59.497 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.497 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sorted ascending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2001-0046 | MED 4.6 | microsoft windows_2000 The default permissions for the SNMP Parameters registry key in Windows NT 4.0 allows remote attackers to read and possibly modify the SNMP community strings to obtain sensitive information or modify network configuration, aka one of the "Registry Permissions" | 5.0% | — |
| CVE-2000-1217 | MED 4.6 | microsoft windows_2000 Microsoft Windows 2000 before Service Pack 2 (SP2), when running in a non-Windows 2000 domain and using NTLM authentication, and when credentials of an account are locally cached, allows local users to bypass account lockout policies and make an unlimited numb | 1.7% | — |
| CVE-2000-1147 | MED 4.6 | microsoft internet_information_server Buffer overflow in IIS ISAPI .ASP parsing mechanism allows attackers to execute arbitrary commands via a long string to the "LANGUAGE" argument in a script tag. | 7.9% | — |
| CVE-2000-1112 | MED 4.6 | microsoft windows_media_player Microsoft Windows Media Player 7 executes scripts in custom skin (.WMS) files, which could allow remote attackers to gain privileges via a skin that contains a malicious script, aka the ".WMS Script Execution" vulnerability. | 14.0% | — |
| CVE-2000-1088 | MED 4.6 | microsoft data_engine The xp_SetSQLSecurity function in Microsoft SQL Server 2000 and SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows | 2.8% | — |
| CVE-2000-1087 | MED 4.6 | microsoft data_engine The xp_proxiedmetadata function in Microsoft SQL Server 2000 and SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allow | 2.8% | — |
| CVE-2000-1086 | MED 4.6 | microsoft data_engine The xp_printstatements function in Microsoft SQL Server 2000 and SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allow | 2.8% | — |
| CVE-2000-1085 | MED 4.6 | microsoft data_engine The xp_peekqueue function in Microsoft SQL Server 2000 and SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an a | 5.3% | — |
| CVE-2000-1084 | MED 4.6 | microsoft data_engine The xp_updatecolvbm function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an att | 2.8% | — |
| CVE-2000-1082 | MED 4.6 | microsoft data_engine The xp_enumresultset function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an at | 2.8% | — |
| CVE-2000-1081 | MED 4.6 | microsoft data_engine The xp_displayparamstmt function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an | 5.2% | — |
| CVE-2000-0933 | MED 4.6 | microsoft windows_2000 The Input Method Editor (IME) in the Simplified Chinese version of Windows 2000 does not disable access to privileged functionality that should normally be restricted, which allows local users to gain privileges, aka the "Simplified Chinese IME State Recogniti | 2.2% | — |
| CVE-2000-0851 | MED 4.6 | microsoft windows_2000 Buffer overflow in the Still Image Service in Windows 2000 allows local users to gain additional privileges via a long WM_USER message, aka the "Still Image Service Privilege Escalation" vulnerability. | 7.6% | — |
| CVE-2000-0790 | MED 4.6 | microsoft windows_2000 The web-based folder display capability in Microsoft Internet Explorer 5.5 on Windows 98 allows local users to insert Trojan horse programs by modifying the Folder.htt file and using the InvokeVerb method in the ShellDefView ActiveX control to specify a defaul | 1.4% | — |
| CVE-2000-0737 | MED 4.6 | microsoft windows_2000 The Service Control Manager (SCM) in Windows 2000 creates predictable named pipes, which allows a local user with console access to gain administrator privileges, aka the "Service Control Manager Named Pipe Impersonation" vulnerability. | 4.4% | — |
| CVE-2000-0663 | MED 4.6 | microsoft windows_2000 The registry entry for the Windows Shell executable (Explorer.exe) in Windows NT and Windows 2000 uses a relative path name, which allows local users to execute arbitrary commands by inserting a Trojan Horse named Explorer.exe into the %Systemdrive% directory, | 1.9% | — |
| CVE-2000-0654 | MED 4.6 | microsoft sql_server Microsoft Enterprise Manager allows local users to obtain database passwords via the Data Transformation Service (DTS) package Registered Servers Dialog dialog, aka a variant of the "DTS Password" vulnerability. | 1.4% | — |
| CVE-2000-0637 | MED 4.6 | microsoft excel Microsoft Excel 97 and 2000 allows an attacker to execute arbitrary commands by specifying a malicious .dll using the Register.ID function, aka the "Excel REGISTER.ID Function" vulnerability. | 2.4% | — |
| CVE-2000-0603 | MED 4.6 | microsoft sql_server Microsoft SQL Server 7.0 allows a local user to bypass permissions for stored procedures by referencing them via a temporary stored procedure, aka the "Stored Procedure Permissions" vulnerability. | 2.3% | — |
| CVE-2000-0475 | MED 4.6 | microsoft windows_2000 Windows 2000 allows a local user process to access another user's desktop within the same windows station, aka the "Desktop Separation" vulnerability. | 1.9% | — |
| CVE-2000-0267 | MED 4.6 | cisco catos Cisco Catalyst 5.4.x allows a user to gain access to the "enable" mode without a password. | 0.4% | — |
| CVE-2000-0197 | MED 4.6 | microsoft windows_nt The Windows NT scheduler uses the drive mapping of the interactive user who is currently logged onto the system, which allows the local user to gain privileges by providing a Trojan horse batch file in place of the original batch file. | 1.6% | — |
| CVE-1999-1431 | MED 4.6 | microsoft zero_administration_kit ZAK in Appstation mode allows users to bypass the "Run only allowed apps" policy by starting Explorer from Office 97 applications (such as Word), installing software into the TEMP directory, and changing the name to that for an allowed application, such as Win | 9.7% | — |
| CVE-1999-1367 | MED 4.6 | microsoft internet_explorer Internet Explorer 5.0 does not properly reset the username/password cache for Web sites that do not use standard cache controls, which could allow users on the same system to access restricted web sites that were visited by other users. | 1.2% | — |
| CVE-1999-1358 | MED 4.6 | microsoft windows_2000 When an administrator in Windows NT or Windows 2000 changes a user policy, the policy is not properly updated if the local ntconfig.pol is not writable by the user, which could allow local users to bypass restrictions that would otherwise be enforced by the po | 1.4% | — |