Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

453new WordPress flaws this week

394,547entries in the database

6,284 results · page 126 of 126

Feb 23, 2000The Sambar server includes batch files ECHO.BAT and HELLO.BAT in the CGI directory, which allow remote attackers to execute commands via shell metacharacters.CVE-2000-0213 · Other software · Sambar · reported by MITREMedium 5
The Sambar server includes batch files ECHO.BAT and HELLO.BAT in the CGI directory, which allow remote attackers to execute commands via shell metacharacters.
Product
Sambar Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sambar.com securityfocus.com
Feb 11, 2000Infopop Ultimate Bulletin Board (UBB) allows remote attackers to execute commands via shell metacharacters in the topic hidden field.CVE-2000-0141 · Other software · Infopop · reported by MITREHigh 10
Infopop Ultimate Bulletin Board (UBB) allows remote attackers to execute commands via shell metacharacters in the topic hidden field.
Product
Ultimate Bulletin Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Feb 4, 2000The Finger Server 0.82 allows remote attackers to execute commands via shell metacharacters.CVE-2000-0128 · Other software · Daniel Beckham · reported by MITREHigh 10
The Finger Server 0.82 allows remote attackers to execute commands via shell metacharacters.
Product
The Finger Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record glazed.org osvdb.org
Feb 1, 2000The @Retail shopping cart application allows remote users to modify sensitive purchase information via hidden form fields.CVE-2000-0135 · Other software · Atretail · reported by MITREHigh 7.5
The @Retail shopping cart application allows remote users to modify sensitive purchase information via hidden form fields.
Product
Atretail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com exchange.xforce.ibmcloud.com
Feb 1, 2000Buffer overflows in Tiny FTPd 0.52 beta3 FTP server allows users to execute commands via the STOR, RNTO, MKD, XMKD, RMD, XRMD, APPE, SIZE, and RNFR commands.CVE-2000-0133 · Other software · H. Nomura · reported by MITREHigh 10
Buffer overflows in Tiny FTPd 0.52 beta3 FTP server allows users to execute commands via the STOR, RNTO, MKD, XMKD, RMD, XRMD, APPE, SIZE, and RNFR commands.
Product
Tiny Ftpdaemon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Jan 26, 2000Buffer overflow in qpopper 3.0 beta versions allows local users to gain privileges via a long LIST command.CVE-2000-0096 · Computers, phones & browsers · Qualcomm · reported by MITREHigh 7.2
Buffer overflow in qpopper 3.0 beta versions allows local users to gain privileges via a long LIST command.
Product
Qpopper
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Jan 17, 2000cgiproc CGI script in Nortel Contivity HTTP server allows remote attackers to cause a denial of service via a malformed URL that includes shell metacharacters.CVE-2000-0064 · Other software · Nortel · reported by MITREMedium 5
cgiproc CGI script in Nortel Contivity HTTP server allows remote attackers to cause a denial of service via a malformed URL that includes shell metacharacters.
Product
Contivity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org securityfocus.com
Jan 4, 2000PHP3 with safe_mode enabled does not properly filter shell metacharacters from commands that are executed by popen, which could allow remote attackers to executCVE-2000-0059 · Websites & servers · PHP · reported by MITREHigh 10
PHP3 with safe_mode enabled does not properly filter shell metacharacters from commands that are executed by popen, which could allow remote attackers to execute commands.
Product
PHP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Dec 31, 1999The AMaViS virus scanner 0.2.0-pre4 and earlier allows remote attackers to execute arbitrary commands as root via an infected mail message with shell metacharacCVE-1999-1512 · Other software · Amavis · reported by MITREHigh 10
The AMaViS virus scanner 0.2.0-pre4 and earlier allows remote attackers to execute arbitrary commands as root via an infected mail message with shell metacharacters in the reply-to field.
Product
Virus Scanner
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record marc.info amavis.org
Dec 31, 1999IRIX soundplayer program allows local users to gain privileges by including shell metacharacters in a .wav file, which is executed via the midikeys program.CVE-2000-0013 · Other software · SGI · reported by MITREHigh 7.2
IRIX soundplayer program allows local users to gain privileges by including shell metacharacters in a .wav file, which is executed via the midikeys program.
Product
Irix
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Dec 31, 1999automatic download option in ncftp 2.4.2 FTP client in Red Hat Linux 5.0 and earlier allows remote attackers to execute arbitrary commands via shell metacharactCVE-1999-1333 · Other software · Redhat · reported by MITREHigh 7.5
automatic download option in ncftp 2.4.2 FTP client in Red Hat Linux 5.0 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the names of files that are to be downloaded.
