browser service on Windows NT 4.0 allows a remote attacker to cause a denial of service by sending a large number of host announcement requests to the master browse tables, aka the "HostAnnouncement Flooding" or "HostAnnouncement Frame" vulnerability.

    Product
    Windows NT
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • May 25, 2000The CIFS Computer Browser service allows remote attackers to cause a denial of service by sending a ResetBrowser frame to the Master Browser, aka the "ResetBrowCVE-2000-0404 · Computers, phones & browsers · Microsoft · reported by MITREMedium 5

    The CIFS Computer Browser service allows remote attackers to cause a denial of service by sending a ResetBrowser frame to the Master Browser, aka the "ResetBrowser Frame" vulnerability.

    Product
    Terminal Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • May 19, 2000Windows 95, Windows 98, Windows 2000, Windows NT 4.0, and Terminal Server systems allow a remote attacker to cause a denial of service by sending a large numberCVE-2000-0305 · Other software · BE · reported by MITREHigh 7.8

    Windows 95, Windows 98, Windows 2000, Windows NT 4.0, and Terminal Server systems allow a remote attacker to cause a denial of service by sending a large number of identical fragmented IP packets, aka jolt2 or the "IP Fragment Reassembly" vulnerability.

    Product
    Beos
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • May 18, 2000NetProwler 3.0 allows remote attackers to cause a denial of service by sending malformed IP packets that trigger NetProwler's Man-in-the-Middle signature.CVE-2000-0394 · Other software · Axent · reported by MITREMedium 5

    NetProwler 3.0 allows remote attackers to cause a denial of service by sending malformed IP packets that trigger NetProwler's Man-in-the-Middle signature.

    Product
    Netprowler
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • May 2, 2000FileMaker Pro 5 Web Companion allows remote attackers to send anonymous or forged email.CVE-2000-0386 · Other software · Filemaker · reported by MITREHigh 7.5

    FileMaker Pro 5 Web Companion allows remote attackers to send anonymous or forged email.

    Product
    Filemaker
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • May 1, 2000NetBSD 1.4.2 and earlier allows remote attackers to cause a denial of service by sending a packet with an unaligned IP timestamp option.CVE-2000-0440 · Other software · Freebsd · reported by MITREMedium 5

    NetBSD 1.4.2 and earlier allows remote attackers to cause a denial of service by sending a packet with an unaligned IP timestamp option.

    Product
    Freebsd
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • May 1, 2000Eudora 4.1 allows remote attackers to perform a denial of service by sending attachments with long file names.CVE-1999-0427 · Computers, phones & browsers · Qualcomm · reported by MITREHigh 7.5

    Eudora 4.1 allows remote attackers to perform a denial of service by sending attachments with long file names.

    Product
    Eudora
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Apr 23, 2000mail.local in Sendmail 8.10.x does not properly identify the .\n string which identifies the end of message text, which allows a remote attacker to cause a deniCVE-2000-0319 · Other software · Eric Allman · reported by MITREMedium 5

    mail.local in Sendmail 8.10.x does not properly identify the .\n string which identifies the end of message text, which allows a remote attacker to cause a denial of service or corrupt mailboxes via a message line that is 2047 characters long and ends in .\n.

    Product
    Sendmail
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Apr 20, 2000RealNetworks RealServer allows remote attackers to cause a denial of service by sending malformed input to the server at port 7070.CVE-2000-0272 · Other software · Realnetworks · reported by MITREHigh 7.8

    RealNetworks RealServer allows remote attackers to cause a denial of service by sending malformed input to the server at port 7070.

    Product
    Realserver
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Apr 20, 2000Cisco IOS 11.x and 12.x allows remote attackers to cause a denial of service by sending the ENVIRON option to the Telnet daemon before it is ready to accept it,CVE-2000-0268 · Network & remote access · Cisco · reported by MITREMedium 5

    Cisco IOS 11.x and 12.x allows remote attackers to cause a denial of service by sending the ENVIRON option to the Telnet daemon before it is ready to accept it, which causes the system to reboot.

    Product
    IOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Apr 12, 2000IIS 4.0 and 5.0 allows remote attackers to cause a denial of service by sending many URLs with a large number of escaped characters, aka the "Myriad Escaped ChaCVE-2000-0258 · Computers, phones & browsers · Microsoft · reported by MITREHigh 7.5

    IIS 4.0 and 5.0 allows remote attackers to cause a denial of service by sending many URLs with a large number of escaped characters, aka the "Myriad Escaped Characters" Vulnerability.

