CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 2 and 2.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
4201 CVE-2000-0679 2000-10-20 2008-09-05
2.1
None Local Low Not required None Partial None
The CVS 1.10.8 client trusts pathnames that are provided by the CVS server, which allows the server to force the client to create arbitrary files.
4202 CVE-2000-0650 Exec Code 2000-07-11 2017-10-09
2.1
None Local Low Not required None Partial None
The default installation of VirusScan 4.5 and NetShield 4.5 has insecure permissions for the registry key that identifies the AutoUpgrade directory, which allows local users to execute arbitrary commands by replacing SETUP.EXE in that directory with a Trojan Horse.
4203 CVE-2000-0649 200 +Info 2000-07-13 2018-10-30
2.6
None Remote High Not required Partial None None
IIS 4.0 allows remote attackers to obtain the internal IP address of the server via an HTTP 1.0 request for a web page which is protected by basic authentication and has no realm defined.
4204 CVE-2000-0633 2000-07-18 2017-10-09
2.1
None Local Low Not required None None Partial
Vulnerability in Mandrake Linux usermode package allows local users to to reboot or halt the system.
4205 CVE-2000-0615 2000-07-19 2017-10-09
2.1
None Local Low Not required Partial None None
LPRng 3.6.x improperly installs lpd as setuid root, which can allow local users to append lpd trace and logging messages to files.
4206 CVE-2000-0605 2000-07-10 2008-09-10
2.1
None Local Low Not required Partial None None
Blackboard CourseInfo 4.0 stores the local and SQL administrator user names and passwords in cleartext in a registry key whose access control allows users to access the passwords.
4207 CVE-2000-0565 2000-06-13 2017-10-09
2.1
None Local Low Not required Partial None None
SmartFTP Daemon 0.2 allows a local user to access arbitrary files by uploading and specifying an alternate user configuration file via a .. (dot dot) attack.
4208 CVE-2000-0559 2000-06-07 2008-09-10
2.1
None Local Low Not required Partial None None
eTrust Intrusion Detection System (formerly SessionWall-3) uses weak encryption (XOR) to store administrative passwords in the registry, which allows local users to easily decrypt the passwords.
4209 CVE-2000-0553 Bypass 2000-05-26 2017-10-09
2.6
None Remote High Not required None Partial None
Race condition in IPFilter firewall 3.4.3 and earlier, when configured with overlapping "return-rst" and "keep state" rules, allows remote attackers to bypass access restrictions.
4210 CVE-2000-0552 +Info 2000-06-06 2017-10-09
2.1
None Local Low Not required Partial None None
ICQwebmail client for ICQ 2000A creates a world readable temporary file during login and does not delete it, which allows local users to obtain sensitive information.
4211 CVE-2000-0531 DoS 1999-11-23 2017-12-18
2.1
None Local Low Not required None None Partial
Linux gpm program allows local users to cause a denial of service by flooding the /dev/gpmctl device with STREAM sockets.
4212 CVE-2000-0519 2000-06-05 2018-10-12
2.6
None Remote High Not required Partial None None
Internet Explorer 4.x and 5.x does not properly re-validate an SSL certificate if the user establishes a new SSL session with the same server during the same Internet Explorer session, aka one of two different "SSL Certificate Validation" vulnerabilities.
4213 CVE-2000-0518 2000-06-05 2018-10-12
2.6
None Remote High Not required Partial None None
Internet Explorer 4.x and 5.x does not properly verify all contents of an SSL certificate if a connection is made to the server via an image or a frame, aka one of two different "SSL Certificate Validation" vulnerabilities.
4214 CVE-2000-0503 2000-06-06 2008-09-10
2.6
None Remote High Not required Partial None None
The IFRAME of the WebBrowser control in Internet Explorer 5.01 allows a remote attacker to violate the cross frame security policy via the NavigateComplete2 event.
4215 CVE-2000-0502 2000-06-08 2017-10-09
2.1
None Local Low Not required None Partial None
Mcafee VirusScan 4.03 does not properly restrict access to the alert text file before it is sent to the Central Alert Server, which allows local users to modify alerts in an arbitrary fashion.
4216 CVE-2000-0501 DoS 2000-06-16 2017-10-09
2.6
None Remote High Not required None None Partial
Race condition in MDaemon 2.8.5.0 POP server allows local users to cause a denial of service by entering a UIDL command and quickly exiting the server.
