Overview 865 matches · 6 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 32 EPSS ≥ 0.5
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
6
0.7%
No exploit published
0
0.0%
Outside Waratek scope
2
0.2%
Not applicable
855
98.8%
Withdrawn CVE
2
0.2%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
865
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
865
100.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
0
0.0%
split by
peak 427 / year
19881
Not applicable1
High1
not blocked1
Working exploit published1
19890
19901
Not applicable1
Medium1
not blocked1
Working exploit published1
19912
Not applicable2
High2
not blocked2
Working exploit published2
19920
19930
19946
Not applicable6
High3
Medium2
Low1
not blocked6
Working exploit published6
19955
Not applicable5
Critical1
High2
Medium2
not blocked5
Working exploit published5
199618
Not applicable17
Withdrawn CVE1
High12
Medium5
Unknown1
not blocked18
Working exploit published18
199773
Not applicable73
High51
Medium18
Low4
not blocked73
Working exploit published73
199850
Not applicable50
Critical1
High33
Medium11
Low5
not blocked50
Working exploit published50
1999282
Outside Waratek scope1
Not applicable280
Withdrawn CVE1
Critical2
High132
Medium119
Low28
Unknown1
not blocked282
Working exploit published282
2000427
Mitigation candidate6
Outside Waratek scope1
Not applicable420
Critical1
High197
Medium195
Low34
not blocked427
Working exploit published427
1988199019921994199619982000
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2000-1244 | High | 2000-12-31 | Not applicable | Working exploit published | Computer Associates InoculateIT Agent for Exchange Server does not recognize an e-mail virus attachment if the SMTP header is missing the "From" field, which allows remote attackers to bypass virus protection. |
| CVE-2000-1234 | Medium | 2000-12-31 | Not applicable | Working exploit published | violation.php3 in Phorum 3.0.7 allows remote attackers to send e-mails to arbitrary addresses and possibly use Phorum as a "spam proxy" by setting the Mod and ForumName parameters. |
| CVE-2000-1230 | Medium | 2000-12-31 | Not applicable | Working exploit published | Backdoor in auth.php3 in Phorum 3.0.7 allows remote attackers to access restricted web pages via an HTTP request with the PHP_AUTH_USER parameter set to "boogieman". |
| CVE-2000-1228 | Medium | 2000-12-31 | Not applicable | Working exploit published | Phorum 3.0.7 allows remote attackers to change the administrator password without authentication via an HTTP request for admin.php3 that sets step, option, confirm and newPssword variables. |
| CVE-2000-0994 | High | 2000-12-19 | Not applicable | Working exploit published | Format string vulnerability in OpenBSD fstat program (and possibly other BSD-based operating systems) allows local users to gain root privileges via the PWD environmental variable. |
| CVE-2000-0993 | High | 2000-12-19 | Not applicable | Working exploit published | Format string vulnerability in pw_error function in BSD libutil library allows local users to gain root privileges via a malformed password in commands such as chpass or passwd. |
| CVE-2000-0992 | Medium | 2000-12-19 | Not applicable | Working exploit published | Directory traversal vulnerability in scp in sshd 1.2.xx allows a remote malicious scp server to overwrite arbitrary files via a .. (dot dot) attack. |
| CVE-2000-0991 | High | 2000-12-19 | Not applicable | Working exploit published | Buffer overflow in Hilgraeve, Inc. HyperTerminal client on Windows 98, ME, and 2000 allows remote attackers to execute arbitrary commands via a long telnet URL, aka the "HyperTerminal Buffer Overflow" vulnerability. |
| CVE-2000-0989 | Medium | 2000-12-19 | Not applicable | Working exploit published | Buffer overflow in Intel InBusiness eMail Station 1.04.87 POP service allows remote attackers to cause a denial of service and possibly execute commands via a long username. |
| CVE-2000-0987 | Medium | 2000-12-19 | Not applicable | Working exploit published | Buffer overflow in oidldapd in Oracle 8.1.6 allow local users to gain privileges via a long "connect" command line parameter. |
