Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,633 results · page 73 of 73
Mar 12, 2001The default installation of Ultraboard 2000 2.11 creates the Skins, Database, and Backups directories with world-writeable permissions, which could allow local CVE-2001-0135 · Other software · Ultrascripts · reported by MITRELow 2.1
The default installation of Ultraboard 2000 2.11 creates the Skins, Database, and Backups directories with world-writeable permissions, which could allow local users to modify sensitive information or possibly insert and execute CGI programs.
- Product
- Ultraboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infosecurityfocus.com
Feb 16, 2001IBM DB2 Universal Database version 6.1 creates an account with a default user name and password, which allows remote attackers to gain access to the database.CVE-2001-0051 · Other software · IBM · reported by MITREHigh 7.5
IBM DB2 Universal Database version 6.1 creates an account with a default user name and password, which allows remote attackers to gain access to the database.
- Product
- Db2 Universal Database
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Feb 16, 2001Secure Locate (slocate) allows local users to corrupt memory via a malformed database file that specifies an offset value that accesses memory outside of the inCVE-2001-0066 · Other software · Kevin Lindsay · reported by MITREHigh 7.2
Secure Locate (slocate) allows local users to corrupt memory via a malformed database file that specifies an offset value that accesses memory outside of the intended buffer.
- Product
- Secure Locate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comdistro.conectiva.com.br
Feb 16, 2001IBM DB2 Universal Database version 6.1 allows users to cause a denial of service via a malformed query.CVE-2001-0052 · Other software · IBM · reported by MITRELow 2.1
IBM DB2 Universal Database version 6.1 allows users to cause a denial of service via a malformed query.
- Product
- Db2 Universal Database
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Feb 12, 2001Backdoor account in Interbase database server allows remote attackers to overwrite arbitrary files using stored procedures.CVE-2001-0008 · Other software · Borland Software · reported by MITREHigh 10
Backdoor account in Interbase database server allows remote attackers to overwrite arbitrary files using stored procedures.
- Product
- Interbase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.orgsecurityfocus.com
Feb 9, 2001Buffer overflow in MySQL before 3.23.33 allows remote attackers to execute arbitrary code via a long drop database request.CVE-2001-1454 · Other software · Oracle · reported by MITREHigh 7.5
Buffer overflow in MySQL before 3.23.33 allows remote attackers to execute arbitrary code via a long drop database request.
- Product
- Mysql
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddev.mysql.comkb.cert.org
Jan 10, 2001Crystal Reports, when displaying data for a password protected database using HTML pages, embeds the username and password in cleartext in the HTML page and theCVE-2001-1464 · Other software · Businessobjects · reported by MITREHigh 7.5
Crystal Reports, when displaying data for a password protected database using HTML pages, embeds the username and password in cleartext in the HTML page and the URL, which allows remote attackers to obtain passwords.
- Product
- Crystal Reports
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgexchange.xforce.ibmcloud.com
Dec 31, 2000upgrade.php3 in Phorum 3.0.7 could allow remote attackers to modify certain Phorum database tables via an unknown method.CVE-2000-1232 · Other software · Phorum · reported by MITREMedium 5
upgrade.php3 in Phorum 3.0.7 could allow remote attackers to modify certain Phorum database tables via an unknown method.
- Product
- Phorum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.uni-stuttgart.dehispahack.ccc.de
Dec 19, 2000MySQL Database Engine uses a weak authentication method which leaks information that could be used by a remote attacker to recover the password.CVE-2000-0981 · Other software · Oracle · reported by MITREHigh 7.2
MySQL Database Engine uses a weak authentication method which leaks information that could be used by a remote attacker to recover the password.
- Product
- Mysql
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.commysql.com
Dec 11, 2000Vulnerabilities in database configuration scripts in HP OpenView Network Node Manager (NNM) 6.1 and earlier allows local users to gain privileges, possibly via CVE-2000-1057 · Other software · HP · reported by MITREMedium 4.6
Vulnerabilities in database configuration scripts in HP OpenView Network Node Manager (NNM) 6.1 and earlier allows local users to gain privileges, possibly via insecure permissions.
- Product
- Openview Network Node Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecurityfocus.com
Oct 20, 2000PCCS MySQLDatabase Admin Tool Manager 1.2.4 and earlier installs the file dbconnect.inc within the web root, which allows remote attackers to obtain sensitive iCVE-2000-0707 · Other software · Pccs-linux · reported by MITREHigh 7.5
PCCS MySQLDatabase Admin Tool Manager 1.2.4 and earlier installs the file dbconnect.inc within the web root, which allows remote attackers to obtain sensitive information such as the administrative password.
