58.127 CVE tracked
788 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.127 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sorted descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2001-1325 | HIGH 7.5 | microsoft internet_explorer Internet Explorer 5.0 and 5.5, and Outlook Express 5.0 and 5.5, allow remote attackers to execute scripts when Active Scripting is disabled by including the scripts in XML stylesheets (XSL) that are referenced using an IFRAME tag, possibly due to a vulnerabili | 27.3% | — |
| CVE-2001-1192 | HIGH 7.5 | citrix ica_client Citrix Independent Computing Architecture (ICA) Client for Windows 6.1 allows remote malicious web sites to execute arbitrary code via a .ICA file, which is downloaded and automatically executed by the client. | 2.2% | — |
| CVE-2001-1105 | HIGH 7.5 | cisco icdn RSA BSAFE SSL-J 3.0, 3.0.1 and 3.1, as used in Cisco iCND 2.0, caches session IDs from failed login attempts, which could allow remote attackers to bypass SSL client authentication and gain access to sensitive data by logging in after an initial failure. | 2.7% | — |
| CVE-2001-1088 | HIGH 7.5 | microsoft outlook Microsoft Outlook 8.5 and earlier, and Outlook Express 5 and earlier, with the "Automatically put people I reply to in my address book" option enabled, do not notify the user when the "Reply-To" address is different than the "From" address, which could allow a | 19.7% | — |
| CVE-2001-1056 | HIGH 7.5 | linux linux_kernel IRC DCC helper in the ip_masq_irc IP masquerading module 2.2 allows remote attackers to bypass intended firewall restrictions by causing the target system to send a "DCC SEND" request to a malicious server which listens on port 6667, which may cause the module | 2.4% | — |
| CVE-2001-0999 | HIGH 7.5 | microsoft outlook_express Outlook Express 6.00 allows remote attackers to execute arbitrary script by embedding SCRIPT tags in a message whose MIME content type is text/plain, contrary to the expected behavior that text/plain messages will not run script. | 12.3% | — |
| CVE-2001-0929 | HIGH 7.5 | cisco ios Cisco IOS Firewall Feature set, aka Context Based Access Control (CBAC) or Cisco Secure Integrated Software, for IOS 11.2P through 12.2T does not properly check the IP protocol type, which could allow remote attackers to bypass access control lists. | 2.1% | — |
| CVE-2001-0909 | HIGH 7.5 | microsoft windows_xp Buffer overflow in helpctr.exe program in Microsoft Help Center for Windows XP allows remote attackers to execute arbitrary code via a long hcp: URL. | 19.7% | — |
| CVE-2001-0908 | HIGH 7.5 | citrix metaframe CITRIX Metaframe 1.8 logs the Client Address (IP address) that is provided by the client instead of obtaining it from the packet headers, which allows clients to spoof their public IP address, e.g. through Network Address Translation (NAT). | 1.4% | — |
| CVE-2001-0902 | HIGH 7.5 | microsoft internet_information_services Microsoft IIS 5.0 allows remote attackers to spoof web log entries via an HTTP request that includes hex-encoded newline or form-feed characters. | 18.6% | — |
| CVE-2001-0876 | HIGH 7.5 | microsoft windows_98 Buffer overflow in Universal Plug and Play (UPnP) on Windows 98, 98SE, ME, and XP allows remote attackers to execute arbitrary code via a NOTIFY directive with a long Location URL. | 49.5% | — |
| CVE-2001-0875 | HIGH 7.5 | microsoft internet_explorer Internet Explorer 5.5 and 6.0 allows remote attackers to cause the File Download dialogue box to misrepresent the name of the file in the dialogue in a way that could fool users into thinking that the file type is safe to download. | 28.1% | — |
| CVE-2001-0867 | HIGH 7.5 | cisco 12000_router Cisco 12000 with IOS 12.0 and line cards based on Engine 2 does not properly filter does not properly filter packet fragments even when the "fragment" keyword is used in an ACL, which allows remote attackers to bypass the intended access controls. | 1.7% | — |
| CVE-2001-0866 | HIGH 7.5 | cisco 12000_router Cisco 12000 with IOS 12.0 and lines card based on Engine 2 does not properly handle an outbound ACL when an input ACL is not configured on all the interfaces of a multi port line card, which could allow remote attackers to bypass the intended access controls. | 1.7% | — |
| CVE-2001-0865 | HIGH 7.5 | cisco 12000_router Cisco 12000 with IOS 12.0 and line cards based on Engine 2 does not support the "fragment" keyword in an outgoing ACL, which could allow fragmented packets in violation of the intended access. | 1.4% | — |
| CVE-2001-0864 | HIGH 7.5 | cisco 12000_router Cisco 12000 with IOS 12.0 and line cards based on Engine 2 does not properly handle the implicit "deny ip any any" rule in an outgoing ACL when the ACL contains exactly 448 entries, which can allow some outgoing packets to bypass access restrictions. | 1.4% | — |
| CVE-2001-0862 | HIGH 7.5 | cisco 12000_router Cisco 12000 with IOS 12.0 and line cards based on Engine 2 does not block non-initial packet fragments, which allows remote attackers to bypass the ACL. | 1.6% | — |
| CVE-2001-0860 | HIGH 7.5 | microsoft windows_2000 Terminal Services Manager MMC in Windows 2000 and XP trusts the Client Address (IP address) that is provided by the client instead of obtaining it from the packet headers, which allows clients to spoof their public IP address, e.g. through a Network Address Tr | 4.8% | — |
| CVE-2001-0757 | HIGH 7.5 | cisco 6400_nrp_2 Cisco 6400 Access Concentrator Node Route Processor 2 (NRP2) 12.1DC card does not properly disable access when a password has not been set for vtys, which allows remote attackers to obtain access via telnet. | 2.5% | — |
| CVE-2001-0753 | HIGH 7.5 | cisco cbos Cisco CBOS 2.3.8 and earlier stores the passwords for (1) exec and (2) enable in cleartext in the NVRAM and a configuration file, which could allow unauthorized users to obtain the passwords and gain privileges. | 1.2% | — |
| CVE-2001-0751 | HIGH 7.5 | cisco cbos Cisco switches and routers running CBOS 2.3.8 and earlier use predictable TCP Initial Sequence Numbers (ISN), which allows remote attackers to spoof or hijack TCP connections. | 2.6% | — |
| CVE-2001-0727 | HIGH 7.5 | microsoft internet_explorer Internet Explorer 6.0 allows remote attackers to execute arbitrary code by modifying the Content-Disposition and Content-Type header fields in a way that causes Internet Explorer to believe that the file is safe to open without prompting the user, aka the "Fil | 31.0% | — |
| CVE-2001-0726 | HIGH 7.5 | microsoft exchange_server Outlook Web Access (OWA) in Microsoft Exchange 5.5 Server, when used with Internet Explorer, does not properly detect certain inline script, which can allow remote attackers to perform arbitrary actions on a user's Exchange mailbox via an HTML e-mail message. | 16.1% | — |
| CVE-2001-0724 | HIGH 7.5 | microsoft internet_explorer Internet Explorer 5.5 allows remote attackers to bypass security restrictions via malformed URLs that contain dotless IP addresses, which causes Internet Explorer to process the page in the Intranet Zone, which may have fewer security restrictions, aka the "Zo | 12.3% | — |
| CVE-2001-0719 | HIGH 7.5 | microsoft windows_media_player Buffer overflow in Microsoft Windows Media Player 6.4 allows remote attackers to execute arbitrary code via a malformed Advanced Streaming Format (ASF) file. | 17.5% | — |