Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 20, 2026
3,918 vulnerabilities · highest exploit probability first
- CVE-2003-0466Critical 9.8Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0 through 2.6.2 via commands that cause pathnames of length MAXPATHLEN+1 to trigger a buffer overflow,…redhat · wu ftpdEPSS78%5 exploitsPublished Jul 31, 2003
- CVE-2003-0349High 7.5Buffer overflow in the streaming media component for logging multicast requests in the ISAPI for the logging capability of Microsoft Windows Media Services (nsiislog.dll), as installed in IIS 5.0, allows remote attackers to execute arbitrary code via a large POST request to…microsoft · windows 2000EPSS80%4 exploitsPublished Jul 24, 2003
- CVE-2003-0344High 7.5Buffer overflow in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to execute arbitrary code via / (slash) characters in the Type property of an Object tag in a web page.microsoft · internet explorerEPSS81%4 exploitsPublished Jun 16, 2003
- CVE-2003-0245Medium 5.0Vulnerability in the apr_psprintf function in the Apache Portable Runtime (APR) library for Apache 2.0.37 through 2.0.45 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long strings, as demonstrated using XML objects to…apache · http serverEPSS63%1 exploitPublished Jun 9, 2003
- CVE-2003-0264High 7.5Multiple buffer overflows in SLMail 5.1.0.4420 allows remote attackers to execute arbitrary code via (1) a long EHLO argument to slmail.exe, (2) a long XTRN argument to slmail.exe, (3) a long string to POPPASSWD, or (4) a long password to the POP3 server.seattle lab software · slmailEPSS72%5 exploitsPublished May 27, 2003
- CVE-2003-0190Medium 5.0OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack.openbsd · opensshEPSS77%3 exploitsPublished May 12, 2003
- CVE-2003-0213High 7.5ctrlpacket.c in PoPToP PPTP server before 1.1.4-b3 allows remote attackers to cause a denial of service via a length field of 0 or 1, which causes a negative value to be fed into a read operation, leading to a buffer overflow.poptop · pptp serverEPSS71%6 exploitsPublished May 12, 2003
- CVE-2003-0220High 7.5Buffer overflow in the administrator authentication process for Kerio Personal Firewall (KPF) 2.1.4 and earlier allows remote attackers to execute arbitrary code via a handshake packet.kerio · personal firewall 2EPSS69%6 exploitsPublished May 12, 2003
- CVE-2003-0201Critical 10.0Buffer overflow in the call_trans2open function in trans2.c for Samba 2.2.x before 2.2.8a, 2.0.10 and earlier 2.0.x versions, and Samba-TNG before 0.3.2, allows remote attackers to execute arbitrary code.samba · sambaEPSS85%16 exploitsPublished May 5, 2003
- CVE-2003-0132Medium 5.0A memory leak in Apache 2.0 through 2.0.44 allows remote attackers to cause a denial of service (memory consumption) via large chunks of linefeed characters, which causes Apache to allocate 80 bytes for each linefeed.apache · http serverEPSS87%2 exploitsPublished Apr 11, 2003
- CVE-2002-1143Medium 5.0Microsoft Word and Excel allow remote attackers to steal sensitive information via certain field codes that insert the information when the document is returned to the attacker, as demonstrated in Word using (1) INCLUDETEXT or (2) INCLUDEPICTURE, aka "Flaw in Word Fields and…microsoft · excelEPSS54%2 exploitsPublished Apr 11, 2003
- CVE-2002-0061High 7.5Apache for Win32 before 1.3.24, and 2.0.x before 2.0.34-beta, allows remote attackers to execute arbitrary commands via shell metacharacters (a | pipe character) provided as arguments to batch (.bat) or .cmd scripts, which are sent unfiltered to the shell interpreter, typically…apache · http serverEPSS50%1 exploitPublished Apr 2, 2003
- CVE-2003-0085Critical 10.0Buffer overflow in the SMB/CIFS packet fragment re-assembly code for SMB daemon (smbd) in Samba before 2.2.8, and Samba-TNG before 0.3.1, allows remote attackers to execute arbitrary code.samba · sambaEPSS86%3 exploitsPublished Mar 31, 2003
- CVE-2003-0109High 7.5Buffer overflow in ntdll.dll on Microsoft Windows NT 4.0, Windows NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows remote attackers to execute arbitrary code, as demonstrated via a WebDAV request to IIS 5.0.microsoft · windows 2000EPSS86%10 exploitsPublished Mar 31, 2003