- Product
- Mysqldatabase Admin Tool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.compccs-linux.com
Oct 20, 2000The Mail Merge tool in Microsoft Word does not prompt the user before executing Visual Basic (VBA) scripts in an Access database, which could allow an attacker CVE-2000-0788 · Email & office · Microsoft · reported by MITREHigh 10
The Mail Merge tool in Microsoft Word does not prompt the user before executing Visual Basic (VBA) scripts in an Access database, which could allow an attacker to execute arbitrary commands.
- Product
- Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Jul 18, 2000BlackBoard CourseInfo 4.0 does not properly authenticate users, which allows local users to modify CourseInfo database information and gain privileges by directCVE-2000-0627 · Other software · Blackboard · reported by MITREHigh 7.5
BlackBoard CourseInfo 4.0 does not properly authenticate users, which allows local users to modify CourseInfo database information and gain privileges by directly calling the supporting CGI programs such as user_update_passwd.pl and user_update_admin.pl.
- Product
- Courseinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecurityfocus.com
Jul 11, 2000Microsoft Enterprise Manager allows local users to obtain database passwords via the Data Transformation Service (DTS) package Registered Servers Dialog dialog,CVE-2000-0654 · Computers, phones & browsers · Microsoft · reported by MITREMedium 4.6
Microsoft Enterprise Manager allows local users to obtain database passwords via the Data Transformation Service (DTS) package Registered Servers Dialog dialog, aka a variant of the "DTS Password" vulnerability.
- Product
- SQL Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comdocs.microsoft.com
Jun 27, 2000Internet Explorer 5.x does not warn a user before opening a Microsoft Access database file that is referenced within ActiveX OBJECT tags in an HTML document, whCVE-2000-0596 · Computers, phones & browsers · Microsoft · reported by MITREHigh 7.5
Internet Explorer 5.x does not warn a user before opening a Microsoft Access database file that is referenced within ActiveX OBJECT tags in an HTML document, which could allow remote attackers to execute arbitrary commands, aka the "IE Script" vulnerability.
- Product
- Internet Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.orgsecurityfocus.com
May 30, 2000Microsoft SQL Server allows local users to obtain database passwords via the Data Transformation Service (DTS) package Properties dialog, aka the "DTS Password"CVE-2000-0485 · Computers, phones & browsers · Microsoft · reported by MITRELow 2.1
Microsoft SQL Server allows local users to obtain database passwords via the Data Transformation Service (DTS) package Properties dialog, aka the "DTS Password" vulnerability.
- Product
- SQL Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
May 24, 2000Buffer overflow in MDBMS database server allows remote attackers to execute arbitrary commands via a long string.CVE-2000-0446 · Other software · Marty Bochane · reported by MITREHigh 7.5
Buffer overflow in MDBMS database server allows remote attackers to execute arbitrary commands via a long string.
- Product
- Mdbms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecurityfocus.com
May 2, 2000FileMaker Pro 5 Web Companion allows remote attackers to bypass Field-Level database security restrictions via the XML publishing or email capabilities.CVE-2000-0385 · Other software · Filemaker · reported by MITREMedium 5
FileMaker Pro 5 Web Companion allows remote attackers to bypass Field-Level database security restrictions via the XML publishing or email capabilities.
- Product
- Filemaker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblueworld.comfilemaker.com
May 1, 2000Omnis Studio 2.4 uses weak encryption (trivial encoding) for encrypting database fields.CVE-2000-0449 · Other software · Omnis · reported by MITREHigh 10
Omnis Studio 2.4 uses weak encryption (trivial encoding) for encrypting database fields.
- Product
- Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecurityfocus.com
Apr 14, 2000The dansie shopping cart application cart.pl allows remote attackers to obtain the shopping cart database and configuration information via a URL that referenceCVE-2000-0254 · Other software · Craig Dansie · reported by MITREMedium 5
The dansie shopping cart application cart.pl allows remote attackers to obtain the shopping cart database and configuration information via a URL that references either the env, db, or vars form variables.
- Product
- Dansie Shopping Cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comexchange.xforce.ibmcloud.com
Feb 8, 2000MySQL 3.22 allows remote attackers to bypass password authentication and access a database via a short check string.CVE-2000-0148 · Other software · Oracle · reported by MITREHigh 7.5
MySQL 3.22 allows remote attackers to bypass password authentication and access a database via a short check string.
- Product
- Mysql
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecurityfocus.com
Dec 22, 1999Solaris dmi_cmd allows local users to crash the dmispd daemon by adding a malformed file to the /var/dmi/db database.CVE-2000-0032 · Other software · SUN · reported by MITREHigh 10
Solaris dmi_cmd allows local users to crash the dmispd daemon by adding a malformed file to the /var/dmi/db database.