    Product
    Internet Information Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Apr 6, 2000HP-UX 11.04 VirtualVault (VVOS) sends data to unprivileged processes via an interface that has multiple aliased IP addresses.CVE-2000-0251 · Other software · HP · reported by MITREMedium 5

    HP-UX 11.04 VirtualVault (VVOS) sends data to unprivileged processes via an interface that has multiple aliased IP addresses.

    Product
    Hp-ux
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Mar 17, 2000Microsoft Windows Media License Manager allows remote attackers to cause a denial of service by sending a malformed request that causes the manager to halt, akaCVE-2000-0228 · Computers, phones & browsers · Microsoft · reported by MITREMedium 5

    Microsoft Windows Media License Manager allows remote attackers to cause a denial of service by sending a malformed request that causes the manager to halt, aka the "Malformed Media License Request" Vulnerability.

    Product
    Windows Media Rights Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Feb 24, 2000ZoneAlarm sends sensitive system and network information in cleartext to the Zone Labs server if a user requests more information about an event.CVE-2000-0220 · Other software · Zonelabs · reported by MITREMedium 5

    ZoneAlarm sends sensitive system and network information in cleartext to the Zone Labs server if a user requests more information about an event.

    Product
    Zonealarm
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Feb 12, 2000Check Point Firewall-1 allows remote attackers to bypass port access restrictions on an FTP server by forcing it to send malicious packets that Firewall-1 misinCVE-2000-0150 · Other software · Checkpoint · reported by MITREHigh 7.5

    Check Point Firewall-1 allows remote attackers to bypass port access restrictions on an FTP server by forcing it to send malicious packets that Firewall-1 misinterprets as a valid 227 response to a client's PASV attempt.

    Product
    Firewall-1
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jan 18, 2000Netopia Timbuktu Pro sends user IDs and passwords in cleartext, which allows remote attackers to obtain them via sniffing.CVE-2000-0086 · Other software · Netopia · reported by MITREMedium 5

    Netopia Timbuktu Pro sends user IDs and passwords in cleartext, which allows remote attackers to obtain them via sniffing.

    Product
    Timbuktu Pro
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jan 8, 2000The line printer daemon (lpd) in the lpr package in multiple Linux operating systems allows local users to gain root privileges by causing sendmail to execute wCVE-2000-1220 · Other software · SGI · reported by MITREHigh 10

    The line printer daemon (lpd) in the lpr package in multiple Linux operating systems allows local users to gain root privileges by causing sendmail to execute with arbitrary command line arguments, as demonstrated using the -C option to specify a configuration file.

    Product
    Irix
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jan 2, 2000WebTV email client allows remote attackers to force the client to send email without the user's knowledge via HTML.CVE-2000-0082 · Computers, phones & browsers · Microsoft · reported by MITREMedium 5

    WebTV email client allows remote attackers to force the client to send email without the user's knowledge via HTML.

    Product
    Webtv
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 31, 1999Multiple unspecified vulnerabilities in sendmail 5, as installed on Sun SunOS 4.1.3_U1 and 4.1.4, have unspecified attack vectors and impact.CVE-1999-1592 · Other software · Sendmail · reported by MITREHigh 7.5

    Multiple unspecified vulnerabilities in sendmail 5, as installed on Sun SunOS 4.1.3_U1 and 4.1.4, have unspecified attack vectors and impact. NOTE: this might overlap CVE-1999-0129.

    Product
    Sendmail
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 31, 1999When a Web site redirects the browser to another site, Internet Explorer 3.02 and 4.0 automatically resends authentication information to the second site, aka tCVE-1999-1473 · Computers, phones & browsers · Microsoft · reported by MITREMedium 5

    When a Web site redirects the browser to another site, Internet Explorer 3.02 and 4.0 automatically resends authentication information to the second site, aka the "Page Redirect Issue."

    Product
    Internet Explorer
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 28, 1999resend command in Majordomo allows local users to gain privileges via shell metacharacters.CVE-2000-0035 · Other software · Great Circle Associates · reported by MITREMedium 4.6

    resend command in Majordomo allows local users to gain privileges via shell metacharacters.

