CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow in the IMAP server in Netscape Messaging Server 4.15 Patch 2 allows local users to execute arbitrary commands via a long LIST command.
The default installation for the Oracle listener program in versions 7.3.4, 8.0.6, and 8.1.6 allows an attacker to append logging information to arbitrary files and execute commands via the SET TRC_FILE or SET LOG_FILE commands.
IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root and possibly execute arbitrary commands via malformed URLs that contain UNICODE encoded characters.
Buffer overflows in Microsoft Network Monitor (Netmon) allow remote attackers to execute arbitrary commands via a long Browser Name in a CIFS Browse Frame, a long SNMP community name, or a long username or filename in an SMB session.
IIS 5.0 allows remote attackers to execute arbitrary commands via a malformed request for an executable file whose name is appended with operating system commands. This is known as the 'Web Server File Request Parsing' vulnerability.
Directory traversal vulnerability in the ssi CGI program in thttpd 2.19 and earlier allows remote attackers to read arbitrary files via a "%2e%2e" string, a variation of the .. (dot dot) attack.
FreeBSD version 4.1.1 and earlier, and possibly other BSD-based operating systems, use an insufficient random number generator to generate initial TCP sequence numbers (ISN), allowing remote attackers to spoof TCP connections.
CVE-2000-0917 describes a format string vulnerability in the use_syslog() function in LPRng 3.6.24 that allows remote attackers to execute arbitrary commands.
CVE-2000-0918 describes a format string vulnerability in kvt in KDE 1.1.2 that may allow local users to execute arbitrary commands via a DISPLAY environmental variable containing formatting characters.
The authenticate.cgi CGI program in Aplio PRO allows remote attackers to execute arbitrary commands via shell metacharacters in the password parameter.
Buffer overflow in Pegasus Mail 3.11 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long email message containing binary data.
Glint in Red Hat Linux 5.2 allows local users to overwrite arbitrary files and cause a denial of service via a symlink attack.
The Samba Web Administration Tool (SWAT) in version 2.0.7 allows local users to overwrite arbitrary files via a symlink attack on the cgi.log file.
The Samba Web Administration Tool (SWAT) in version 2.0.7 does not log login attempts where the username is correct but the password is wrong, allowing remote attackers to conduct brute force password guessing attacks.
CVE-2000-0947 is a format string vulnerability in the cfd daemon in GNU CFEngine before version 1.6.0a11, allowing attackers to execute arbitrary commands via format characters in the CAUTH command.
GnoRPM before 0.95 allows local users to modify arbitrary files via a symlink attack.
CVE-2000-0950 describes a format string vulnerability in x-gw in TIS Firewall Toolkit (FWTK) that allows local users to execute arbitrary commands via a malformed display name.
The pluggable authentication module for MySQL (pam_mysql) before version 0.4.7 does not properly cleanse user input when constructing SQL statements, allowing attackers to obtain plaintext passwords or hashes.
CVE-2000-0969 describes a format string vulnerability in Half Life dedicated server build 3104 and earlier, allowing remote attackers to execute arbitrary commands by injecting format strings into the changelevel command via the system console or rcon.
The bbd server in Big Brother System and Network Monitor before version 1.5c2 allows remote attackers to execute arbitrary commands via the '&' shell metacharacter.