| CVE-2000-0985 | High | 2000-12-19 | Not applicable | Working exploit published | Buffer overflow in All-Mail 1.1 allows remote attackers to execute arbitrary commands via a long "MAIL FROM" or "RCPT TO" command. |
| CVE-2000-0983 | Medium | 2000-12-19 | Not applicable | Working exploit published | Microsoft NetMeeting with Remote Desktop Sharing enabled allows remote attackers to cause a denial of service (CPU utilization) via a sequence of null bytes to the NetMeeting port, aka the "NetMeeting Desktop Sharing" vulnerability. |
| CVE-2000-0979 | Medium | 2000-12-19 | Not applicable | Working exploit published | File and Print Sharing service in Windows 95, Windows 98, and Windows Me does not properly check the password for a file share, which allows remote attackers to bypass share access controls by sending a 1-byte password that matches the first character of the real password, aka the "Share Level Password" vulnerability. |
| CVE-2000-0977 | Medium | 2000-12-19 | Not applicable | Working exploit published | mailfile.cgi CGI program in MailFile 1.10 allows remote attackers to read arbitrary files by specifying the target file name in the "filename" parameter in a POST request, which is then sent by email to the address specified in the "email" parameter. |
| CVE-2000-0976 | Medium | 2000-12-19 | Not applicable | Working exploit published | Buffer overflow in xlib in XFree 3.3.x possibly allows local users to execute arbitrary commands via a long DISPLAY environment variable or a -display command line parameter. |
| CVE-2000-0975 | Medium | 2000-12-19 | Not applicable | Working exploit published | Directory traversal vulnerability in apexec.pl in Anaconda Foundation Directory allows remote attackers to read arbitrary files via a .. (dot dot) attack. |
| CVE-2000-0973 | High | 2000-12-19 | Not applicable | Working exploit published | Buffer overflow in curl earlier than 6.0-1.1, and curl-ssl earlier than 6.0-1.2, allows remote attackers to execute arbitrary commands by forcing a long error message to be generated. |
| CVE-2000-0972 | Medium | 2000-12-19 | Not applicable | Working exploit published | HP-UX 11.00 crontab allows local users to read arbitrary files via the -e option by creating a symlink to the target file during the crontab session, quitting the session, and reading the error messages that crontab generates. |
| CVE-2000-0971 | High | 2000-12-19 | Not applicable | Working exploit published | Avirt Mail 4.0 and 4.2 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long "RCPT TO" or "MAIL FROM" command. |
| CVE-2000-0967 | High | 2000-12-19 | Not applicable | Working exploit published | PHP 3 and 4 do not properly cleanse user-injected format strings, which allows remote attackers to execute arbitrary commands by triggering error messages that are improperly written to the error logs. |
| CVE-2000-0958 | Medium | 2000-12-19 | Not applicable | Working exploit published | HotJava Browser 3.0 allows remote attackers to access the DOM of a web page by opening a javascript: URL in a named window. |
| CVE-2000-0955 | High | 2000-12-19 | Not applicable | Working exploit published | Cisco Virtual Central Office 4000 (VCO/4K) uses weak encryption to store usernames and passwords in the SNMP MIB, which allows an attacker who knows the community name to crack the password and gain privileges. |
| CVE-2000-0953 | Medium | 2000-12-19 | Not applicable | Working exploit published | Shambala Server 4.5 allows remote attackers to cause a denial of service by opening then closing a connection. |
| CVE-2000-0951 | Medium | 2000-12-19 | Not applicable | Working exploit published | A misconfiguration in IIS 5.0 with Index Server enabled and the Index property set allows remote attackers to list directories in the web root via a Web Distributed Authoring and Versioning (WebDAV) search. |
| CVE-2000-0949 | High | 2000-12-19 | Not applicable | Working exploit published | Heap overflow in savestr function in LBNL traceroute 1.4a5 and earlier allows a local user to execute arbitrary commands via the -g option. |
