CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CVE-2001-1350 describes a cross-site scripting vulnerability in namazu.cgi for Namazu version 2.0.7 and earlier. This allows remote attackers to execute arbitrary Javascript as other web users via the lang parameter.
CVE-2001-0913 describes a format string vulnerability in Network Solutions Rwhoisd version 1.5.7.2 and earlier, allowing remote attackers to corrupt memory and possibly execute arbitrary code via a rwhois request containing format specifiers.
Buffer overflow in Berkeley parallel make (pmake) 2.1.33 and earlier allows a local user to gain root privileges via a long check argument of a shell definition.
Legato Networker before version 6.1 allows remote attackers to bypass access restrictions and gain privileges on the Networker interface by spoofing the admin server name and IP address.
PHP-Nuke 5.1 stores user and administrator passwords in a base-64 encoded cookie, which could allow remote attackers to gain privileges by stealing or sniffing the cookie and decoding it.
CITRIX Metaframe 1.8 logs the Client Address (IP address) provided by the client instead of obtaining it from the packet headers. This allows clients to spoof their public IP address, e.g. through Network Address Translation (NAT).
CVE-2001-0915 describes a format string vulnerability in Berkeley parallel make (pmake) version 2.1.33 and earlier, allowing a local user to gain root privileges via format specifiers in the check argument of a shell definition.
Buffer overflow in the helpctr.exe program in Microsoft Help Center for Windows XP allows remote attackers to execute arbitrary code via a long hcp: URL.
The key exchange process in the High-bandwidth Digital Content Protection (HDCP) system allows remote attackers to access data as plaintext, bypass device blacklists, clone devices, and create new device keyvectors by computing and using alternate key combinations for authentication.
Microsoft IIS 5.0 allows remote attackers to spoof web log entries via an HTTP request that includes hex-encoded newline or form-feed characters.
Hypermail allows remote attackers to execute arbitrary commands on a server supporting SSI via an attachment with a .shtml extension, which is archived on the server and can then be executed by requesting the URL for the attachment.
The remote administration client for RhinoSoft Serv-U 3.0 sends the user password in plaintext even when S/KEY One-Time Password (OTP) authentication is enabled, allowing remote attackers to sniff passwords.
Buffer overflows in gzip versions 1.3x, 1.2.4, and others may allow attackers to execute code via a long file name. This could potentially occur remotely if gzip is run on an FTP server.
Network Tools 0.2 for PHP-Nuke allows remote attackers to execute commands on the server via shell metacharacters in the $hostinput variable.
Internet Explorer 5.5 allows remote attackers to bypass security restrictions via malformed URLs that contain dotless IP addresses, causing Internet Explorer to process the page in the Intranet Zone, which may have fewer security restrictions.
CVE-2001-1129 describes format string vulnerabilities in various components of Progress database 9.1C, allowing a local user to execute arbitrary code via format string specifiers in the file used by the PROMSGS environment variable.
The rendering engine in Internet Explorer determines the MIME type independently of the type specified by the server, allowing remote servers to automatically execute scripts placed in files whose MIME type does not normally support scripting, such as text (.txt), JPEG (.jpg), etc.
CVE-2001-0717 describes a format string vulnerability in the ToolTalk database server rpc.ttdbserverd that allows remote attackers to execute arbitrary commands via format string specifiers passed to the syslog function.
Internet Explorer 6 and earlier allows remote attackers to automatically execute certain HTTP requests that appear to come from the user. This could allow attackers to gain privileges or execute operations within web-based services.
Various Intrusion Detection Systems (IDS), including Cisco Secure IDS and Snort, allow remote attackers to evade detection of HTTP attacks via non-standard '%u' Unicode encoding of ASCII characters in the requested URL.