    Product
    Majordomo
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 22, 1999Sendmail before 8.10.0 allows remote attackers to cause a denial of service by sending a series of ETRN commands then disconnecting from the server, while SendmCVE-1999-1109 · Other software · Sendmail · reported by MITREMedium 5

    Sendmail before 8.10.0 allows remote attackers to cause a denial of service by sending a series of ETRN commands then disconnecting from the server, while Sendmail continues to process the commands after the connection has been terminated.

    Product
    Sendmail
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 8, 1999The ping command in Linux 2.0.3x allows local users to cause a denial of service by sending large packets with the -R (record route) option.CVE-1999-0986 · Other software · Debian · reported by MITREMedium 5

    The ping command in Linux 2.0.3x allows local users to cause a denial of service by sending large packets with the -R (record route) option.

    Product
    Debian Linux
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 7, 1999Sendmail allows local users to reinitialize the aliases database via the newaliases command, then cause a denial of service by interrupting Sendmail.CVE-1999-0976 · Other software · Eric Allman · reported by MITRELow 2.1

    Sendmail allows local users to reinitialize the aliases database via the newaliases command, then cause a denial of service by interrupting Sendmail.

    Product
    Sendmail
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 8, 1999A buffer overflow in InterScan VirusWall 3.23 and 3.3 allows a remote attacker to execute arbitrary code by sending a long HELO command to the server.CVE-2001-0679 · Other software · Trend Micro · reported by MITREHigh 10

    A buffer overflow in InterScan VirusWall 3.23 and 3.3 allows a remote attacker to execute arbitrary code by sending a long HELO command to the server.

    Product
    Interscan Viruswall
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 5, 1999Auto_FTP.pl script in Auto_FTP 0.2 uses the /tmp/ftp_tmp as a shared directory with insecure permissions, which allows local users to (1) send arbitrary files tCVE-1999-1345 · Other software · Auto FTP · reported by MITREMedium 4.6

    Auto_FTP.pl script in Auto_FTP 0.2 uses the /tmp/ftp_tmp as a shared directory with insecure permissions, which allows local users to (1) send arbitrary files to the remote server by placing them in the directory, and (2) view files that are being transferred.

    Product
    Auto FTP
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 31, 1999A non-default configuration in TenFour TFS Gateway 4.0 allows an attacker to cause a denial of service via messages with incorrect sender and recipient addresseCVE-1999-1515 · Other software · Tenfour · reported by MITREMedium 5

    A non-default configuration in TenFour TFS Gateway 4.0 allows an attacker to cause a denial of service via messages with incorrect sender and recipient addresses, which causes the gateway to continuously try to return the message every 10 seconds.

    Product
    TFS Gateway
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 25, 1999Vixie Cron on Linux systems allows local users to set parameters of sendmail commands via the MAILTO environmental variable.CVE-1999-0769 · Other software · Paul Vixie · reported by MITREHigh 7.2

    Vixie Cron on Linux systems allows local users to set parameters of sendmail commands via the MAILTO environmental variable.

    Product
    Vixie Cron
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jul 1, 1999The default FTP configuration in HP Visualize Conference allows conference users to send a file to other participants without authorization.CVE-1999-0707 · Other software · HP · reported by MITREHigh 7.5

    The default FTP configuration in HP Visualize Conference allows conference users to send a file to other participants without authorization.

    Product
    Visualize Conference FTP
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 25, 1999Microsoft Outlook client allows remote attackers to cause a denial of service by sending multiple email messages with the same X-UIDL headers, which causes OutlCVE-1999-1164 · Email & office · Microsoft · reported by MITREMedium 5

    Microsoft Outlook client allows remote attackers to cause a denial of service by sending multiple email messages with the same X-UIDL headers, which causes Outlook to hang.

    Product
    Outlook
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • May 11, 1999Microsoft Outlook Express before 4.72.3612.1700 allows a malicious user to send a message that contains a .., which can inadvertently cause Outlook to re-enter CVE-1999-1033 · Email & office · Microsoft · reported by MITREMedium 5

    Microsoft Outlook Express before 4.72.3612.1700 allows a malicious user to send a message that contains a .., which can inadvertently cause Outlook to re-enter POP3 command mode and cause the POP3 session to hang.

    Product
    Outlook Express
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • May 8, 1999Buffer overflow in iParty server 1.2 and earlier allows remote attackers to cause a denial of service (crash) by connecting to default port 6004 and sending repCVE-1999-1566 · Other software · Intel · reported by MITREMedium 5

    Buffer overflow in iParty server 1.2 and earlier allows remote attackers to cause a denial of service (crash) by connecting to default port 6004 and sending repeated extended characters.