| CVE-2000-0945 | High | 2000-12-19 | Not applicable | Working exploit published | The web configuration interface for Catalyst 3500 XL switches allows remote attackers to execute arbitrary commands without authentication when the enable password is not set, via a URL containing the /exec/ directory. |
| CVE-2000-0944 | Critical | 2000-12-19 | Not applicable | Working exploit published | CGI Script Center News Update 1.1 does not properly validate the original news administration password during a password change operation, which allows remote attackers to modify the password without knowing the original password. |
| CVE-2000-0942 | Medium | 2000-12-19 | Not applicable | Working exploit published | The CiWebHitsFile component in Microsoft Indexing Services for Windows 2000 allows remote attackers to conduct a cross site scripting (CSS) attack via a CiRestriction parameter in a .htw request, aka the "Indexing Services Cross Site Scripting" vulnerability. |
| CVE-2000-0941 | High | 2000-12-19 | Not applicable | Working exploit published | Kootenay Web KW Whois 1.0 CGI program allows remote attackers to execute arbitrary commands via shell metacharacters in the "whois" parameter. |
| CVE-2000-0937 | High | 2000-12-19 | Not applicable | Working exploit published | Samba Web Administration Tool (SWAT) in Samba 2.0.7 does not log login attempts in which the username is correct but the password is wrong, which allows remote attackers to conduct brute force password guessing attacks. |
| CVE-2000-0936 | Low | 2000-12-19 | Not applicable | Working exploit published | Samba Web Administration Tool (SWAT) in Samba 2.0.7 installs the cgi.log logging file with world readable permissions, which allows local users to read sensitive information such as user names and passwords. |
| CVE-2000-0935 | High | 2000-12-19 | Not applicable | Working exploit published | Samba Web Administration Tool (SWAT) in Samba 2.0.7 allows local users to overwrite arbitrary files via a symlink attack on the cgi.log file. |
| CVE-2000-0930 | Medium | 2000-12-19 | Not applicable | Working exploit published | Pegasus Mail 3.12 allows remote attackers to read arbitrary files via an embedded URL that calls the mailto: protocol with a -F switch. |
| CVE-2000-0929 | Medium | 2000-12-19 | Not applicable | Working exploit published | Microsoft Windows Media Player 7 allows attackers to cause a denial of service in RTF-enabled email clients via an embedded OCX control that is not closed properly, aka the "OCX Attachment" vulnerability. |
| CVE-2000-0926 | High | 2000-12-19 | Not applicable | Working exploit published | SmartWin CyberOffice Shopping Cart 2 (aka CyberShop) allows remote attackers to modify price information by changing the "Price" hidden form variable. |
| CVE-2000-0925 | Medium | 2000-12-19 | Not applicable | Working exploit published | The default installation of SmartWin CyberOffice Shopping Cart 2 (aka CyberShop) installs the _private directory with world readable permissions, which allows remote attackers to obtain sensitive information. |
| CVE-2000-0924 | Medium | 2000-12-19 | Not applicable | Working exploit published | Directory traversal vulnerability in search.cgi CGI script in Armada Master Index allows remote attackers to read arbitrary files via a .. (dot dot) attack in the "catigory" parameter. |
| CVE-2000-0922 | Medium | 2000-12-19 | Not applicable | Working exploit published | Directory traversal vulnerability in Bytes Interactive Web Shopper shopping cart program (shopper.cgi) 2.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) attack on the newpage parameter. |
| CVE-2000-0921 | Medium | 2000-12-19 | Not applicable | Working exploit published | Directory traversal vulnerability in Hassan Consulting shop.cgi shopping cart program allows remote attackers to read arbitrary files via a .. (dot dot) attack on the page parameter. |
| CVE-2000-0920 | Medium | 2000-12-19 | Not applicable | Working exploit published | Directory traversal vulnerability in BOA web server 0.94.8.2 and earlier allows remote attackers to read arbitrary files via a modified .. (dot dot) attack in the GET HTTP request that uses a "%2E" instead of a "." |
