Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

577new WordPress flaws this week

391,397entries in the database

2,617 results · page 52 of 53

May 29, 2000The guestbook CGI program in ICQ Web Front service for ICQ 2000a, 99b, and others allows remote attackers to cause a denial of service via a URL with a long namCVE-2000-0564 · Other software · Mirabilis · reported by MITREMedium 5
The guestbook CGI program in ICQ Web Front service for ICQ 2000a, 99b, and others allows remote attackers to cause a denial of service via a URL with a long name parameter.
Product
ICQ
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com archives.neohapsis.com
May 22, 2000Cobalt RaQ2 and RaQ3 does not properly set the access permissions and ownership for files that are uploaded via FrontPage, which allows attackers to bypass cgiwCVE-2000-0431 · Other software · SUN · reported by MITREHigh 7.5
Cobalt RaQ2 and RaQ3 does not properly set the access permissions and ownership for files that are uploaded via FrontPage, which allows attackers to bypass cgiwrap and modify files.
Product
Cobalt RAQ 2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com osvdb.org
May 15, 2000The CGI counter 4.0.7 by George Burgyan allows remote attackers to execute arbitrary commands via shell metacharacters.CVE-2000-0424 · Other software · George Burgyan · reported by MITREHigh 7.5
The CGI counter 4.0.7 by George Burgyan allows remote attackers to execute arbitrary commands via shell metacharacters.
Product
CGI Counter
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securityfocus.com
May 13, 2000The allmanageup.pl file upload CGI script in the Allmanage Website administration software 2.6 can be called directly by remote attackers, which allows them to CVE-2000-0435 · Other software · Matthew Redman · reported by MITREHigh 7.5
The allmanageup.pl file upload CGI script in the Allmanage Website administration software 2.6 can be called directly by remote attackers, which allows them to modify user accounts or web pages.
Product
Allmanage
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com osvdb.org
May 11, 2000The process_bug.cgi script in Bugzilla allows remote attackers to execute arbitrary commands via shell metacharacters.CVE-2000-0421 · Computers, phones & browsers · Mozilla · reported by MITREHigh 7.5
The process_bug.cgi script in Bugzilla allows remote attackers to execute arbitrary commands via shell metacharacters.
Product
Bugzilla
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com securityfocus.com
May 10, 2000Matt Wright's FormMail CGI script allows remote attackers to obtain environmental variables via the env_report parameter.CVE-2000-0411 · Other software · Matt Wright · reported by MITREMedium 5
Matt Wright's FormMail CGI script allows remote attackers to obtain environmental variables via the env_report parameter.
Product
Formmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com perfectotech.com
May 5, 2000Buffer overflow in Netwin DNEWSWEB CGI program allows remote attackers to execute arbitrary commands via long parameters such as group, cmd, and utag.CVE-2000-0423 · Other software · Netwin · reported by MITREMedium 5
Buffer overflow in Netwin DNEWSWEB CGI program allows remote attackers to execute arbitrary commands via long parameters such as group, cmd, and utag.
Product
Dnews
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record marc.info securityfocus.com
May 5, 2000The Gossamer Threads DBMan db.cgi CGI script allows remote attackers to view environmental variables and setup information by referencing a non-existing databasCVE-2000-0381 · Other software · Gossamer Threads · reported by MITREMedium 6.4
The Gossamer Threads DBMan db.cgi CGI script allows remote attackers to view environmental variables and setup information by referencing a non-existing database in the db parameter.
Product
Dbman
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com perfectotech.com
May 4, 2000Buffer overflow in Netwin DMailWeb CGI program allows remote attackers to execute arbitrary commands via a long utoken parameter.CVE-2000-0422 · Other software · Netwin · reported by MITREHigh 7.5
Buffer overflow in Netwin DMailWeb CGI program allows remote attackers to execute arbitrary commands via a long utoken parameter.
Product
Dmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record marc.info securityfocus.com
May 3, 2000UltraBoard.pl or UltraBoard.cgi CGI scripts in UltraBoard 1.6 allows remote attackers to read arbitrary files via a pathname string that includes a dot dot (..)CVE-2000-0332 · Other software · Ultrascripts · reported by MITREMedium 5
UltraBoard.pl or UltraBoard.cgi CGI scripts in UltraBoard 1.6 allows remote attackers to read arbitrary files via a pathname string that includes a dot dot (..) and ends with a null byte.
