CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflows in the send_status, kill_print, and chk_fhost functions in lpd in AIX 4.3 and 5.1 allow remote attackers to gain root privileges.
CVE-2001-0857 describes a cross-site scripting vulnerability in status.php3 in Imp Webmail version 2.2.6 and earlier. It allows remote attackers to gain access to other users' emails by hijacking session cookies via the message parameter.
Lotus Domino Web Server 5.x allows remote attackers to gain sensitive information by accessing the default navigator $defaultNav via URL encoding the request or directly requesting the ReplicaID.
Cisco 12000 with IOS 12.0 and line cards based on Engine 2 does not support the 'fragment' keyword in an outgoing ACL, which could allow fragmented packets in violation of the intended access.
Lotus Domino 5.x allows remote attackers to read files or execute arbitrary code by requesting the ReplicaID of the Web Administrator template file (webadmin.ntf).
Vulnerability in (1) Book of guests and (2) Post it! allows remote attackers to execute arbitrary code via shell metacharacters in the email parameter.
Buffer overflow in Microsoft Windows Media Player 6.4 allows remote attackers to execute arbitrary code via a malformed Advanced Streaming Format (ASF) file.
Buffer overflow in db_loader in ClearCase 4.2 and earlier allows local users to gain root privileges via a long TERM environment variable.
Directory traversal vulnerability in Search.cgi in Leoboard LB5000 LB5000II 1029 and earlier allows remote attackers to overwrite files and gain privileges via .. (dot dot) sequences in the amembernamecookie cookie.
Directory traversal vulnerability in Search.cgi in Ikonboard ib219 and earlier allows remote attackers to overwrite files and gain privileges via .. (dot dot) sequences in the amembernamecookie cookie.
The iBill password management system generates weak passwords based on a client's MASTER_ACCOUNT, allowing remote attackers to modify account information in the .htpasswd file via brute force password guessing.
Cross-site scripting vulnerability in Webalizer 2.01-06, and possibly other versions, allows remote attackers to inject arbitrary HTML tags by specifying them in (1) search keywords embedded in HTTP referrer information, or (2) host names that are retrieved via a reverse DNS lookup.
6tunnel version 0.08 and earlier does not properly close sockets initiated by a client, allowing remote attackers to cause a denial of service (resource exhaustion) by repeatedly connecting to and disconnecting from the server.
Cisco 12000 devices with IOS 12.0 and line cards based on Engine 2 do not properly handle outbound ACLs when input ACLs are not configured on all interfaces of a multi-port line card. This could allow remote attackers to bypass intended access controls.
Buffer overflow in otrcrep in Oracle 8.0.x through 9.0.1 allows local users to execute arbitrary code via a long ORACLE_HOME environment variable, known as the 'Oracle Trace Collection Security Vulnerability.'
A buffer overflow in the '\s' console command in MDBMS 0.99b9 and earlier allows remote attackers to execute arbitrary commands by sending a large amount of data.
CVE-2001-0948 is a cross-site scripting (XSS) vulnerability in ValiCert Enterprise Validation Authority (EVA) versions 3.3 through 4.2.1. It allows remote attackers to execute arbitrary code or display false information by including HTML or script in the certificate's description, which is executed when the certificate is viewed.
The Forms.exe CGI program in ValiCert Enterprise Validation Authority (EVA) versions 3.3 through 4.2.1 allows remote attackers to determine the real pathname of the server by requesting an invalid extension, which produces an error page that includes the path.
Buffer overflows in the forms.exe CGI program in ValiCert Enterprise Validation Authority (EVA) allow remote attackers to execute arbitrary code via long arguments to various parameters. This issue affects versions 3.3 through 4.2.1.
The ValiCert Enterprise Validation Authority (EVA) Administration Server versions 3.3 through 4.2.1 uses insufficiently random data to generate session tokens and certificates, which may facilitate brute force attacks.