| CVE-2000-0919 | Medium | 2000-12-19 | Not applicable | Working exploit published | Directory traversal vulnerability in PHPix Photo Album 1.0.2 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) attack. |
| CVE-2000-0917 | High | 2000-12-19 | Not applicable | Working exploit published | Format string vulnerability in use_syslog() function in LPRng 3.6.24 allows remote attackers to execute arbitrary commands. |
| CVE-2000-0916 | High | 2000-12-19 | Not applicable | Working exploit published | FreeBSD 4.1.1 and earlier, and possibly other BSD-based OSes, uses an insufficient random number generator to generate initial TCP sequence numbers (ISN), which allows remote attackers to spoof TCP connections. |
| CVE-2000-0914 | Medium | 2000-12-19 | Not applicable | Working exploit published | OpenBSD 2.6 and earlier allows remote attackers to cause a denial of service by flooding the server with ARP requests. |
| CVE-2000-0912 | Medium | 2000-12-19 | Not applicable | Working exploit published | MultiHTML CGI script allows remote attackers to read arbitrary files and possibly execute arbitrary commands by specifying the file name to the "multi" parameter. |
| CVE-2000-0909 | High | 2000-12-19 | Not applicable | Working exploit published | Buffer overflow in the automatic mail checking component of Pine 4.21 and earlier allows remote attackers to execute arbitrary commands via a long From: header. |
| CVE-2000-0908 | Medium | 2000-12-19 | Not applicable | Working exploit published | BrowseGate 2.80 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via long Authorization or Referer MIME headers in the HTTP request. |
| CVE-2000-0906 | Medium | 2000-12-19 | Not applicable | Working exploit published | Directory traversal vulnerability in Moreover.com cached_feed.cgi script version 4.July.00 allows remote attackers to read arbitrary files via a .. (dot dot) attack on the category or format parameters. |
| CVE-2000-0904 | Medium | 2000-12-19 | Not applicable | Working exploit published | Voyager web server 2.01B in the demo disks for QNX 405 stores sensitive web client information in the .photon directory in the web document root, which allows remote attackers to obtain that information. |
| CVE-2000-0903 | Medium | 2000-12-19 | Not applicable | Working exploit published | Directory traversal vulnerability in Voyager web server 2.01B in the demo disks for QNX 405 allows remote attackers to read arbitrary files via a .. (dot dot) attack. |
| CVE-2000-0901 | Medium | 2000-12-19 | Not applicable | Working exploit published | Format string vulnerability in screen 3.9.5 and earlier allows local users to gain root privileges via format characters in the vbell_msg initialization variable. |
| CVE-2000-0887 | Medium | 2000-12-19 | Not applicable | Working exploit published | named in BIND 8.2 through 8.2.2-P6 allows remote attackers to cause a denial of service by making a compressed zone transfer (ZXFR) request and performing a name service query on an authoritative record that is not cached, aka the "zxfr bug." |
| CVE-2000-0886 | High | 2000-12-19 | Not applicable | Working exploit published | IIS 5.0 allows remote attackers to execute arbitrary commands via a malformed request for an executable file whose name is appended with operating system commands, aka the "Web Server File Request Parsing" vulnerability. |
| CVE-2000-1078 | Medium | 2000-12-11 | Not applicable | Working exploit published | ICQ Web Front HTTPd allows remote attackers to cause a denial of service by requesting a URL that contains a "?" character. |
| CVE-2000-1075 | Medium | 2000-12-11 | Not applicable | Working exploit published | Directory traversal vulnerability in iPlanet Certificate Management System 4.2 and Directory Server 4.12 allows remote attackers to read arbitrary files via a .. (dot dot) attack in the Agent, End Entity, or Administrator services. |
| CVE-2000-1074 | High | 2000-12-11 | Not applicable | Working exploit published | csstart program in iCal 2.1 Patch 2 uses relative pathnames to install the libsocket and libnsl libraries, which could allow the icsuser account to gain root privileges by creating a Trojan Horse library in the current or parent directory. |