4217 CVE-2000-0489 DoS 1999-09-05 2017-10-09
2.1
None Local Low Not required None None Partial
FreeBSD, NetBSD, and OpenBSD allow an attacker to cause a denial of service by creating a large number of socket pairs using the socketpair function, setting a large buffer size via setsockopt, then writing large buffers.
4218 CVE-2000-0485 2000-05-30 2018-10-12
2.1
None Local Low Not required Partial None None
Microsoft SQL Server allows local users to obtain database passwords via the Data Transformation Service (DTS) package Properties dialog, aka the "DTS Password" vulnerability.
4219 CVE-2000-0462 2000-05-28 2008-09-10
2.1
None Local Low Not required Partial None None
ftpd in NetBSD 1.4.2 does not properly parse entries in /etc/ftpchroot and does not chroot the specified users, which allows those users to access other files outside of their home directory.
4220 CVE-2000-0461 DoS 2000-05-29 2008-09-10
2.1
None Local Low Not required None None Partial
The undocumented semconfig system call in BSD freezes the state of semaphores, which allows local users to cause a denial of service of the semaphore system by using the semconfig call.
4221 CVE-2000-0458 2000-04-22 2016-10-17
2.1
None Local Low Not required Partial None None
The MSWordView application in IMP creates world-readable files in the /tmp directory, which allows other local users to read potentially sensitive information.
4222 CVE-2000-0456 DoS 2000-05-28 2008-09-10
2.1
None Local Low Not required None None Partial
NetBSD 1.4.2 and earlier allows local users to cause a denial of service by repeatedly running certain system calls in the kernel which do not yield the CPU, aka "cpu-hog".
4223 CVE-2000-0455 Overflow 2000-05-29 2008-09-10
2.1
None Local Low Not required Partial None None
Buffer overflow in xlockmore xlock program version 4.16 and earlier allows local users to read sensitive data from memory via a long -mode option.
4224 CVE-2000-0445 2000-05-24 2008-09-10
2.1
None Local Low Not required Partial None None
The pgpk command in PGP 5.x on Unix systems uses an insufficiently random data source for non-interactive key pair generation, which may produce predictable keys.
4225 CVE-2000-0439 2000-05-11 2018-10-12
2.6
None Remote High Not required Partial None None
Internet Explorer 4.0 and 5.0 allows a malicious web site to obtain client cookies from another domain by including that domain name and escaped characters in a URL, aka the "Unauthorized Cookie Access" vulnerability.
4226 CVE-2000-0406 2000-05-10 2008-09-10
2.6
None Remote High Not required Partial None None
Netscape Communicator before version 4.73 and Navigator 4.07 do not properly validate SSL certificates, which allows remote attackers to steal information by redirecting traffic from a legitimate web server to their own malicious server, aka the "Acros-Suencksen SSL" vulnerability.
4227 CVE-2000-0402 2000-05-30 2018-10-12
2.1
None Local Low Not required Partial None None
The Mixed Mode authentication capability in Microsoft SQL Server 7.0 stores the System Administrator (sa) account in plaintext in a log file which is readable by any user, aka the "SQL Server 7.0 Service Pack Password" vulnerability.
4228 CVE-2000-0387 2000-05-09 2008-09-10
2.1
None Local Low Not required None Partial None
The makelev program in the golddig game from the FreeBSD ports collection allows local users to overwrite arbitrary files.
4229 CVE-2000-0382 2000-05-08 2008-09-10
2.6
None Remote High Not required Partial None None
ColdFusion ClusterCATS appends stale query string arguments to a URL during HTML redirection, which may provide sensitive information to the redirected site.
4230 CVE-2000-0375 2001-03-12 2008-09-10
2.1
None Local Low Not required None Partial None
The kernel in FreeBSD 3.2 follows symbolic links when it creates core dump files, which allows local attackers to modify arbitrary files.
4231 CVE-2000-0368 200 +Info 2001-03-12 2016-09-21
2.1
None Local Low Not required Partial None None
Classic Cisco IOS 9.1 and later allows attackers with access to the login prompt to obtain portions of the command history of previous users, which may allow the attacker to access sensitive data.
4232 CVE-2000-0366 1999-12-02 2008-09-10
2.1
None Local Low Not required None Partial None
dump in Debian GNU/Linux 2.1 does not properly restore symlinks, which allows a local user to modify the ownership of arbitrary files.
4233 CVE-2000-0361 1999-12-14 2008-09-10
2.1
None Local Low Not required Partial None None
The PPP wvdial.lxdialog script in wvdial 1.4 and earlier creates a .config file with world readable permissions, which allows a local attacker in the dialout group to access login and password information.