- CVE-2002-1337Critical 10.0Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments as processed by the crackaddr function of headers.c.sendmail · sendmailEPSS73%3 exploitsPublished Mar 7, 2003
- CVE-2003-0050High 7.5parse_xml.cgi in Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote attackers to execute arbitrary code via shell metacharacters.apple · quicktime streaming serverEPSS69%2 exploitsPublished Mar 7, 2003
- CVE-2003-0001Medium 5.3cisco: information leak in ethernet frames.linux · linux kernelEPSS70%3 exploitsPublished Jan 6, 2003
- CVE-2002-1744Medium 5.0Directory traversal vulnerability in CodeBrws.asp in Microsoft IIS 5.0 allows remote attackers to view source code and determine the existence of arbitrary files via a hex-encoded "%c0%ae%c0%ae" string, which is the Unicode representation for ".." (dot dot).microsoft · internet information servicesEPSS65%1 exploitPublished Dec 31, 2002
- CVE-2002-2226High 7.5Buffer overflow in tftpd of TFTP32 2.21 and earlier allows remote attackers to execute arbitrary code via a long filename argument.tftpd32 · tftpd32EPSS63%3 exploitsPublished Dec 31, 2002
- CVE-2002-2268Critical 9.4Buffer overflow in Webster HTTP Server allows remote attackers to execute arbitrary code via a long URL.netdave · webster http serverEPSS52%4 exploitsPublished Dec 31, 2002
- CVE-2002-1643High 7.5Multiple buffer overflows in RealNetworks Helix Universal Server 9.0 (9.0.2.768) allow remote attackers to execute arbitrary code via (1) a long Transport field in a SETUP RTSP request, (2) a DESCRIBE RTSP request with a long URL argument, or (3) two simultaneous HTTP GET…realnetworks · helix universal serverEPSS75%4 exploitsPublished Dec 19, 2002
- CVE-2002-1359Critical 10.0Multiple SSH2 servers and clients do not properly handle large packets or large fields, which may allow remote attackers to cause a denial of service or possibly execute arbitrary code via buffer overflow attacks, as demonstrated by the SSHredder SSH protocol test suite.cisco · iosEPSS80%3 exploitsPublished Dec 17, 2002
- CVE-2002-1318Critical 10.0Buffer overflow in samba 2.2.2 through 2.2.6 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an encrypted password that causes the overflow during decryption in which a DOS codepage string is converted to a little-endian UCS2 unicode…samba · sambaEPSS52%1 exploitPublished Dec 11, 2002
- CVE-2002-1254High 7.5Internet Explorer 5.5 and 6.0 allows remote attackers to bypass the cross-domain security model and access information on the local system or in other domains, and possibly execute code, via cached methods and objects, aka "Cross Domain Verification via Cached Methods."microsoft · internet explorerEPSS54%1 exploitPublished Dec 11, 2002
- CVE-2002-1142High 7.5Heap-based buffer overflow in the Remote Data Services (RDS) component of Microsoft Data Access Components (MDAC) 2.1 through 2.6, and Internet Explorer 5.01 through 6.0, allows remote attackers to execute code via a malformed HTTP request to the Data Stub.microsoft · data access componentsEPSS76%2 exploitsPublished Nov 29, 2002
- CVE-2002-0840Medium 6.8Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host:…apache · http serverEPSS95%1 exploitPublished Oct 11, 2002
- CVE-2002-0965High 7.5Buffer overflow in TNS Listener for Oracle 9i Database Server on Windows systems, and Oracle 8 on VM, allows local users to execute arbitrary code via a long SERVICE_NAME parameter, which is not properly handled when writing an error message to a log file.oracle · oracle9iEPSS70%2 exploitsPublished Oct 4, 2002
- CVE-2002-1059High 7.5Buffer overflow in Van Dyke SecureCRT SSH client before 3.4.6, and 4.x before 4.0 beta 3, allows an SSH server to execute arbitrary code via a long SSH1 protocol version string.van dyke technologies · securecrtEPSS60%4 exploitsPublished Oct 4, 2002
- CVE-2002-1123High 7.5Buffer overflow in the authentication function for Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000 allows remote attackers to execute arbitrary code via a long request to TCP port 1433, aka the "Hello" overflow.microsoft · sql serverEPSS78%3 exploitsPublished Sep 24, 2002