| CVE-2000-1072 | High | 2000-12-11 | Not applicable | Working exploit published | iCal 2.1 Patch 2 installs many files with world-writeable permissions, which allows local users to modify the iCal configuration and execute arbitrary commands by replacing the iplncal.sh program with a Trojan horse. |
| CVE-2000-1069 | Medium | 2000-12-11 | Not applicable | Working exploit published | pollit.cgi in Poll It 2.01 and earlier allows remote attackers to access administrative functions without knowing the real password by specifying the same value to the entered_password and admin_password parameters. |
| CVE-2000-1061 | Medium | 2000-12-11 | Not applicable | Working exploit published | Microsoft Virtual Machine (VM) in Internet Explorer 4.x and 5.x allows an unsigned applet to create and use ActiveX controls, which allows a remote attacker to bypass Internet Explorer's security settings and execute arbitrary commands via a malicious web page or email, aka the "Microsoft VM ActiveX Component" vulnerability. |
| CVE-2000-1058 | Medium | 2000-12-11 | Not applicable | Working exploit published | Buffer overflow in OverView5 CGI program in HP OpenView Network Node Manager (NNM) 6.1 and earlier allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, in the SNMP service (snmp.exe), aka the "Java SNMP MIB Browser Object ID parsing problem." |
| CVE-2000-1054 | High | 2000-12-11 | Not applicable | Working exploit published | Buffer overflow in CSAdmin module in CiscoSecure ACS Server 2.4(2) and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a large packet. |
| CVE-2000-1053 | High | 2000-12-11 | Not applicable | Working exploit published | Allaire JRun 2.3.3 server allows remote attackers to compile and execute JSP code by inserting it via a cross-site scripting (CSS) attack and directly calling the com.livesoftware.jrun.plugins.JSP JSP servlet. |
| CVE-2000-1050 | Medium | 2000-12-11 | Not applicable | Working exploit published | Allaire JRun 3.0 http servlet server allows remote attackers to directly access the WEB-INF directory via a URL request that contains an extra "/" in the beginning of the request (aka the "extra leading slash"). |
| CVE-2000-1046 | High | 2000-12-11 | Not applicable | Working exploit published | Multiple buffer overflows in the ESMTP service of Lotus Domino 5.0.2c and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via long (1) "RCPT TO," (2) "SAML FROM," or (3) "SOML FROM" commands. |
| CVE-2000-1037 | High | 2000-12-11 | Not applicable | Working exploit published | Check Point Firewall-1 session agent 3.0 through 4.1 generates different error messages for invalid user names versus invalid passwords, which allows remote attackers to determine valid usernames and guess a password via a brute force attack. |
| CVE-2000-1036 | Medium | 2000-12-11 | Not applicable | Working exploit published | Directory traversal vulnerability in Extent RBS ISP web server allows remote attackers to read sensitive information via a .. (dot dot) attack on the Image parameter. |
| CVE-2000-1035 | High | 2000-12-11 | Not applicable | Working exploit published | Buffer overflows in TYPSoft FTP Server 0.78 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long USER, PASS, or CWD command. |
| CVE-2000-1033 | High | 2000-12-11 | Not applicable | Working exploit published | Serv-U FTP Server allows remote attackers to bypass its anti-hammering feature by first logging on as a valid user (possibly anonymous) and then attempting to guess the passwords of other users. |
| CVE-2000-1029 | High | 2000-12-11 | Not applicable | Working exploit published | Buffer overflow in host command allows a remote attacker to execute arbitrary commands via a long response to an AXFR query. |
| CVE-2000-1028 | High | 2000-12-11 | Not applicable | Working exploit published | Buffer overflow in cu program in HP-UX 11.0 may allow local users to gain privileges via a long -l command line argument. |