    Product
    Iparty
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Apr 19, 1999Denial of service in Sendmail 8.8.6 in HPUX.CVE-1999-0684 · Other software · HP · reported by MITREMedium 5

    Denial of service in Sendmail 8.8.6 in HPUX.

    Product
    Sendmail
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Mar 8, 1999Denial of service in SMTP applications such as Sendmail, when a remote attacker (e.g.CVE-1999-0418 · Other software · reported by MITREMedium 6.4

    Denial of service in SMTP applications such as Sendmail, when a remote attacker (e.g. spammer) uses many "RCPT TO" commands in the same connection.

    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Mar 1, 1999Remote attackers can perform a denial of service in WebRamp systems by sending a malicious UDP packet to port 5353, changing its IP address.CVE-1999-0438 · Other software · Ramp Networks · reported by MITREMedium 5

    Remote attackers can perform a denial of service in WebRamp systems by sending a malicious UDP packet to port 5353, changing its IP address.

    Product
    Webramp 200i
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Mar 1, 1999Remote attackers can perform a denial of service in WebRamp systems by sending a malicious string to the HTTP port.CVE-1999-0437 · Other software · Ramp Networks · reported by MITREMedium 5

    Remote attackers can perform a denial of service in WebRamp systems by sending a malicious string to the HTTP port.

    Product
    Webramp
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Mar 1, 1999The Lotus Notes 4.5 client may send a copy of encrypted mail in the clear across the network if the user does not set the "Encrypt Saved Mail" preference.CVE-1999-0429 · Other software · IBM · reported by MITREHigh 7.5

    The Lotus Notes 4.5 client may send a copy of encrypted mail in the clear across the network if the user does not set the "Encrypt Saved Mail" preference.

    Product
    Lotus Notes
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Mar 1, 1999When the Microsoft SMTP service attempts to send a message to a server and receives a 4xx error code, it quickly and repeatedly attempts to redeliver the messagCVE-1999-0419 · Other software · reported by MITREMedium 5

    When the Microsoft SMTP service attempts to send a message to a server and receives a 4xx error code, it quickly and repeatedly attempts to redeliver the message, causing a denial of service.

    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jan 1, 1999Remote attackers can cause a denial of service in Sendmail 8.8.x and 8.9.2 by sending messages with a large number of headers.CVE-1999-0393 · Other software · Eric Allman · reported by MITREMedium 5

    Remote attackers can cause a denial of service in Sendmail 8.8.x and 8.9.2 by sending messages with a large number of headers.

    Product
    Sendmail
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jan 1, 1999The demo version of the Quakenbush NT Password Appraiser sends passwords across the network in plaintext.CVE-1999-0397 · Other software · reported by MITREHigh 10

    The demo version of the Quakenbush NT Password Appraiser sends passwords across the network in plaintext.

    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jan 1, 1999An attacker can identify a CISCO device by sending a SYN packet to port 1999, which is for the Cisco Discovery Protocol (CDP).CVE-1999-0453 · Network & remote access · Cisco · reported by MITREMedium 5

    An attacker can identify a CISCO device by sending a SYN packet to port 1999, which is for the Cisco Discovery Protocol (CDP).

    Product
    Router
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jan 1, 1999A Sendmail alias allows input to be piped to a program.CVE-1999-0565 · Other software · reported by MITREHigh 10

    A Sendmail alias allows input to be piped to a program.

    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jan 1, 1999Win32 ICQ 98a 1.30, and possibly other versions, does not display the entire portion of long filenames, which could allow attackers to send an executable file wCVE-1999-1440 · Other software · Mirabilis · reported by MITREMedium 5.1

    Win32 ICQ 98a 1.30, and possibly other versions, does not display the entire portion of long filenames, which could allow attackers to send an executable file with a long name that contains so many spaces that the .exe extension is not displayed, which could make the user believe that the file is safe to open from the client.

    Product
    ICQ 98a
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jan 1, 1999Denial of service in Sendmail 8.6.11 and 8.6.12.CVE-1999-0205 · Other software · Eric Allman · reported by MITREMedium 5

    Denial of service in Sendmail 8.6.11 and 8.6.12.

    Product
    Sendmail
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Get in touch

Tell us what you're building.

A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.

What do you need?
Build
Grow
Protect
Urgent

No newsletter, no sales sequence. Just a reply.