- CVE-2002-1120High 7.5Buffer overflow in Savant Web Server 3.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request.savant · savant web serverEPSS67%5 exploitsPublished Sep 24, 2002
- CVE-2002-0654Medium 5.0Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to determine the full pathname of the server via (1) a request for a .var file, which leaks the pathname in the resulting error message, or (2) via an error message that occurs when a script (child…apache · http serverEPSS59%1 exploitPublished Sep 5, 2002
- CVE-2002-0656High 7.5Buffer overflows in OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, allow remote attackers to execute arbitrary code via (1) a large client master key in SSL2 or (2) a large session ID in SSL3.openssl · opensslEPSS90%1 exploitPublished Aug 12, 2002
- CVE-2002-0661High 7.5Directory traversal vulnerability in Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to read arbitrary files and execute commands via ..apache · http serverEPSS70%1 exploitPublished Aug 12, 2002
- CVE-2002-0391Critical 9.8Integer overflow in xdr_array function in RPC servers for operating systems that use libc, glibc, or other code based on SunRPC including dietlibc, allows remote attackers to execute arbitrary code by passing a large number of arguments to xdr_array through RPC services such as…sun · solarisEPSS58%·Published Aug 12, 2002
- CVE-2000-1209Critical 10.0The "sa" account is installed with a default null password on (1) Microsoft SQL Server 2000, (2) SQL Server 7.0, and (3) Data Engine (MSDE) 1.0, including third party packages that use these products such as (4) Tumbleweed Secure Mail (MMS) (5) Compaq Insight Manager, and (6)…compaq · insight managerEPSS87%4 exploitsPublished Aug 12, 2002
- CVE-2002-0649High 7.5Multiple buffer overflows in the Resolution Service for Microsoft SQL Server 2000 and Microsoft Desktop Engine 2000 (MSDE) allow remote attackers to cause a denial of service or execute arbitrary code via UDP packets to port 1434 in which (1) a 0x04 byte that causes the SQL…microsoft · sql serverEPSS85%3 exploitsPublished Aug 12, 2002
- CVE-2002-0422Low 2.6IIS 5 and 5.1 supporting WebDAV methods allows remote attackers to determine the internal IP address of the system (which may be obscured by NAT) via (1) a PROPFIND HTTP request with a blank Host header, which leaks the address in an HREF property in a 207 Multi-Status response,…microsoft · internet information servicesEPSS51%·Published Aug 12, 2002
- CVE-2002-0392High 7.5Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request that causes Apache to use an incorrect size.apache · http serverEPSS95%4 exploitsPublished Jul 3, 2002
- CVE-2002-0568Low 2.1Oracle 9i Application Server stores XSQL and SOAP configuration files insecurely, which allows local users to obtain sensitive information including usernames and passwords by requesting (1) XSQLConfig.xml or (2) soapConfig.xml through a virtual directory.oracle · application serverEPSS75%·Published Jul 3, 2002
- CVE-2002-0186High 7.5Buffer overflow in the SQLXML ISAPI extension of Microsoft SQL Server 2000 allows remote attackers to execute arbitrary code via data queries with a long content-type parameter, aka "Unchecked Buffer in SQLXML ISAPI Extension."microsoft · sql serverEPSS55%1 exploitPublished Jul 3, 2002
- CVE-2002-0371High 7.5Buffer overflow in gopher client for Microsoft Internet Explorer 5.1 through 6.0, Proxy Server 2.0, or ISA Server 2000 allows remote attackers to execute arbitrary code via a gopher:// URL that redirects the user to a real or simulated gopher server that sends a long response.microsoft · internet explorerEPSS54%1 exploitPublished Jul 3, 2002
- CVE-2002-0563Medium 5.0The default configuration of Oracle 9i Application Server 1.0.2.x allows remote anonymous users to access sensitive services without authentication, including Dynamic Monitoring Services (1) dms0, (2) dms/DMSDump, (3) servlet/DMSDump, (4) servlet/Spy, (5) soap/servlet/Spy, and…oracle · application serverEPSS51%·Published Jul 3, 2002
- CVE-2002-0079High 7.5Buffer overflow in the chunked encoding transfer mechanism in Internet Information Server (IIS) 4.0 and 5.0 Active Server Pages allows attackers to cause a denial of service or execute arbitrary code.microsoft · internet information serverEPSS77%4 exploitsPublished Apr 22, 2002