| CVE-2000-1027 | Medium | 2000-12-11 | Not applicable | Working exploit published | Cisco Secure PIX Firewall 5.2(2) allows remote attackers to determine the real IP address of a target FTP server by flooding the server with PASV requests, which includes the real IP address in the response when passive mode is established. |
| CVE-2000-1026 | High | 2000-12-11 | Not applicable | Working exploit published | Multiple buffer overflows in LBNL tcpdump allow remote attackers to execute arbitrary commands. |
| CVE-2000-1025 | Medium | 2000-12-11 | Not applicable | Working exploit published | eWave ServletExec JSP/Java servlet engine, versions 3.0C and earlier, allows remote attackers to cause a denial of service via a URL that contains the "/servlet/" string, which invokes the ServletExec servlet and causes an exception if the servlet is already running. |
| CVE-2000-1023 | High | 2000-12-11 | Not applicable | Working exploit published | The Alabanza Control Panel does not require passwords to access administrative commands, which allows remote attackers to modify domain name information via the nsManager.cgi CGI program. |
| CVE-2000-1022 | High | 2000-12-11 | Not applicable | Working exploit published | The mailguard feature in Cisco Secure PIX Firewall 5.2(2) and earlier does not properly restrict access to SMTP commands, which allows remote attackers to execute restricted commands by sending a DATA command before sending the restricted commands. |
| CVE-2000-1021 | High | 2000-12-11 | Not applicable | Working exploit published | Heap overflow in WebConfig in Mdaemon 3.1.1 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long URL. |
| CVE-2000-1016 | Medium | 2000-12-11 | Not applicable | Working exploit published | The default configuration of Apache (httpd.conf) on SuSE 6.4 includes an alias for the /usr/doc directory, which allows remote attackers to read package documentation and obtain system configuration information via an HTTP request for the /doc/packages URL. |
| CVE-2000-1014 | High | 2000-12-11 | Not applicable | Working exploit published | Format string vulnerability in the search97.cgi CGI script in SCO help http server for Unixware 7 allows remote attackers to execute arbitrary commands via format characters in the queryText parameter. |
| CVE-2000-1009 | High | 2000-12-11 | Not applicable | Working exploit published | dump in Red Hat Linux 6.2 trusts the pathname specified by the RSH environmental variable, which allows local users to obtain root privileges by modifying the RSH variable to point to a Trojan horse program. |
| CVE-2000-1008 | Medium | 2000-12-11 | Not applicable | Working exploit published | PalmOS 3.5.2 and earlier uses weak encryption to store the user password, which allows attackers with physical access to the Palm device to decrypt the password and gain access to the device. |
| CVE-2000-1005 | Medium | 2000-12-11 | Not applicable | Working exploit published | Directory traversal vulnerability in html_web_store.cgi and web_store.cgi CGI programs in eXtropia WebStore allows remote attackers to read arbitrary files via a .. (dot dot) attack on the page parameter. |
| CVE-2000-1002 | Medium | 2000-12-11 | Not applicable | Working exploit published | POP3 daemon in Stalker CommuniGate Pro 3.3.2 generates different error messages for invalid usernames versus invalid passwords, which allows remote attackers to determine valid email addresses on the server for SPAM attacks. |
| CVE-2000-0998 | High | 2000-12-11 | Not applicable | Working exploit published | Format string vulnerability in top program allows local attackers to gain root privileges via the "kill" or "renice" function. |
| CVE-2000-1224 | Medium | 2000-11-23 | Not applicable | Working exploit published | Caucho Technology Resin 1.2 and possibly earlier allows remote attackers to view JSP source via an HTTP request to a .jsp file with certain characters appended to the file name, such as (1) "..", (2) "%2e..", (3) "%81", (4) "%82", and others. |
