CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CVE-2000-1208 describes a vulnerability in the startprinting() function in printjob.c of the BSD-based lpr lpd package. It may allow local users to gain privileges through an improper syslog call that uses format strings from the checkremote() call.
Multiple buffer overflows in HP Tru64 UNIX allow local users to gain root privileges through commands such as su, chsh, passwd, chfn, dxchpwd, and libc.
eUpload 1.0 stores the password.txt password file in plaintext under the web document root, which allows remote attackers to overwrite arbitrary files by reading password.txt.
Cross-site scripting vulnerability in CaupoShop 1.30a and earlier, and possibly CaupoShopPro, allows remote attackers to execute arbitrary Javascript. Attackers can steal credit card numbers or delete items by injecting the script into new customer information fields such as the message field.
Buffer overflow in Transsoft Broker FTP Server 5.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a CWD command with a large number of . (dot) characters.
Buffer overflow in Talentsoft Web+ 5.0 and earlier allows remote attackers to execute arbitrary code via a long Web Markup Language (wml) file name to (1) webplus.dll or (2) webplus.exe.
Buffer overflow in ASP.NET Worker Process allows remote attackers to cause a denial of service (restart) and possibly execute arbitrary code via a routine that processes cookies while in StateServer mode.
The PPP server in the Red-M 1050 Bluetooth Access Point allows bonded users to cause a denial of service through a long username, potentially leading to arbitrary code execution.
The web management server for Red-M 1050 (Bluetooth Access Point) does not use session-based credentials to authenticate users, allowing attackers to connect to the server from the same IP address as a user who has already established a session.
Red-M 1050 (Bluetooth Access Point) uses case insensitive passwords, making it easier for attackers to conduct a brute force guessing attack due to the smaller space of possible passwords.
CVE-2002-0702 describes format string vulnerabilities in the logging routines for dynamic DNS code in the ISC DHCP daemon (DHCPD) versions 3 to 3.0.1rc8, with the NSUPDATE option enabled. This allows remote malicious DNS servers to execute arbitrary code via format strings in a DNS server response.
An interaction between the Perl MD5 module (perl-Digest-MD5) and Perl could produce incorrect MD5 checksums for UTF-8 data, which could prevent a system from properly verifying the integrity of the data.
Buffer overflow in the management web interface of Red-M 1050 (Bluetooth Access Point) allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long administration password.
Buffer overflows in Squid before 2.4.STABLE6 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the MSNT auth helper, gopher client, or FTP server directory listing parser.
PHP versions 4.2.0 and 4.2.1 allow remote attackers to cause a denial of service and possibly execute arbitrary code via an HTTP POST request with certain arguments in a multipart/form-data form, leading to improper memory management.
Buffer overflow in lprintf and cprintf in sysdep.c of Citadel/UX 5.90 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via attacks such as a long HELO command to the SMTP server.
The directory.php script by Marcus S. Xenakis allows remote attackers to execute arbitrary commands via shell metacharacters in the dir parameter.
Smsd in SMS Server Tools (SMStools) before version 1.4.8 allows remote attackers to execute arbitrary commands via shell metacharacters (backquotes) in message text, referred to as a 'string format vulnerability'.
Trend Micro InterScan VirusWall HTTP proxy 3.6 with the 'Skip scanning if Content-length equals 0' option enabled allows malicious web servers to bypass content scanning via a Content-length header set to 0, which is often ignored by HTTP clients.
Microsoft Windows 2000 running the Terminal Server 90-day trial version, and possibly other versions, does not apply group policies to incoming users when the number of connections to the SYSVOL share exceeds the maximum. This may allow remote authenticated users to bypass group policies.