- CVE-2002-0148High 7.5Cross-site scripting vulnerability in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other users via an HTTP error page.microsoft · internet information serverEPSS64%1 exploitPublished Apr 22, 2002
- CVE-2002-0149High 7.5Buffer overflow in ASP Server-Side Include Function in IIS 4.0, 5.0 and 5.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via long file names.microsoft · internet information serverEPSS63%·Published Apr 22, 2002
- CVE-2002-0147High 7.5Buffer overflow in the ASP data transfer mechanism in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to cause a denial of service or execute code, aka "Microsoft-discovered variant of Chunked Encoding buffer overrun."microsoft · internet information serverEPSS62%·Published Apr 22, 2002
- CVE-2002-0072Medium 5.0The w3svc.dll ISAPI filter in Front Page Server Extensions and ASP.NET for Internet Information Server (IIS) 4.0, 5.0, and 5.1 does not properly handle the error condition when a long URL is provided, which allows remote attackers to cause a denial of service (crash) when the…microsoft · internet information serverEPSS57%·Published Apr 22, 2002
- CVE-2002-0073Medium 5.0The FTP service in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows attackers who have established an FTP session to cause a denial of service via a specially crafted status request containing glob characters.microsoft · internet information serverEPSS56%·Published Apr 22, 2002
- CVE-2002-0013Critical 10.0Vulnerabilities in the SNMPv1 request handling of a large number of SNMP implementations allow remote attackers to cause a denial of service or gain privileges via (1) GetRequest, (2) GetNextRequest, and (3) SetRequest messages, as demonstrated by the PROTOS c06-SNMPv1 test…snmp · snmpEPSS51%1 exploitPublished Feb 12, 2002
- CVE-2001-1013Medium 5.0Apache on Red Hat Linux with with the UserDir directive enabled generates different error codes when a username exists and there is no public_html directory and when the username does not exist, which could allow remote attackers to determine valid usernames on the server.redhat · linuxEPSS66%1 exploitPublished Feb 2, 2002
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2003-0466 | Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0 through 2.6.2 via commands that cause pathnames of length MAXPATHLEN+1 to trigger a buffer overflow,… redhat · wu ftpd | Critical 9.8 | 78% | 5 exploits | |
| CVE-2003-0349 | Buffer overflow in the streaming media component for logging multicast requests in the ISAPI for the logging capability of Microsoft Windows Media Services (nsiislog.dll), as installed in IIS 5.0, allows remote attackers to execute arbitrary code via a large POST request to… microsoft · windows 2000 | High 7.5 | 80% | 4 exploits | |
| CVE-2003-0344 | Buffer overflow in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to execute arbitrary code via / (slash) characters in the Type property of an Object tag in a web page. microsoft · internet explorer | High 7.5 | 81% | 4 exploits | |
| CVE-2003-0245 | Vulnerability in the apr_psprintf function in the Apache Portable Runtime (APR) library for Apache 2.0.37 through 2.0.45 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long strings, as demonstrated using XML objects to… apache · http server | Medium 5.0 | 63% | 1 exploit | |
| CVE-2003-0264 | Multiple buffer overflows in SLMail 5.1.0.4420 allows remote attackers to execute arbitrary code via (1) a long EHLO argument to slmail.exe, (2) a long XTRN argument to slmail.exe, (3) a long string to POPPASSWD, or (4) a long password to the POP3 server. seattle lab software · slmail | High 7.5 | 72% | 5 exploits | |
| CVE-2003-0190 | OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack. openbsd · openssh | Medium 5.0 | 77% | 3 exploits | |
| CVE-2003-0213 | ctrlpacket.c in PoPToP PPTP server before 1.1.4-b3 allows remote attackers to cause a denial of service via a length field of 0 or 1, which causes a negative value to be fed into a read operation, leading to a buffer overflow. poptop · pptp server | High 7.5 | 71% | 6 exploits | |
