Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,330 results · page 67 of 67
Jan 9, 2001WinVNC installs the WinVNC3 registry key with permissions that give Special Access (read and modify) to the Everybody group, which allows users to read and modiCVE-2000-1164 · Other software · ATT · reported by MITREHigh 9
WinVNC installs the WinVNC3 registry key with permissions that give Special Access (read and modify) to the Everybody group, which allows users to read and modify sensitive information such as passwords and gain access to the system.
- Product
- Winvnc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecurityfocus.com
Jan 9, 2001registrar in the HP resource monitor service allows local users to read and modify arbitrary files by renaming the original registrar.log log file and creating CVE-2000-1127 · Other software · HP · reported by MITRELow 3.6
registrar in the HP resource monitor service allows local users to read and modify arbitrary files by renaming the original registrar.log log file and creating a symbolic link to the target file, to which registrar appends log information and sets the permissions to be world readable.
- Product
- Hp-ux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Dec 16, 2000Zope 2.2.0 through 2.2.4 does not properly perform security registration for legacy names of object constructors such as DTML method objects, which could allow CVE-2000-1211 · Other software · Zope · reported by MITREHigh 7.5
Zope 2.2.0 through 2.2.4 does not properly perform security registration for legacy names of object constructors such as DTML method objects, which could allow attackers to perform unauthorized activities.
- Product
- Zope
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiss.netlinux-mandrake.com
Jul 26, 2000Microsoft Excel 97 and 2000 allows an attacker to execute arbitrary commands by specifying a malicious .dll using the Register.ID function, aka the "Excel REGISCVE-2000-0637 · Email & office · Microsoft · reported by MITREMedium 4.6
Microsoft Excel 97 and 2000 allows an attacker to execute arbitrary commands by specifying a malicious .dll using the Register.ID function, aka the "Excel REGISTER.ID Function" vulnerability.
- Product
- Excel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Jul 25, 2000The registry entry for the Windows Shell executable (Explorer.exe) in Windows NT and Windows 2000 uses a relative path name, which allows local users to executeCVE-2000-0663 · Computers, phones & browsers · Microsoft · reported by MITREMedium 4.6
The registry entry for the Windows Shell executable (Explorer.exe) in Windows NT and Windows 2000 uses a relative path name, which allows local users to execute arbitrary commands by inserting a Trojan Horse named Explorer.exe into the %Systemdrive% directory, aka the "Relative Shell Path" vulnerability.
- Product
- Windows 2000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmicrosoft.comsecurityfocus.com
Jul 11, 2000Microsoft Enterprise Manager allows local users to obtain database passwords via the Data Transformation Service (DTS) package Registered Servers Dialog dialog,CVE-2000-0654 · Computers, phones & browsers · Microsoft · reported by MITREMedium 4.6
Microsoft Enterprise Manager allows local users to obtain database passwords via the Data Transformation Service (DTS) package Registered Servers Dialog dialog, aka a variant of the "DTS Password" vulnerability.
- Product
- SQL Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comdocs.microsoft.com
Jul 11, 2000The default installation of VirusScan 4.5 and NetShield 4.5 has insecure permissions for the registry key that identifies the AutoUpgrade directory, which allowCVE-2000-0650 · Other software · Network Associates · reported by MITRELow 2.1
The default installation of VirusScan 4.5 and NetShield 4.5 has insecure permissions for the registry key that identifies the AutoUpgrade directory, which allows local users to execute arbitrary commands by replacing SETUP.EXE in that directory with a Trojan Horse.
- Product
- Netshield
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordntbugtraq.comosvdb.org
Jul 10, 2000Blackboard CourseInfo 4.0 stores the local and SQL administrator user names and passwords in cleartext in a registry key whose access control allows users to acCVE-2000-0605 · Other software · Blackboard · reported by MITRELow 2.1
Blackboard CourseInfo 4.0 stores the local and SQL administrator user names and passwords in cleartext in a registry key whose access control allows users to access the passwords.
- Product
- Courseinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordntbugtraq.comsecurityfocus.com
Jun 8, 2000The Remote Registry server in Windows NT 4.0 allows local authenticated users to cause a denial of service via a malformed request, which causes the winlogon prCVE-2000-0377 · Computers, phones & browsers · Microsoft · reported by MITREMedium 5
The Remote Registry server in Windows NT 4.0 allows local authenticated users to cause a denial of service via a malformed request, which causes the winlogon process to fail, aka the "Remote Registry Access Authentication" vulnerability.