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record marc.info iss.net
Dec 29, 1999The bna_pass program in Optivity NETarchitect uses the PATH environmental variable for finding the "rm" program, which allows local users to execute arbitrary cCVE-2000-0009 · Other software · Nortel · reported by MITREHigh 7.2
The bna_pass program in Optivity NETarchitect uses the PATH environmental variable for finding the "rm" program, which allows local users to execute arbitrary commands.
Product
Optivity NET Architect
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Dec 28, 1999resend command in Majordomo allows local users to gain privileges via shell metacharacters.CVE-2000-0035 · Other software · Great Circle Associates · reported by MITREMedium 4.6
resend command in Majordomo allows local users to gain privileges via shell metacharacters.
Product
Majordomo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record marc.info securityfocus.com
Dec 26, 1999WebWho+ whois.cgi program allows remote attackers to execute commands via shell metacharacters in the TLD parameter.CVE-2000-0010 · Other software · Tony Greenwood · reported by MITREHigh 10
WebWho+ whois.cgi program allows remote attackers to execute commands via shell metacharacters in the TLD parameter.
Product
Webwho+
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com exchange.xforce.ibmcloud.com
Dec 23, 1999glFtpD allows local users to gain privileges via metacharacters in the SITE ZIPCHK command.CVE-2000-0040 · Other software · Glftpd · reported by MITREHigh 10
glFtpD allows local users to gain privileges via metacharacters in the SITE ZIPCHK command.
Product
Glftpd
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com exchange.xforce.ibmcloud.com
Dec 15, 1999classifieds.cgi allows remote attackers to read arbitrary files via shell metacharacters.CVE-1999-0934 · Other software · reported by MITREMedium 5
classifieds.cgi allows remote attackers to read arbitrary files via shell metacharacters.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com exchange.xforce.ibmcloud.com
Dec 10, 1999The Windows help system can allow a local user to execute commands as another user by editing a table of contents metafile with a .CNT extension and modifying tCVE-1999-0975 · Computers, phones & browsers · Microsoft · reported by MITREMedium 4.6
The Windows help system can allow a local user to execute commands as another user by editing a table of contents metafile with a .CNT extension and modifying the topic action to include the commands to be executed when the .hlp file is accessed.
Product
Windows 95
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Dec 9, 1999htdig allows remote attackers to execute commands via filenames with shell metacharacters.CVE-1999-0978 · Other software · Debian · reported by MITREHigh 7.5
htdig allows remote attackers to execute commands via filenames with shell metacharacters.
Product
Debian Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Nov 23, 1999Internal HTTP server in Sun Netbeans Java IDE in Netbeans Developer 3.0 Beta and Forte Community Edition 1.0 Beta does not properly restrict access to IP addresCVE-1999-1527 · Other software · SUN · reported by MITREHigh 7.5
Internal HTTP server in Sun Netbeans Java IDE in Netbeans Developer 3.0 Beta and Forte Community Edition 1.0 Beta does not properly restrict access to IP addresses as specified in its configuration, which allows arbitrary remote attackers to access the server.
Product
Forte
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record marc.info securityfocus.com
Nov 18, 1999Pine before version 4.21 does not properly filter shell metacharacters from URLs, which allows remote attackers to execute arbitrary commands via a malformed URCVE-2000-0352 · Other software · University Of Washington · reported by MITREHigh 10
Pine before version 4.21 does not properly filter shell metacharacters from URLs, which allows remote attackers to execute arbitrary commands via a malformed URL.
Product
Pine
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ftp.calderasystems.com novell.com
Nov 9, 1999CC Whois program whois.cgi allows remote attackers to execute commands via shell metacharacters in the domain entry.CVE-1999-0985 · Other software · CC · reported by MITREHigh 7.5
CC Whois program whois.cgi allows remote attackers to execute commands via shell metacharacters in the domain entry.
Product
CC Whois
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com exchange.xforce.ibmcloud.com
Nov 9, 1999Matt's Whois program whois.cgi allows remote attackers to execute commands via shell metacharacters in the domain entry.CVE-1999-0984 · Other software · Matts Whois · reported by MITREHigh 7.5
Matt's Whois program whois.cgi allows remote attackers to execute commands via shell metacharacters in the domain entry.