| CVE-2003-0220 | Buffer overflow in the administrator authentication process for Kerio Personal Firewall (KPF) 2.1.4 and earlier allows remote attackers to execute arbitrary code via a handshake packet. kerio · personal firewall 2 | High 7.5 | 69% | 6 exploits | |
| CVE-2003-0201 | Buffer overflow in the call_trans2open function in trans2.c for Samba 2.2.x before 2.2.8a, 2.0.10 and earlier 2.0.x versions, and Samba-TNG before 0.3.2, allows remote attackers to execute arbitrary code. samba · samba | Critical 10.0 | 85% | 16 exploits | |
| CVE-2003-0132 | A memory leak in Apache 2.0 through 2.0.44 allows remote attackers to cause a denial of service (memory consumption) via large chunks of linefeed characters, which causes Apache to allocate 80 bytes for each linefeed. apache · http server | Medium 5.0 | 87% | 2 exploits | |
| CVE-2002-1143 | Microsoft Word and Excel allow remote attackers to steal sensitive information via certain field codes that insert the information when the document is returned to the attacker, as demonstrated in Word using (1) INCLUDETEXT or (2) INCLUDEPICTURE, aka "Flaw in Word Fields and… microsoft · excel | Medium 5.0 | 54% | 2 exploits | |
| CVE-2002-0061 | Apache for Win32 before 1.3.24, and 2.0.x before 2.0.34-beta, allows remote attackers to execute arbitrary commands via shell metacharacters (a | pipe character) provided as arguments to batch (.bat) or .cmd scripts, which are sent unfiltered to the shell interpreter, typically… apache · http server | High 7.5 | 50% | 1 exploit | |
| CVE-2003-0085 | Buffer overflow in the SMB/CIFS packet fragment re-assembly code for SMB daemon (smbd) in Samba before 2.2.8, and Samba-TNG before 0.3.1, allows remote attackers to execute arbitrary code. samba · samba | Critical 10.0 | 86% | 3 exploits | |
| CVE-2003-0109 | Buffer overflow in ntdll.dll on Microsoft Windows NT 4.0, Windows NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows remote attackers to execute arbitrary code, as demonstrated via a WebDAV request to IIS 5.0. microsoft · windows 2000 | High 7.5 | 86% | 10 exploits | |
| CVE-2002-1337 | Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments as processed by the crackaddr function of headers.c. sendmail · sendmail | Critical 10.0 | 73% | 3 exploits | |
| CVE-2003-0050 | parse_xml.cgi in Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote attackers to execute arbitrary code via shell metacharacters. apple · quicktime streaming server | High 7.5 | 69% | 2 exploits | |
| CVE-2003-0001 | cisco: information leak in ethernet frames. linux · linux kernel | Medium 5.3 | 70% | 3 exploits | |
| CVE-2002-1744 | Directory traversal vulnerability in CodeBrws.asp in Microsoft IIS 5.0 allows remote attackers to view source code and determine the existence of arbitrary files via a hex-encoded "%c0%ae%c0%ae" string, which is the Unicode representation for ".." (dot dot). microsoft · internet information services | Medium 5.0 | 65% | 1 exploit | |
| CVE-2002-2226 | Buffer overflow in tftpd of TFTP32 2.21 and earlier allows remote attackers to execute arbitrary code via a long filename argument. tftpd32 · tftpd32 | High 7.5 | 63% | 3 exploits | |
| CVE-2002-2268 | Buffer overflow in Webster HTTP Server allows remote attackers to execute arbitrary code via a long URL. netdave · webster http server | Critical 9.4 | 52% | 4 exploits | |
| CVE-2002-1643 | Multiple buffer overflows in RealNetworks Helix Universal Server 9.0 (9.0.2.768) allow remote attackers to execute arbitrary code via (1) a long Transport field in a SETUP RTSP request, (2) a DESCRIBE RTSP request with a long URL argument, or (3) two simultaneous HTTP GET… realnetworks · helix universal server | High 7.5 | 75% | 4 exploits | |
| CVE-2002-1359 | Multiple SSH2 servers and clients do not properly handle large packets or large fields, which may allow remote attackers to cause a denial of service or possibly execute arbitrary code via buffer overflow attacks, as demonstrated by the SSHredder SSH protocol test suite. cisco · ios | Critical 10.0 | 80% | 3 exploits | |