- Product
- Windows NT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmicrosoft.comsecurityfocus.com
Jun 7, 2000eTrust Intrusion Detection System (formerly SessionWall-3) uses weak encryption (XOR) to store administrative passwords in the registry, which allows local userCVE-2000-0559 · Other software · Broadcom · reported by MITRELow 2.1
eTrust Intrusion Detection System (formerly SessionWall-3) uses weak encryption (XOR) to store administrative passwords in the registry, which allows local users to easily decrypt the passwords.
- Product
- Etrust Intrusion Detection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
May 11, 2000The default configuration of SYSKEY in Windows 2000 stores the startup key in the registry, which could allow an attacker tor ecover it and use it to decrypt EnCVE-2000-0420 · Computers, phones & browsers · Microsoft · reported by MITREHigh 7.2
The default configuration of SYSKEY in Windows 2000 stores the startup key in the registry, which could allow an attacker tor ecover it and use it to decrypt Encrypted File System (EFS) data.
- Product
- Windows 2000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecurityfocus.com
Apr 17, 2000Panda Security 3.0 with registry editing disabled allows users to edit the registry and gain privileges by directly executing a .reg file or using other methodsCVE-2000-0264 · Other software · Panda · reported by MITRELow 2.1
Panda Security 3.0 with registry editing disabled allows users to edit the registry and gain privileges by directly executing a .reg file or using other methods.
- Product
- Panda Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordupdates.pandasoftware.comsecurityfocus.com
Apr 12, 2000The default permissions for the Cryptography\Offload registry key used by the OffloadModExpo in Windows NT 4.0 allows local users to obtain compromise the cryptCVE-2000-0259 · Computers, phones & browsers · Microsoft · reported by MITREHigh 7.2
The default permissions for the Cryptography\Offload registry key used by the OffloadModExpo in Windows NT 4.0 allows local users to obtain compromise the cryptographic keys of other users.
- Product
- Terminal Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comdocs.microsoft.com
Mar 14, 2000When a new SQL Server is registered in Enterprise Manager for Microsoft SQL Server 7.0 and the "Always prompt for login name and password" option is not set, thCVE-2000-0199 · Computers, phones & browsers · Microsoft · reported by MITREHigh 7.2
When a new SQL Server is registered in Enterprise Manager for Microsoft SQL Server 7.0 and the "Always prompt for login name and password" option is not set, then the Enterprise Manager uses weak encryption to store the login ID and password.
- Product
- SQL Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Feb 4, 2000The rdisk utility in Microsoft Terminal Server Edition and Windows NT 4.0 stores registry hive information in a temporary file with permissions that allow localCVE-2000-0089 · Computers, phones & browsers · Microsoft · reported by MITRELow 2.1
The rdisk utility in Microsoft Terminal Server Edition and Windows NT 4.0 stores registry hive information in a temporary file with permissions that allow local users to read it, aka the "RDISK Registry Enumeration File" vulnerability.
- Product
- Windows NT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.microsoft.comsecurityfocus.com
Dec 31, 1999The "AEDebug" registry key is installed with insecure permissions, which allows local users to modify the key to specify a Trojan Horse debugger which is automaCVE-1999-1084 · Computers, phones & browsers · Microsoft · reported by MITREMedium 4.6
The "AEDebug" registry key is installed with insecure permissions, which allows local users to modify the key to specify a Trojan Horse debugger which is automatically executed on a system crash.
- Product
- Windows NT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infosupport.microsoft.com
Dec 21, 1999Ipswitch IMail 5.0 and 6.0 uses weak encryption to store passwords in registry keys, which allows local attackers to read passwords for e-mail accounts.CVE-1999-1497 · Other software · Ipswitch · reported by MITREHigh 7.2
Ipswitch IMail 5.0 and 6.0 uses weak encryption to store passwords in registry keys, which allows local attackers to read passwords for e-mail accounts.
- Product
- Imail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Sep 24, 1999Buffer overflow in Registration Wizard ActiveX control (regwizc.dll, InvokeRegWizard) 3.0.0.0 for Internet Explorer 4.01 and 5 allows remote attackers to executCVE-1999-1578 · Computers, phones & browsers · Microsoft · reported by MITREMedium 5.1
Buffer overflow in Registration Wizard ActiveX control (regwizc.dll, InvokeRegWizard) 3.0.0.0 for Internet Explorer 4.01 and 5 allows remote attackers to execute arbitrary commands.
