Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
- CVE-1999-0874Critical 10.0Buffer overflow in IIS 4.0 allows remote attackers to cause a denial of service via a malformed request for files with .HTR, .IDC, or .STM extensions.microsoft · internet information serverEPSS75%6 exploitsPublished Jun 16, 1999
- CVE-1999-1510High 7.5Buffer overflows in Bisonware FTP server prior to 4.1 allow remote attackers to cause a denial of service, and possibly execute arbitrary commands, via long (1) USER, (2) LIST, or (3) CWD commands.bisonware · bisonware ftp serverEPSS67%4 exploitsPublished May 17, 1999
- CVE-1999-1551Medium 5.0Buffer overflow in Ipswitch IMail Service 5.0 allows an attacker to cause a denial of service (crash) and possibly execute arbitrary commands via a long URL.ipswitch · imailEPSS72%1 exploitPublished Mar 2, 1999
- CVE-1999-0661Critical 10.0A system is running a version of software that was replaced with a Trojan Horse at one of its distribution points, such as (1) TCP Wrappers 7.6, (2) util-linux 2.9g, (3) wuarchive ftpd (wuftpd) 2.2 and 2.1f, (4) IRC client (ircII) ircII 2.2.9, (5) OpenSSH 3.4p1, or (6) Sendmail…EPSS54%1 exploitPublished Jan 1, 1999
- CVE-1999-0278Medium 5.0In IIS, remote attackers can obtain source code for ASP files by appending "::$DATA" to the URL.microsoft · internet information serverEPSS65%1 exploitPublished Jun 1, 1998
- CVE-1999-0502High 7.5A Unix account has a default, null, blank, or missing password.sun · solarisEPSS53%2 exploitsPublished Mar 1, 1998
- CVE-1999-0256High 7.5Buffer overflow in War FTP allows remote execution of commands.microsoft · windows 95EPSS73%4 exploitsPublished Feb 1, 1998
- CVE-1999-0513Medium 5.0ICMP messages to broadcast addresses are allowed, allowing for a Smurf attack that can cause a denial of service.freebsd · freebsdEPSS71%1 exploitPublished Jan 5, 1998
- CVE-1999-0016Medium 5.0Land IP denial of service.hp · hp-uxEPSS96%5 exploitsPublished Dec 1, 1997
- CVE-1999-0191Medium 6.4IIS newdsn.exe CGI script allows remote users to overwrite files.microsoft · internet information serverEPSS53%1 exploitPublished Sep 1, 1997
- CVE-1999-0532None 0.0A DNS server allows zone transfers.EPSS69%·Published Jul 1, 1997
- CVE-1999-0526Critical 10.0An X server's access control is disabled (e.g.x.org · x11EPSS21%1 exploitPublished Jul 1, 1997
- CVE-1999-0612None 0.0A version of finger is running that exposes valid user information to any entity on the network.gnu · fingerdEPSS68%·Published Mar 1, 1997
- CVE-1999-0046Critical 10.0Buffer overflow of rlogin program using TERM environmental variable.hp · hp-uxEPSS52%1 exploitPublished Feb 6, 1997
- CVE-1999-0504High 7.5A Windows NT local user or administrator account has a default, null, blank, or missing password.microsoft · windows ntEPSS64%5 exploitsPublished Jan 1, 1997
- CVE-1999-0128Medium 5.0Oversized ICMP ping packets can result in a denial of service, aka Ping o' Death.ibm · sngEPSS75%1 exploitPublished Dec 18, 1996
- CVE-1999-0067Critical 10.0phf CGI program allows remote command execution through shell metacharacters.apache · http serverEPSS87%·Published Mar 20, 1996
- CVE-1999-0209Medium 5.0The SunView (SunTools) selection_svc facility allows remote users to read files.sun · sunosEPSS49%4 exploitsPublished Aug 14, 1990
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-1999-0874 | Buffer overflow in IIS 4.0 allows remote attackers to cause a denial of service via a malformed request for files with .HTR, .IDC, or .STM extensions. microsoft · internet information server | Critical 10.0 | 75% | 6 exploits | |
| CVE-1999-1510 | Buffer overflows in Bisonware FTP server prior to 4.1 allow remote attackers to cause a denial of service, and possibly execute arbitrary commands, via long (1) USER, (2) LIST, or (3) CWD commands. bisonware · bisonware ftp server | High 7.5 | 67% | 4 exploits | |
| CVE-1999-1551 | Buffer overflow in Ipswitch IMail Service 5.0 allows an attacker to cause a denial of service (crash) and possibly execute arbitrary commands via a long URL. ipswitch · imail | Medium 5.0 | 72% | 1 exploit | |
| CVE-1999-0661 | A system is running a version of software that was replaced with a Trojan Horse at one of its distribution points, such as (1) TCP Wrappers 7.6, (2) util-linux 2.9g, (3) wuarchive ftpd (wuftpd) 2.2 and 2.1f, (4) IRC client (ircII) ircII 2.2.9, (5) OpenSSH 3.4p1, or (6) Sendmail… | Critical 10.0 | 54% | 1 exploit | |
| CVE-1999-0278 | In IIS, remote attackers can obtain source code for ASP files by appending "::$DATA" to the URL. microsoft · internet information server | Medium 5.0 | 65% | 1 exploit | |
| CVE-1999-0502 | A Unix account has a default, null, blank, or missing password. sun · solaris | High 7.5 | 53% | 2 exploits | |
| CVE-1999-0256 | Buffer overflow in War FTP allows remote execution of commands. microsoft · windows 95 | High 7.5 | 73% | 4 exploits | |
| CVE-1999-0513 | ICMP messages to broadcast addresses are allowed, allowing for a Smurf attack that can cause a denial of service. freebsd · freebsd | Medium 5.0 | 71% | 1 exploit | |
| CVE-1999-0016 | Land IP denial of service. hp · hp-ux | Medium 5.0 | 96% | 5 exploits | |
| CVE-1999-0191 | IIS newdsn.exe CGI script allows remote users to overwrite files. microsoft · internet information server | Medium 6.4 | 53% | 1 exploit | |
| CVE-1999-0532 | A DNS server allows zone transfers. | None 0.0 | 69% | · | |
| CVE-1999-0526 | An X server's access control is disabled (e.g. x.org · x11 | Critical 10.0 | 21% | 1 exploit | |
| CVE-1999-0612 | A version of finger is running that exposes valid user information to any entity on the network. gnu · fingerd | None 0.0 | 68% | · | |
| CVE-1999-0046 | Buffer overflow of rlogin program using TERM environmental variable. hp · hp-ux | Critical 10.0 | 52% | 1 exploit | |
| CVE-1999-0504 | A Windows NT local user or administrator account has a default, null, blank, or missing password. microsoft · windows nt | High 7.5 | 64% | 5 exploits | |
| CVE-1999-0128 | Oversized ICMP ping packets can result in a denial of service, aka Ping o' Death. ibm · sng | Medium 5.0 | 75% | 1 exploit | |
| CVE-1999-0067 | phf CGI program allows remote command execution through shell metacharacters. apache · http server | Critical 10.0 | 87% | · | |
| CVE-1999-0209 | The SunView (SunTools) selection_svc facility allows remote users to read files. sun · sunos | Medium 5.0 | 49% | 4 exploits |
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.