| CVE-2002-1318 | Buffer overflow in samba 2.2.2 through 2.2.6 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an encrypted password that causes the overflow during decryption in which a DOS codepage string is converted to a little-endian UCS2 unicode… samba · samba | Critical 10.0 | 52% | 1 exploit | |
| CVE-2002-1254 | Internet Explorer 5.5 and 6.0 allows remote attackers to bypass the cross-domain security model and access information on the local system or in other domains, and possibly execute code, via cached methods and objects, aka "Cross Domain Verification via Cached Methods." microsoft · internet explorer | High 7.5 | 54% | 1 exploit | |
| CVE-2002-1142 | Heap-based buffer overflow in the Remote Data Services (RDS) component of Microsoft Data Access Components (MDAC) 2.1 through 2.6, and Internet Explorer 5.01 through 6.0, allows remote attackers to execute code via a malformed HTTP request to the Data Stub. microsoft · data access components | High 7.5 | 76% | 2 exploits | |
| CVE-2002-0840 | Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host:… apache · http server | Medium 6.8 | 95% | 1 exploit | |
| CVE-2002-0965 | Buffer overflow in TNS Listener for Oracle 9i Database Server on Windows systems, and Oracle 8 on VM, allows local users to execute arbitrary code via a long SERVICE_NAME parameter, which is not properly handled when writing an error message to a log file. oracle · oracle9i | High 7.5 | 70% | 2 exploits | |
| CVE-2002-1059 | Buffer overflow in Van Dyke SecureCRT SSH client before 3.4.6, and 4.x before 4.0 beta 3, allows an SSH server to execute arbitrary code via a long SSH1 protocol version string. van dyke technologies · securecrt | High 7.5 | 60% | 4 exploits | |
| CVE-2002-1123 | Buffer overflow in the authentication function for Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000 allows remote attackers to execute arbitrary code via a long request to TCP port 1433, aka the "Hello" overflow. microsoft · sql server | High 7.5 | 78% | 3 exploits | |
| CVE-2002-1120 | Buffer overflow in Savant Web Server 3.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request. savant · savant web server | High 7.5 | 67% | 5 exploits | |
| CVE-2002-0654 | Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to determine the full pathname of the server via (1) a request for a .var file, which leaks the pathname in the resulting error message, or (2) via an error message that occurs when a script (child… apache · http server | Medium 5.0 | 59% | 1 exploit | |
| CVE-2002-0656 | Buffer overflows in OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, allow remote attackers to execute arbitrary code via (1) a large client master key in SSL2 or (2) a large session ID in SSL3. openssl · openssl | High 7.5 | 90% | 1 exploit | |
| CVE-2002-0661 | Directory traversal vulnerability in Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to read arbitrary files and execute commands via .. apache · http server | High 7.5 | 70% | 1 exploit | |
| CVE-2002-0391 | Integer overflow in xdr_array function in RPC servers for operating systems that use libc, glibc, or other code based on SunRPC including dietlibc, allows remote attackers to execute arbitrary code by passing a large number of arguments to xdr_array through RPC services such as… sun · solaris | Critical 9.8 | 58% | · | |
| CVE-2000-1209 | The "sa" account is installed with a default null password on (1) Microsoft SQL Server 2000, (2) SQL Server 7.0, and (3) Data Engine (MSDE) 1.0, including third party packages that use these products such as (4) Tumbleweed Secure Mail (MMS) (5) Compaq Insight Manager, and (6)… compaq · insight manager | Critical 10.0 | 87% | 4 exploits | |
| CVE-2002-0649 | Multiple buffer overflows in the Resolution Service for Microsoft SQL Server 2000 and Microsoft Desktop Engine 2000 (MSDE) allow remote attackers to cause a denial of service or execute arbitrary code via UDP packets to port 1434 in which (1) a 0x04 byte that causes the SQL… microsoft · sql server | High 7.5 | 85% | 3 exploits | |