| CVE-2000-0883 | Medium | 2000-11-14 | Not applicable | Working exploit published | The default configuration of mod_perl for Apache as installed on Mandrake Linux 6.1 through 7.1 sets the /perl/ directory to be browseable, which allows remote attackers to list the contents of that directory. |
| CVE-2000-0881 | Low | 2000-11-14 | Not applicable | Working exploit published | The dccscan setuid program in LPPlus does not properly check if the user has the permissions to print the file that is specified to dccscan, which allows local users to print arbitrary files. |
| CVE-2000-0880 | Low | 2000-11-14 | Not applicable | Working exploit published | LPPlus creates the lpdprocess file with world-writeable permissions, which allows local users to kill arbitrary processes by specifying an alternate process ID and using the setuid dcclpdshut program to kill the process that was specified in the lpdprocess file. |
| CVE-2000-0873 | Low | 2000-11-14 | Not applicable | Working exploit published | netstat in AIX 4.x.x does not properly restrict access to the -Zi option, which allows local users to clear network interface statistics and possibly hide evidence of unusual network activities. |
| CVE-2000-0872 | Medium | 2000-11-14 | Not applicable | Working exploit published | explorer.php in PhotoAlbum 0.9.9 allows remote attackers to read arbitrary files via a .. (dot dot) attack. |
| CVE-2000-0869 | Medium | 2000-11-14 | Not applicable | Working exploit published | The default configuration of Apache 1.3.12 in SuSE Linux 6.4 enables WebDAV, which allows remote attackers to list arbitrary directories via the PROPFIND HTTP request method. |
| CVE-2000-0865 | High | 2000-11-14 | Not applicable | Working exploit published | Buffer overflow in dvtermtype in Tridia Double Vision 3.07.00 allows local users to gain root privileges via a long terminal type argument. |
| CVE-2000-0864 | Medium | 2000-11-14 | Not applicable | Working exploit published | Race condition in the creation of a Unix domain socket in GNOME esound 0.2.19 and earlier allows a local user to change the permissions of arbitrary files and directories, and gain additional privileges, via a symlink attack. |
| CVE-2000-0854 | High | 2000-11-14 | Not applicable | Working exploit published | When a Microsoft Office 2000 document is launched, the directory of that document is first used to locate DLL's such as riched20.dll and msi.dll, which could allow an attacker to execute arbitrary commands by inserting a Trojan Horse DLL into the same directory as the document. |
| CVE-2000-0853 | Medium | 2000-11-14 | Not applicable | Working exploit published | YaBB Bulletin Board 9.1.2000 allows remote attackers to read arbitrary files via a .. (dot dot) attack. |
| CVE-2000-0851 | Medium | 2000-11-14 | Not applicable | Working exploit published | Buffer overflow in the Still Image Service in Windows 2000 allows local users to gain additional privileges via a long WM_USER message, aka the "Still Image Service Privilege Escalation" vulnerability. |
| CVE-2000-0848 | High | 2000-11-14 | Outside Waratek scope | Working exploit published | Buffer overflow in IBM WebSphere web application server (WAS) allows remote attackers to execute arbitrary commands via a long Host: request header. |
| CVE-2000-0846 | High | 2000-11-14 | Not applicable | Working exploit published | Buffer overflow in Darxite 0.4 and earlier allows a remote attacker to execute arbitrary commands via a long username or password. |
| CVE-2000-0844 | High | 2000-11-14 | Not applicable | Working exploit published | Some functions that implement the locale subsystem on Unix do not properly cleanse user-injected format strings, which allows local attackers to execute arbitrary commands via functions such as gettext and catopen. |
| CVE-2000-0836 | High | 2000-11-14 | Not applicable | Working exploit published | Buffer overflow in CamShot WebCam Trial2.6 allows remote attackers to execute arbitrary commands via a long Authorization header. |
| CVE-2000-0835 | Medium | 2000-11-14 | Not applicable | Working exploit published | search.dll Sambar ISAPI Search utility in Sambar Server 4.4 Beta 3 allows remote attackers to read arbitrary directories by specifying the directory in the query parameter. |