Product
Ultraboard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org osvdb.org
Apr 24, 2000The passwd.php3 CGI script in the Red Hat Piranha Virtual Server Package allows local users to execute arbitrary commands via shell metacharacters.CVE-2000-0322 · Other software · Redhat · reported by MITREHigh 10
The passwd.php3 CGI script in the Red Hat Piranha Virtual Server Package allows local users to execute arbitrary commands via shell metacharacters.
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record redhat.com securityfocus.com
Apr 12, 2000The BizDB CGI script bizdb-search.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the dbname parameter.CVE-2000-0287 · Other software · CNC · reported by MITREHigh 10
The BizDB CGI script bizdb-search.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the dbname parameter.
Product
Technology Bizdb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com securityfocus.com
Apr 12, 2000Infonautics getdoc.cgi allows remote attackers to bypass the payment phase for accessing documents via a modified form variable.CVE-2000-0288 · Other software · reported by MITREMedium 5
Infonautics getdoc.cgi allows remote attackers to bypass the payment phase for accessing documents via a modified form variable.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com archives.neohapsis.com
Apr 5, 2000The Nbase-Xyplex EdgeBlaster router allows remote attackers to cause a denial of service via a scan for the FormMail CGI program.CVE-2000-0255 · Other software · Nbase-xyplex · reported by MITREMedium 5
The Nbase-Xyplex EdgeBlaster router allows remote attackers to cause a denial of service via a scan for the FormMail CGI program.
Product
Edgeblaster
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com securityfocus.com
Mar 25, 2000AnalogX SimpleServer:WWW HTTP server 1.03 allows remote attackers to cause a denial of service via a short GET request to cgi-bin.CVE-2000-0243 · Other software · Analogx · reported by MITREMedium 5
AnalogX SimpleServer:WWW HTTP server 1.03 allows remote attackers to cause a denial of service via a short GET request to cgi-bin.
Product
Simpleserver WWW
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record analogx.com osvdb.org
Mar 5, 2000The default installation of Caldera OpenLinux 2.3 includes the CGI program rpm_query, which allows remote attackers to determine what packages are installed on CVE-2000-0192 · Other software · Caldera · reported by MITREMedium 5
The default installation of Caldera OpenLinux 2.3 includes the CGI program rpm_query, which allows remote attackers to determine what packages are installed on the system.
Product
Openlinux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com securityfocus.com
Mar 2, 2000DNSTools CGI applications allow remote attackers to execute arbitrary commands via shell metacharacters.CVE-2000-0177 · Other software · Dnstools Software · reported by MITREHigh 10
DNSTools CGI applications allow remote attackers to execute arbitrary commands via shell metacharacters.
Product
Dnstools
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com securityfocus.com
Mar 1, 2000SGI InfoSearch CGI program infosrch.cgi allows remote attackers to execute commands via shell metacharacters.CVE-2000-0207 · Other software · SGI · reported by MITREHigh 7.5
SGI InfoSearch CGI program infosrch.cgi allows remote attackers to execute commands via shell metacharacters.
Product
Infosearch
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record patches.sgi.com securityfocus.com
Feb 29, 2000The htdig (ht://Dig) CGI program htsearch allows remote attackers to read arbitrary files by enclosing the file name with backticks (`) in parameters to htsearcCVE-2000-0208 · Other software · Htdig · reported by MITREMedium 5
The htdig (ht://Dig) CGI program htsearch allows remote attackers to read arbitrary files by enclosing the file name with backticks (`) in parameters to htsearch.
Product
Htdig
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Feb 27, 2000EZShopper 3.0 search.cgi CGI script allows remote attackers to read arbitrary files via a ..CVE-2000-0188 · Other software · Alex Heiphetz Group · reported by MITREHigh 7.5
EZShopper 3.0 search.cgi CGI script allows remote attackers to read arbitrary files via a .. (dot dot) attack or execute commands via shell metacharacters.