Product
Matts Whois
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com exchange.xforce.ibmcloud.com
Nov 9, 1999Whois Internic Lookup program whois.cgi allows remote attackers to execute commands via shell metacharacters in the domain entry.CVE-1999-0983 · Other software · Internic · reported by MITREHigh 7.5
Whois Internic Lookup program whois.cgi allows remote attackers to execute commands via shell metacharacters in the domain entry.
Product
Whois Lookup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com exchange.xforce.ibmcloud.com
Nov 2, 1999AN-HTTPd provides example CGI scripts test.bat, input.bat, input2.bat, and envout.bat, which allow remote attackers to execute commands via shell metacharactersCVE-1999-0947 · Other software · AN · reported by MITREHigh 7.5
AN-HTTPd provides example CGI scripts test.bat, input.bat, input2.bat, and envout.bat, which allow remote attackers to execute commands via shell metacharacters.
Product
An-httpd
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record marc.info securityfocus.com
Oct 4, 1999RPMMail before 1.4 allows remote attackers to execute commands via an e-mail message with shell metacharacters in the "MAIL FROM" command.CVE-1999-1542 · Other software · Redhat · reported by MITREHigh 10
RPMMail before 1.4 allows remote attackers to execute commands via an e-mail message with shell metacharacters in the "MAIL FROM" command.
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record marc.info marc.info
Aug 5, 1999dfire.cgi script in Dragon-Fire IDS allows remote users to execute commands via shell metacharacters.CVE-1999-0913 · Other software · Network Security Wizards · reported by MITREHigh 10
dfire.cgi script in Dragon-Fire IDS allows remote users to execute commands via shell metacharacters.
Product
Dragon-fire IDS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record marc.info securityfocus.com
Jun 28, 1999MBone SDR Package allows remote attackers to execute commands via shell metacharacters in Session Initiation Protocol (SIP) messages.CVE-1999-0938 · Other software · University College London · reported by MITREHigh 7.5
MBone SDR Package allows remote attackers to execute commands via shell metacharacters in Session Initiation Protocol (SIP) messages.
Product
SDR
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com exchange.xforce.ibmcloud.com
Jun 1, 1999CDomain whois_raw.cgi whois CGI script allows remote attackers to execute arbitrary commands via shell metacharacters in the fqdn parameter.CVE-1999-1063 · Other software · Cdomain · reported by MITREHigh 10
CDomain whois_raw.cgi whois CGI script allows remote attackers to execute arbitrary commands via shell metacharacters in the fqdn parameter.
Product
Cdomainfree
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Apr 7, 1999The SNMP default community name "public" is not properly removed in NetApps C630 Netcache, even if the administrator tries to disable it.CVE-1999-0472 · Other software · Snmp · reported by MITREMedium 5
The SNMP default community name "public" is not properly removed in NetApps C630 Netcache, even if the administrator tries to disable it.
Product
Snmp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com exchange.xforce.ibmcloud.com
Feb 16, 1999O'Reilly WebSite 1.1e and Website Pro 2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in an argument to (1) args.cmd or (2) aCVE-1999-1180 · Other software · Oreilly · reported by MITREMedium 5
O'Reilly WebSite 1.1e and Website Pro 2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in an argument to (1) args.cmd or (2) args.bat.
Product
Website
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oliver.efri.hr tryc.on.ca
Feb 4, 1999The metamail package allows remote command execution using shell metacharacters that are not quoted in a mailcap entry.CVE-1999-0365 · Other software · Metainfo · reported by MITREHigh 7.5
The metamail package allows remote command execution using shell metacharacters that are not quoted in a mailcap entry.
Product
Metaip
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com exchange.xforce.ibmcloud.com
Jan 29, 1999The debug option in Caldera Linux smail allows remote attackers to execute commands via shell metacharacters in the -D option for the rmail command.CVE-2000-0370 · Other software · Caldera · reported by MITREHigh 10
The debug option in Caldera Linux smail allows remote attackers to execute commands via shell metacharacters in the -D option for the rmail command.
Product
Openlinux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ftp.calderasystems.com securityfocus.com
Jan 19, 1999Windows NT 4.0 beta allows users to read and delete shares.CVE-1999-0119 · Computers, phones & browsers · Microsoft · reported by MITREHigh 10
Windows NT 4.0 beta allows users to read and delete shares.
Product
Windows NT
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com exchange.xforce.ibmcloud.com
Jan 1, 1999MetaInfo MetaWeb web server allows users to upload, execute, and read scripts.CVE-1999-0268 · Other software · Metainfo · reported by MITREHigh 10
MetaInfo MetaWeb web server allows users to upload, execute, and read scripts.
Product
Metaweb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org osvdb.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.