CVE-2000-0854
HighSummary
A vulnerability in Microsoft Office 2000 allows an attacker to execute arbitrary commands by placing a malicious DLL in the same directory as the document. When the document is launched, the system looks for required DLLs in that directory, creating an opportunity for exploitation.
Risk Assessment
The organization may be exposed to malware that can be executed through infected documents. This could lead to data loss or system compromise.
Recommendation
It is recommended to restrict the execution of documents from untrusted sources and to monitor directories where documents are stored. Consider upgrading to a newer version of the software.
Related vulnerabilities
- CVE-2026-82592Critical
A vulnerability was detected in D-Link DIR-825M 1.1.8. It affects the function sub_46725C in the file /boafrm/formDiskFormat of the Disk Formatting Handler Endpoint. Manipulation of the argument partition results in a stack-based buffer overflow. The attack can be executed remotely, and the exploit is public.
- CVE-2026-82542Critical
A vulnerability in Tenda HG10 300001138 affects the formIPv6Routing function in the file /boaform/admin/formIPv6Routing of the Boa Web Server component. Manipulation of the destNet argument causes a buffer overflow. The attack can be carried out remotely, and the exploit is publicly available.
- CVE-2026-82539Critical
A vulnerability was identified in TOTOLINK A720R 4.1.5cu.630_B20250509, affecting the setMacFilterRules function in cstecgi.cgi of the MAC Filtering component. Manipulating the desc argument can lead to memory corruption. The attack can be launched remotely, and the exploit has been publicly disclosed.
- CVE-2026-15980Critical
The MyHome Core plugin for WordPress up to version 4.4.5 contains an authentication bypass vulnerability. This is due to missing authorization in the send_link() AJAX handler and improper token validation in the activate() function. This allows unauthenticated attackers to generate an activation token for an unconfirmed user account and obtain a valid authentication cookie for that account, including administrators.
- CVE-2026-15369Critical
The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 2.2.3. This is due to the plugin accepting an attacker-controlled afreg_select_user_role value from the unauthenticated WooCommerce Store API /wc/store/v1/checkout request, persisting it in order meta, and then passing it directly to WP_User::add_role() without validating against the plugin's admin-configured allowed role list. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by creating an account during checkout with a modified JSON body specifying administrator as the desired role.
- CVE-2026-82460Critical
Cloud Commander before version 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to properly validate path normalization. Attackers can use path traversal sequences to read, write, move, or copy files outside the configured root directory.
- CVE-2026-82456Critical
argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCD_API_TOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications, request syncs, and modify Argo CD resources.
- CVE-2026-82454Critical
The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify(). Using jsonwebtoken v8 (which does not validate key/algorithm compatibility), an attacker can set alg=HS256 and sign a forged token using Apple's publicly available RSA public key as the HMAC secret, bypassing signature verification and impersonating any Apple-linked account.
- CVE-2026-82452Critical
rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected endpoints without providing valid credentials.
- CVE-2026-82448Critical
Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries through the onWebSocketDataFromChildNode handler to read and modify user records and camera configuration.
Original NVD description (English source)
When a Microsoft Office 2000 document is launched, the directory of that document is first used to locate DLL's such as riched20.dll and msi.dll, which could allow an attacker to execute arbitrary commands by inserting a Trojan Horse DLL into the same directory as the document.