Product
Ezshopper
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com securityfocus.com
Feb 27, 2000EZShopper 3.0 loadpage.cgi CGI script allows remote attackers to read arbitrary files via a ..CVE-2000-0187 · Other software · Alex Heiphetz Group · reported by MITREHigh 7.5
EZShopper 3.0 loadpage.cgi CGI script allows remote attackers to read arbitrary files via a .. (dot dot) attack or execute commands via shell metacharacters.
Product
Ezshopper
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com securityfocus.com
Feb 23, 2000The Sambar server includes batch files ECHO.BAT and HELLO.BAT in the CGI directory, which allow remote attackers to execute commands via shell metacharacters.CVE-2000-0213 · Other software · Sambar · reported by MITREMedium 5
The Sambar server includes batch files ECHO.BAT and HELLO.BAT in the CGI directory, which allow remote attackers to execute commands via shell metacharacters.
Product
Sambar Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sambar.com securityfocus.com
Feb 8, 2000Zeus web server allows remote attackers to view the source code for CGI programs via a null character (%00) at the end of a URL.CVE-2000-0149 · Other software · Zeus Technologies · reported by MITREMedium 5
Zeus web server allows remote attackers to view the source code for CGI programs via a null character (%00) at the end of a URL.
Product
Zeus Web Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com osvdb.org
Feb 3, 2000Frontpage Server Extensions allows remote attackers to determine the physical path of a virtual directory via a GET request to the htimage.exe CGI program.CVE-2000-0122 · Computers, phones & browsers · Microsoft · reported by MITREMedium 5
Frontpage Server Extensions allows remote attackers to determine the physical path of a virtual directory via a GET request to the htimage.exe CGI program.
Product
Frontpage
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Feb 1, 2000Cross site scripting vulnerabilities in Apache 1.3.0 through 1.3.11 allow remote attackers to execute script as other web site visitors via (1) the printenv CGICVE-2000-1205 · Websites & servers · Apache · reported by MITREMedium 4.3
Cross site scripting vulnerabilities in Apache 1.3.0 through 1.3.11 allow remote attackers to execute script as other web site visitors via (1) the printenv CGI (printenv.pl), which does not encode its output, (2) pages generated by the ap_send_error_response function such as a default 404, which does not add an explicit charset, or (3) various messages that are generated by certain Apache modules or core code. NOTE: the printenv issue might still exist for web browsers that can render text/plain content types as HTML, such as Internet Explorer, but CVE regards this as a design limitation of those browsers, not Apache. The printenv.pl/acuparam vector, discloser on 20070724, is one such variant.
Product
Http Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archive.cert.uni-stuttgart.de archives.neohapsis.com
Jan 30, 2000The siteUserMod.cgi program in Cobalt RaQ2 servers allows any Site Administrator to modify passwords for other users, site administrators, and possibly admin (rCVE-2000-0117 · Other software · SUN · reported by MITREHigh 7.2
The siteUserMod.cgi program in Cobalt RaQ2 servers allows any Site Administrator to modify passwords for other users, site administrators, and possibly admin (root).
Product
Cobalt RAQ
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Jan 17, 2000cgiproc CGI script in Nortel Contivity HTTP server allows remote attackers to read arbitrary files by specifying the filename in a parameter to the script.CVE-2000-0063 · Other software · Nortel · reported by MITREMedium 5
cgiproc CGI script in Nortel Contivity HTTP server allows remote attackers to read arbitrary files by specifying the filename in a parameter to the script.
Product
Contivity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Jan 17, 2000cgiproc CGI script in Nortel Contivity HTTP server allows remote attackers to cause a denial of service via a malformed URL that includes shell metacharacters.CVE-2000-0064 · Other software · Nortel · reported by MITREMedium 5
cgiproc CGI script in Nortel Contivity HTTP server allows remote attackers to cause a denial of service via a malformed URL that includes shell metacharacters.
Product
Contivity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org securityfocus.com
Jan 11, 2000PowerScripts PlusMail CGI program allows remote attackers to execute commands via a password file with improper permissions.CVE-2000-0074 · Other software · Powerscripts · reported by MITREHigh 7.5
PowerScripts PlusMail CGI program allows remote attackers to execute commands via a password file with improper permissions.