- Product
- Internet Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgsecurityfocus.com
Sep 7, 1999Nosque MsgCore 2.14 stores passwords in cleartext: (1) the administrator password in the AdmPasswd registry key, and (2) user passwords in the Userbase.dbf dataCVE-1999-1353 · Other software · Nosque · reported by MITREMedium 4.6
Nosque MsgCore 2.14 stores passwords in cleartext: (1) the administrator password in the AdmPasswd registry key, and (2) user passwords in the Userbase.dbf data file, which could allow local users to gain privileges.
- Product
- Msgcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 1999Eastman Work Management 3.21 stores passwords in cleartext in the COMMON and LOCATOR registry keys, which could allow local users to gain privileges.CVE-1999-1470 · Other software · Eastman Software · reported by MITREMedium 4.6
Eastman Work Management 3.21 stores passwords in cleartext in the COMMON and LOCATOR registry keys, which could allow local users to gain privileges.
- Product
- Work Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infosecurityfocus.com
Mar 23, 1999Index Server 2.0 on IIS 4.0 stores physical path information in the ContentIndex\Catalogs subkey of the AllowedPaths registry key, whose permissions allows locaCVE-1999-1397 · Computers, phones & browsers · Microsoft · reported by MITREHigh 7.5
Index Server 2.0 on IIS 4.0 stores physical path information in the ContentIndex\Catalogs subkey of the AllowedPaths registry key, whose permissions allows local and remote users to obtain the physical paths of directories that are being indexed.
- Product
- Index Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 1999Triactive Remote Manager with Basic authentication enabled stores the username and password in cleartext in registry keys, which could allow local users to gainCVE-1999-1372 · Other software · Triactive · reported by MITREMedium 4.6
Triactive Remote Manager with Basic authentication enabled stores the username and password in cleartext in registry keys, which could allow local users to gain privileges.
- Product
- Remote Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 1999IPswitch WS_FTP allows local users to gain additional privileges and modify or add mail accounts by setting the "flags" registry key to 1920.CVE-1999-1171 · Other software · Ipswitch · reported by MITREMedium 4.6
IPswitch WS_FTP allows local users to gain additional privileges and modify or add mail accounts by setting the "flags" registry key to 1920.
- Product
- Imail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infosecurityfocus.com
Jan 2, 1999IPswitch IMail allows local users to gain additional privileges and modify or add mail accounts by setting the "flags" registry key to 1920.CVE-1999-1170 · Other software · Ipswitch · reported by MITREMedium 4.6
IPswitch IMail allows local users to gain additional privileges and modify or add mail accounts by setting the "flags" registry key to 1920.
- Product
- Imail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infosecurityfocus.com
Jan 1, 1999An application-critical Windows NT registry key has inappropriate permissions.CVE-1999-0664 · Other software · reported by MITREHigh 10
An application-critical Windows NT registry key has inappropriate permissions.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 1, 1999A system-critical Windows NT registry key has inappropriate permissions.CVE-1999-0589 · Other software · reported by MITREHigh 10
A system-critical Windows NT registry key has inappropriate permissions.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 1, 1999A system-critical Windows NT registry key has an inappropriate value.CVE-1999-0611 · Other software · reported by MITREHigh 10
A system-critical Windows NT registry key has an inappropriate value.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 1, 1999A Windows NT system's registry audit policy does not log an event success or failure for non-critical registry keys.CVE-1999-0579 · Computers, phones & browsers · Microsoft · reported by MITREHigh 10
A Windows NT system's registry audit policy does not log an event success or failure for non-critical registry keys.
- Product
- Windows NT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Jan 1, 1999A Windows NT system's registry audit policy does not log an event success or failure for security-critical registry keys.CVE-1999-0578 · Computers, phones & browsers · Microsoft · reported by MITREMedium 4.6
A Windows NT system's registry audit policy does not log an event success or failure for security-critical registry keys.
- Product
- Windows NT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Jan 1, 1999An application-critical Windows NT registry key has an inappropriate value.CVE-1999-0665 · Other software · reported by MITREHigh 10
An application-critical Windows NT registry key has an inappropriate value.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.