58.127 CVE tracked
788 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.127 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sorted descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2000-0597 | HIGH 7.5 | microsoft excel Microsoft Office 2000 (Excel and PowerPoint) and PowerPoint 97 are marked as safe for scripting, which allows remote attackers to force Internet Explorer or some email clients to save files to arbitrary locations via the Visual Basic for Applications (VBA) Sav | 12.1% | — |
| CVE-2000-0596 | HIGH 7.5 | microsoft internet_explorer Internet Explorer 5.x does not warn a user before opening a Microsoft Access database file that is referenced within ActiveX OBJECT tags in an HTML document, which could allow remote attackers to execute arbitrary commands, aka the "IE Script" vulnerability. | 24.8% | — |
| CVE-2000-0457 | HIGH 7.5 | microsoft internet_information_server ISM.DLL in IIS 4.0 and 5.0 allows remote attackers to read file contents by requesting the file and appending a large number of encoded spaces (%20) and terminated with a .htr extension, aka the ".HTR File Fragment Reading" or "File Fragment Reading via .HTR" | 52.8% | — |
| CVE-2000-0419 | HIGH 7.5 | microsoft access The Office 2000 UA ActiveX Control is marked as "safe for scripting," which allows remote attackers to conduct unauthorized activities via the "Show Me" function in Office Help, aka the "Office 2000 UA Control" vulnerability. | 21.0% | — |
| CVE-2000-0400 | HIGH 7.5 | microsoft internet_explorer The Microsoft Active Movie ActiveX Control in Internet Explorer 5 does not restrict which file types can be downloaded, which allows an attacker to download any type of file to a user's system by encoding it within an email message or news post. | 7.4% | — |
| CVE-2000-0260 | HIGH 7.5 | microsoft frontpage Buffer overflow in the dvwssr.dll DLL in Microsoft Visual Interdev 1.0 allows users to cause a denial of service or execute commands, aka the "Link View Server-Side Component" vulnerability. | 13.9% | — |
| CVE-2000-0258 | HIGH 7.5 | microsoft internet_information_server IIS 4.0 and 5.0 allows remote attackers to cause a denial of service by sending many URLs with a large number of escaped characters, aka the "Myriad Escaped Characters" Vulnerability. | 19.6% | — |
| CVE-2000-0256 | HIGH 7.5 | microsoft frontpage Buffer overflows in htimage.exe and Imagemap.exe in FrontPage 97 and 98 Server Extensions allow a user to conduct activities that are not otherwise available through the web site, aka the "Server-Side Image Map Components" vulnerability. | 11.7% | — |
| CVE-2000-0202 | HIGH 7.5 | microsoft data_engine Microsoft SQL Server 7.0 and Microsoft Data Engine (MSDE) 1.0 allow remote attackers to gain privileges via a malformed Select statement in an SQL query. | 9.5% | — |
| CVE-2000-0161 | HIGH 7.5 | microsoft site_server Sample web sites on Microsoft Site Server 3.0 Commerce Edition do not validate an identification number, which allows remote attackers to execute SQL commands. | 10.1% | — |
| CVE-2000-0150 | HIGH 7.5 | checkpoint firewall-1 Check Point Firewall-1 allows remote attackers to bypass port access restrictions on an FTP server by forcing it to send malicious packets that Firewall-1 misinterprets as a valid 227 response to a client's PASV attempt. | 2.2% | — |
| CVE-2000-0085 | HIGH 7.5 | microsoft hotmail Hotmail does not properly filter JavaScript code from a user's mailbox, which allows a remote attacker to execute code via the LOWSRC or DYNRC parameters in the IMG tag. | 14.9% | — |
| CVE-2000-0053 | HIGH 7.5 | microsoft commercial_internet_system Microsoft Commercial Internet System (MCIS) IMAP server allows remote attackers to cause a denial of service via a malformed IMAP request. | 14.7% | — |
| CVE-1999-1591 | HIGH 7.5 | microsoft internet_information_server Microsoft Internet Information Services (IIS) server 4.0 SP4, without certain hotfixes released for SP4, does not require authentication credentials under certain conditions, which allows remote attackers to bypass authentication requirements, as demonstrated | 11.3% | — |
| CVE-1999-1582 | HIGH 7.5 | cisco pix_firewall By design, the "established" command on the Cisco PIX firewall allows connections from one host to arbitrary ports of a target host if an alternative conduit has already been allowed, which can cause administrators to configure less restrictive access controls | 1.9% | — |
| CVE-1999-1484 | HIGH 7.5 | microsoft msn_setup_bulletin_board_services Buffer overflow in MSN Setup BBS 4.71.0.10 ActiveX control (setupbbs.ocx) allows a remote attacker to execute arbitrary commands via the methods (1) vAddNewsServer or (2) bIsNewsServerConfigured. | 27.0% | — |
| CVE-1999-1474 | HIGH 7.5 | microsoft powerpoint PowerPoint 95 and 97 allows remote attackers to cause an application to be run automatically without prompting the user, possibly through the slide show, when the document is opened in browsers such as Internet Explorer. | 9.4% | — |
| CVE-1999-1466 | HIGH 7.5 | cisco ios Vulnerability in Cisco routers versions 8.2 through 9.1 allows remote attackers to bypass access control lists when extended IP access lists are used on certain interfaces, the IP route cache is enabled, and the access list uses the "established" keyword. | 2.3% | — |
| CVE-1999-1465 | HIGH 7.5 | cisco ios Vulnerability in Cisco IOS 11.1 through 11.3 with distributed fast switching (DFS) enabled allows remote attackers to bypass certain access control lists when the router switches traffic from a DFS-enabled input interface to an output interface with a logical | 1.6% | — |
| CVE-1999-1464 | HIGH 7.5 | cisco ios Vulnerability in Cisco IOS 11.1CC and 11.1CT with distributed fast switching (DFS) enabled allows remote attackers to bypass certain access control lists when the router switches traffic from a DFS-enabled interface to an interface that does not have DFS enabl | 1.6% | — |
| CVE-1999-1455 | HIGH 7.5 | microsoft windows_nt RSH service utility RSHSVC in Windows NT 3.5 through 4.0 does not properly restrict access as specified in the .Rhosts file when a user comes from an authorized host, which could allow unauthorized users to access the service by logging in from an authorized h | 3.9% | — |
| CVE-1999-1397 | HIGH 7.5 | microsoft index_server Index Server 2.0 on IIS 4.0 stores physical path information in the ContentIndex\Catalogs subkey of the AllowedPaths registry key, whose permissions allows local and remote users to obtain the physical paths of directories that are being indexed. | 11.7% | — |
| CVE-1999-1359 | HIGH 7.5 | microsoft windows_nt When the Ntconfig.pol file is used on a server whose name is longer than 13 characters, Windows NT does not properly enforce policies for global groups, which could allow users to bypass restrictions that were intended by those policies. | 3.9% | — |
| CVE-1999-1316 | HIGH 7.5 | microsoft windows_nt Passfilt.dll in Windows NT SP2 allows users to create a password that contains the user's name, which could make it easier for an attacker to guess. | 3.9% | — |
| CVE-1999-1306 | HIGH 7.5 | cisco ios Cisco IOS 9.1 and earlier does not properly handle extended IP access lists when the IP route cache is enabled and the "established" keyword is set, which could allow attackers to bypass filters. | 1.4% | — |