Product
Plusmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com exchange.xforce.ibmcloud.com
Jan 5, 2000IMail IMONITOR status.cgi CGI script allows remote attackers to cause a denial of service with many calls to status.cgi.CVE-2000-0056 · Other software · Ipswitch · reported by MITREMedium 5
IMail IMONITOR status.cgi CGI script allows remote attackers to cause a denial of service with many calls to status.cgi.
Product
Imail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Dec 31, 1999Vulnerability in bb-hist.sh CGI History module in Big Brother 1.09b and 1.09c allows remote attackers to read portions of arbitrary files.CVE-1999-1462 · Other software · Bb4 · reported by MITREMedium 5
Vulnerability in bb-hist.sh CGI History module in Big Brother 1.09b and 1.09c allows remote attackers to read portions of arbitrary files.
Product
BIG Brother
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bb4.com securityfocus.com
Dec 27, 1999Buffer overflow in w3-msql CGI program in miniSQL package allows remote attackers to execute commands.CVE-2000-0012 · Other software · Hughes · reported by MITREHigh 10
Buffer overflow in w3-msql CGI program in miniSQL package allows remote attackers to execute commands.
Product
Msql
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Dec 26, 1999WebWho+ whois.cgi program allows remote attackers to execute commands via shell metacharacters in the TLD parameter.CVE-2000-0010 · Other software · Tony Greenwood · reported by MITREHigh 10
WebWho+ whois.cgi program allows remote attackers to execute commands via shell metacharacters in the TLD parameter.
Product
Webwho+
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com exchange.xforce.ibmcloud.com
Dec 21, 1999Lotus Domino HTTP server does not properly disable anonymous access for the cgi-bin directory.CVE-2000-0022 · Other software · Lotus · reported by MITREMedium 5
Lotus Domino HTTP server does not properly disable anonymous access for the cgi-bin directory.
Product
Domino Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Dec 15, 1999classifieds.cgi allows remote attackers to execute arbitrary commands by specifying them in a hidden variable in a CGI form.CVE-1999-0935 · Other software · reported by MITREHigh 10
classifieds.cgi allows remote attackers to execute arbitrary commands by specifying them in a hidden variable in a CGI form.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com exchange.xforce.ibmcloud.com
Dec 15, 1999classifieds.cgi allows remote attackers to read arbitrary files via shell metacharacters.CVE-1999-0934 · Other software · reported by MITREMedium 5
classifieds.cgi allows remote attackers to read arbitrary files via shell metacharacters.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com exchange.xforce.ibmcloud.com
Dec 1, 1999Lotus Domino HTTP server allows remote attackers to determine the real path of the server via a request to a non-existent script in /cgi-bin.CVE-2000-0021 · Other software · Lotus · reported by MITREMedium 5
Lotus Domino HTTP server allows remote attackers to determine the real path of the server via a request to a non-existent script in /cgi-bin.
Product
Domino Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Nov 16, 1999Default configuration in Matt Wright FormHandler.cgi script allows arbitrary directories to be used for attachments, and only restricts access to the /etc/ direCVE-1999-1051 · Other software · Matt Wright · reported by MITREMedium 5
Default configuration in Matt Wright FormHandler.cgi script allows arbitrary directories to be used for attachments, and only restricts access to the /etc/ directory, which allows remote attackers to read arbitrary files via the reply_message_attach attachment parameter.
Product
Formhandler.cgi
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Nov 12, 1999Directory traversal vulnerability in Matt Wright FormHandler.cgi script allows remote attackers to read arbitrary files via (1) a ..CVE-1999-1050 · Other software · Matt Wright · reported by MITREMedium 5
Directory traversal vulnerability in Matt Wright FormHandler.cgi script allows remote attackers to read arbitrary files via (1) a .. (dot dot) in the reply_message_attach attachment parameter, or (2) by specifying the filename as a template.
Product
Formhandler.cgi
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Nov 9, 1999Whois Internic Lookup program whois.cgi allows remote attackers to execute commands via shell metacharacters in the domain entry.CVE-1999-0983 · Other software · Internic · reported by MITREHigh 7.5
Whois Internic Lookup program whois.cgi allows remote attackers to execute commands via shell metacharacters in the domain entry.