- Product
- Solaris
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgsecurityfocus.com
Dec 22, 1999Solaris dmispd dmi_cmd allows local users to fill up restricted disk space by adding files to the /var/dmi/db database.CVE-2000-0030 · Other software · SUN · reported by MITREMedium 5
Solaris dmispd dmi_cmd allows local users to fill up restricted disk space by adding files to the /var/dmi/db database.
- Product
- Solaris
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Dec 7, 1999Sendmail allows local users to reinitialize the aliases database via the newaliases command, then cause a denial of service by interrupting Sendmail.CVE-1999-0976 · Other software · Eric Allman · reported by MITRELow 2.1
Sendmail allows local users to reinitialize the aliases database via the newaliases command, then cause a denial of service by interrupting Sendmail.
- Product
- Sendmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Oct 24, 1999IBM WebSphere ikeyman tool uses weak encryption to store a password for a key database that is used for SSL connections.CVE-1999-0944 · Other software · reported by MITREHigh 10
IBM WebSphere ikeyman tool uses weak encryption to store a password for a key database that is used for SSL connections.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Aug 20, 1999The Microsoft Jet database engine allows an attacker to execute commands via a database query, aka the "VBA Shell" vulnerability.CVE-2000-0325 · Computers, phones & browsers · Microsoft · reported by MITREHigh 7.2
The Microsoft Jet database engine allows an attacker to execute commands via a database query, aka the "VBA Shell" vulnerability.
- Product
- JET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comdocs.microsoft.com
Aug 19, 1999A default configuration of CiscoSecure Access Control Server (ACS) allows remote users to modify the server database without authentication.CVE-1999-0734 · Network & remote access · Cisco · reported by MITREHigh 7.5
A default configuration of CiscoSecure Access Control Server (ACS) allows remote users to modify the server database without authentication.
- Product
- Ciscosecure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comtools.cisco.com
Aug 18, 1999Buffer overflow in Source Code Browser Program Database Name Server Daemon (pdnsd) for the IBM AIX C Set ++ compiler.CVE-1999-0745 · Other software · IBM · reported by MITREHigh 10
Buffer overflow in Source Code Browser Program Database Name Server Daemon (pdnsd) for the IBM AIX C Set ++ compiler.
- Product
- AIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordciac.orgsecurityfocus.com
Aug 16, 1999dbsnmp in Oracle Intelligent Agent allows local users to gain privileges by setting the ORACLE_HOME environmental variable, which dbsnmp uses to find the nmiconCVE-1999-0888 · Other software · Oracle · reported by MITREMedium 4.6
dbsnmp in Oracle Intelligent Agent allows local users to gain privileges by setting the ORACLE_HOME environmental variable, which dbsnmp uses to find the nmiconf.tcl script.
- Product
- Database Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Jul 28, 1999The Microsoft Jet database engine allows an attacker to modify text files via a database query, aka the "Text I-ISAM" vulnerability.CVE-2000-0323 · Computers, phones & browsers · Microsoft · reported by MITREHigh 7.6
The Microsoft Jet database engine allows an attacker to modify text files via a database query, aka the "Text I-ISAM" vulnerability.
- Product
- JET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comdocs.microsoft.com
Mar 4, 1999Oracle Database Assistant 1.0 in Oracle 8.0.3 Enterprise Edition stores the database master password in plaintext in the spoolmain.log file when a new database CVE-1999-1256 · Other software · Oracle · reported by MITREMedium 4.6
Oracle Database Assistant 1.0 in Oracle 8.0.3 Enterprise Edition stores the database master password in plaintext in the spoolmain.log file when a new database is created, which allows local users to obtain the password from that file.
- Product
- Database Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infosecurityfocus.com
Feb 15, 1999mSQL (Mini SQL) 2.0.6 allows remote attackers to obtain sensitive server information such as logged users, database names, and server version via the ServerStatCVE-1999-1260 · Other software · Hughes · reported by MITREHigh 7.5
mSQL (Mini SQL) 2.0.6 allows remote attackers to obtain sensitive server information such as logged users, database names, and server version via the ServerStats query.
- Product
- Msql
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infoexchange.xforce.ibmcloud.com
Jan 1, 1999Microsoft Access 97 stores a database password as plaintext in a foreign mdb, allowing access to data.CVE-1999-0364 · Other software · FMS Inc. · reported by MITREHigh 10
Microsoft Access 97 stores a database password as plaintext in a foreign mdb, allowing access to data.
- Product
- Total VB Sourcebook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.