4234 CVE-2000-0345 +Info 2000-05-03 2008-09-10
2.1
None Local Low Not required Partial None None
The on-line help system options in Cisco routers allows non-privileged users without "enabled" access to obtain sensitive information via the show command.
4235 CVE-2000-0336 2000-04-21 2008-09-10
2.1
None Local Low Not required None Partial None
Linux OpenLDAP server allows local users to modify arbitrary files via a symlink attack.
4236 CVE-2000-0334 2000-04-24 2008-09-10
2.1
None Local Low Not required Partial None None
The Allaire Spectra container editor preview tool does not properly enforce object security, which allows an attacker to conduct unauthorized activities via an object-method that is added to the container object with a publishing rule.
4237 CVE-2000-0311 2000-04-20 2018-10-12
2.1
None Local Low Not required None Partial None
The Windows 2000 domain controller allows a malicious user to modify Active Directory information by modifying an unprotected attribute, aka the "Mixed Object Access" vulnerability.
4238 CVE-2000-0309 DoS 2001-03-12 2008-09-10
2.1
None Local Low Not required None None Partial
The i386 trace-trap handling in OpenBSD 2.4 with DDB enabled allows a local user to cause a denial of service.
4239 CVE-2000-0293 2000-05-02 2008-09-10
2.1
None Local Low Not required None Partial None
aaa_base in SuSE Linux 6.3, and cron.daily in earlier versions, allow local users to delete arbitrary files by creating files whose names include spaces, which are then incorrectly interpreted by aaa_base when it deletes expired files from the /tmp directory.
4240 CVE-2000-0286 DoS 2000-04-16 2008-09-10
2.1
None Local Low Not required None None Partial
X fontserver xfs allows local users to cause a denial of service via malformed input to the server.
4241 CVE-2000-0281 DoS Overflow 2000-03-26 2008-09-05
2.1
None Local Low Not required None None Partial
Buffer overflow in the Napster client beta 5 allows remote attackers to cause a denial of service via a long message.
4242 CVE-2000-0280 DoS Overflow 2000-04-03 2008-09-05
2.6
None Remote High Not required None None Partial
Buffer overflow in the RealNetworks RealPlayer client versions 6 and 7 allows remote attackers to cause a denial of service via a long Location URL.
4243 CVE-2000-0276 DoS 2000-04-10 2008-09-10
2.1
None Local Low Not required None None Partial
BeOS 4.5 and 5.0 allow local users to cause a denial of service via malformed direct system calls using interrupt 37.
4244 CVE-2000-0275 2000-04-10 2008-09-10
2.1
None Local Low Not required Partial None None
CRYPTOCard CryptoAdmin for PalmOS uses weak encryption to store a user's PIN number, which allows an attacker with access to the .PDB file to generate valid PT-1 tokens after cracking the PIN.
4245 CVE-2000-0274 DoS 2000-04-10 2008-09-10
2.1
None Local Low Not required None None Partial
The Linux trustees kernel patch allows attackers to cause a denial of service by accessing a file or directory with a long name.
4246 CVE-2000-0269 2000-04-18 2008-09-10
2.1
None Local Low Not required Partial None None
Emacs 20 does not properly set permissions for a slave PTY device when starting a new subprocess, which allows local users to read or modify communications between Emacs and the subprocess.
4247 CVE-2000-0266 Bypass 2000-04-18 2008-09-10
2.6
None Remote High Not required Partial None None
Internet Explorer 5.01 allows remote attackers to bypass the cross frame security policy via a malicious applet that interacts with the Java JSObject to modify the DOM properties to set the IFRAME to an arbitrary Javascript URL.
4248 CVE-2000-0264 +Priv 2000-04-17 2008-09-10
2.1
None Local Low Not required None Partial None
Panda Security 3.0 with registry editing disabled allows users to edit the registry and gain privileges by directly executing a .reg file or using other methods.
4249 CVE-2000-0263 DoS 2000-04-16 2008-09-10
2.1
None Local Low Not required None None Partial
The X font server xfs in Red Hat Linux 6.x allows an attacker to cause a denial of service via a malformed request.
4250 CVE-2000-0232 DoS 2000-03-30 2018-10-12
2.1
None Local Low Not required None None Partial
Microsoft TCP/IP Printing Services, aka Print Services for Unix, allows an attacker to cause a denial of service via a malformed TCP/IP print request.
Total number of vulnerabilities : 4392   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 (This Page)86 87 88
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.