| CVE-2002-0422 | IIS 5 and 5.1 supporting WebDAV methods allows remote attackers to determine the internal IP address of the system (which may be obscured by NAT) via (1) a PROPFIND HTTP request with a blank Host header, which leaks the address in an HREF property in a 207 Multi-Status response,… microsoft · internet information services | Low 2.6 | 51% | · | |
| CVE-2002-0392 | Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request that causes Apache to use an incorrect size. apache · http server | High 7.5 | 95% | 4 exploits | |
| CVE-2002-0568 | Oracle 9i Application Server stores XSQL and SOAP configuration files insecurely, which allows local users to obtain sensitive information including usernames and passwords by requesting (1) XSQLConfig.xml or (2) soapConfig.xml through a virtual directory. oracle · application server | Low 2.1 | 75% | · | |
| CVE-2002-0186 | Buffer overflow in the SQLXML ISAPI extension of Microsoft SQL Server 2000 allows remote attackers to execute arbitrary code via data queries with a long content-type parameter, aka "Unchecked Buffer in SQLXML ISAPI Extension." microsoft · sql server | High 7.5 | 55% | 1 exploit | |
| CVE-2002-0371 | Buffer overflow in gopher client for Microsoft Internet Explorer 5.1 through 6.0, Proxy Server 2.0, or ISA Server 2000 allows remote attackers to execute arbitrary code via a gopher:// URL that redirects the user to a real or simulated gopher server that sends a long response. microsoft · internet explorer | High 7.5 | 54% | 1 exploit | |
| CVE-2002-0563 | The default configuration of Oracle 9i Application Server 1.0.2.x allows remote anonymous users to access sensitive services without authentication, including Dynamic Monitoring Services (1) dms0, (2) dms/DMSDump, (3) servlet/DMSDump, (4) servlet/Spy, (5) soap/servlet/Spy, and… oracle · application server | Medium 5.0 | 51% | · | |
| CVE-2002-0079 | Buffer overflow in the chunked encoding transfer mechanism in Internet Information Server (IIS) 4.0 and 5.0 Active Server Pages allows attackers to cause a denial of service or execute arbitrary code. microsoft · internet information server | High 7.5 | 77% | 4 exploits | |
| CVE-2002-0148 | Cross-site scripting vulnerability in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other users via an HTTP error page. microsoft · internet information server | High 7.5 | 64% | 1 exploit | |
| CVE-2002-0149 | Buffer overflow in ASP Server-Side Include Function in IIS 4.0, 5.0 and 5.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via long file names. microsoft · internet information server | High 7.5 | 63% | · | |
| CVE-2002-0147 | Buffer overflow in the ASP data transfer mechanism in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to cause a denial of service or execute code, aka "Microsoft-discovered variant of Chunked Encoding buffer overrun." microsoft · internet information server | High 7.5 | 62% | · | |
| CVE-2002-0072 | The w3svc.dll ISAPI filter in Front Page Server Extensions and ASP.NET for Internet Information Server (IIS) 4.0, 5.0, and 5.1 does not properly handle the error condition when a long URL is provided, which allows remote attackers to cause a denial of service (crash) when the… microsoft · internet information server | Medium 5.0 | 57% | · | |
| CVE-2002-0073 | The FTP service in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows attackers who have established an FTP session to cause a denial of service via a specially crafted status request containing glob characters. microsoft · internet information server | Medium 5.0 | 56% | · | |
| CVE-2002-0013 | Vulnerabilities in the SNMPv1 request handling of a large number of SNMP implementations allow remote attackers to cause a denial of service or gain privileges via (1) GetRequest, (2) GetNextRequest, and (3) SetRequest messages, as demonstrated by the PROTOS c06-SNMPv1 test… snmp · snmp | Critical 10.0 | 51% | 1 exploit | |
| CVE-2001-1013 | Apache on Red Hat Linux with with the UserDir directive enabled generates different error codes when a username exists and there is no public_html directory and when the username does not exist, which could allow remote attackers to determine valid usernames on the server. redhat · linux | Medium 5.0 | 66% | 1 exploit |
Showing 3,801–3,850 of 3,918
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.