Product
Whois Lookup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com exchange.xforce.ibmcloud.com
Nov 9, 1999CC Whois program whois.cgi allows remote attackers to execute commands via shell metacharacters in the domain entry.CVE-1999-0985 · Other software · CC · reported by MITREHigh 7.5
CC Whois program whois.cgi allows remote attackers to execute commands via shell metacharacters in the domain entry.
Product
CC Whois
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com exchange.xforce.ibmcloud.com
Nov 9, 1999Matt's Whois program whois.cgi allows remote attackers to execute commands via shell metacharacters in the domain entry.CVE-1999-0984 · Other software · Matts Whois · reported by MITREHigh 7.5
Matt's Whois program whois.cgi allows remote attackers to execute commands via shell metacharacters in the domain entry.
Product
Matts Whois
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com exchange.xforce.ibmcloud.com
Nov 8, 1999cgiwrap as used on Cobalt RaQ 2.0 and RaQ 3i does not properly identify the user for running certain scripts, which allows a malicious site administrator to vieCVE-1999-1530 · Other software · SUN · reported by MITRELow 3.6
cgiwrap as used on Cobalt RaQ 2.0 and RaQ 3i does not properly identify the user for running certain scripts, which allows a malicious site administrator to view or modify data located at another virtual site on the same system.
Product
Cobalt RAQ 2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record marc.info marc.info
Nov 2, 1999AN-HTTPd provides example CGI scripts test.bat, input.bat, input2.bat, and envout.bat, which allow remote attackers to execute commands via shell metacharactersCVE-1999-0947 · Other software · AN · reported by MITREHigh 7.5
AN-HTTPd provides example CGI scripts test.bat, input.bat, input2.bat, and envout.bat, which allow remote attackers to execute commands via shell metacharacters.
Product
An-httpd
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record marc.info securityfocus.com
Nov 1, 1999Ultimate Bulletin Board stores data files in the cgi-bin directory, allowing remote attackers to view the data if an error occurs when the HTTP server attempts CVE-1999-0854 · Other software · Infopop · reported by MITREMedium 5
Ultimate Bulletin Board stores data files in the cgi-bin directory, allowing remote attackers to view the data if an error occurs when the HTTP server attempts to execute the file.
Product
Ultimate Bulletin Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com ultimatebb.com
Oct 22, 1999Buffer overflow in OmniHTTPd CGI program imagemap.exe allows remote attackers to execute commands.CVE-1999-0951 · Other software · Omnicron · reported by MITREHigh 10
Buffer overflow in OmniHTTPd CGI program imagemap.exe allows remote attackers to execute commands.
Product
Omnihttpd
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org securityfocus.com
Sep 30, 1999Buffer overflow in w3-auth CGI program in miniSQL package allows remote attackers to execute arbitrary commands via an HTTP request with (1) a long URL, or (2) CVE-1999-1469 · Other software · Hughes Technologies · reported by MITREHigh 7.5
Buffer overflow in w3-auth CGI program in miniSQL package allows remote attackers to execute arbitrary commands via an HTTP request with (1) a long URL, or (2) a long User-Agent MIME header.
Product
W3-auth
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record marc.info marc.info
Sep 9, 1999Matt Wright's download.cgi 1.0 allows remote attackers to read arbitrary files via a ..CVE-1999-1377 · Other software · Matt Wright · reported by MITREMedium 5
Matt Wright's download.cgi 1.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the f parameter.
Product
Download.cgi
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pulhas.org pulhas.org
Aug 17, 1999The w3-msql CGI script provided with Mini SQL allows remote attackers to view restricted directories.CVE-1999-0753 · Other software · Hughes · reported by MITREHigh 7.5
The w3-msql CGI script provided with Mini SQL allows remote attackers to view restricted directories.
Product
Msql
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Aug 5, 1999dfire.cgi script in Dragon-Fire IDS allows remote users to execute commands via shell metacharacters.CVE-1999-0913 · Other software · Network Security Wizards · reported by MITREHigh 10
dfire.cgi script in Dragon-Fire IDS allows remote users to execute commands via shell metacharacters.
Product
Dragon-fire IDS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record marc.info securityfocus.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.