Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: December 1999

27 records · 0 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-1999-0819
    24Monitor

    NTMail does not disable the VRFY command, even if the administrator has explicitly disabled it.

    MediumCVSS 5.0Proof of conceptEPSS 14%

    microsoft · windows 2000Dec 1, 1999

  • CVE-1999-0858
    24Monitor

    Internet Explorer 5 allows a remote attacker to modify the IE client's proxy configuration via a malicious Web Proxy Auto-Discovery (WPAD) s

    MediumCVSS 5.0No exploitEPSS 13%

    microsoft · internet explorerDec 2, 1999

  • CVE-1999-0989
    34Monitor

    Buffer overflow in Internet Explorer 5 directshow filter (MSDXM.OCX) allows remote attackers to execute commands via the vnd.ms.radio protoc

    HighCVSS 7.5Proof of conceptEPSS 11%

    microsoft · ieDec 6, 1999

  • CVE-1999-0981
    24Monitor

    Internet Explorer 5.01 and earlier allows a remote attacker to create a reference to a client window and use a server-side redirect to acces

    MediumCVSS 5.1Proof of conceptEPSS 13%

    microsoft · internet explorerDec 8, 1999

  • CVE-1999-0977
    44Plan

    Buffer overflow in Solaris sadmind allows remote attackers to gain root privileges using a NETMGT_PROC_SERVICE request.

    CriticalCVSS 10.0Proof of conceptEPSS 12%

    sun · solarisDec 10, 1999

  • CVE-1999-0995
    38Monitor

    Windows NT Local Security Authority (LSA) allows remote attackers to cause a denial of service via malformed arguments to the LsaLookupSids

    HighCVSS 7.8No exploitEPSS 21%

    microsoft · windows ntDec 16, 1999

  • CVE-2000-0024
    29Monitor

    IIS does not properly canonicalize URLs, potentially allowing remote attackers to bypass access restrictions in third-party software via esc

    MediumCVSS 6.4No exploitEPSS 12%

    microsoft · internet information serverDec 21, 1999

  • CVE-2000-0025
    30Monitor

    IIS 4.0 and Site Server 3.0 allow remote attackers to read source code for ASP files if the file is in a virtual directory whose name includ

    MediumCVSS 5.0No exploitEPSS 34%

    microsoft · internet information serverDec 21, 1999

  • CVE-2000-0002
    44Plan

    Buffer overflow in ZBServer Pro 1.50 allows remote attackers to execute commands via a long GET request.

    CriticalCVSS 10.0Proof of conceptEPSS 13%

    zbsoft · zbserverDec 22, 1999

  • CVE-2000-0028
    17Monitor

    Internet Explorer 5.0 and 5.01 allows remote attackers to bypass the cross frame security policy and read files via the external.NavigateAnd

    LowCVSS 2.6Proof of conceptEPSS 23%

    microsoft · ieDec 23, 1999

  • CVE-2000-0010
    43Plan

    WebWho+ whois.cgi program allows remote attackers to execute commands via shell metacharacters in the TLD parameter.

    CriticalCVSS 10.0Proof of conceptEPSS 11%

    tony greenwood · webwho\+Dec 26, 1999

  • CVE-1999-0154
    32Monitor

    IIS 2.0 and 3.0 allows remote attackers to read the source code for ASP pages by appending a .

    MediumCVSS 5.0Proof of conceptEPSS 40%

    microsoft · internet information serverDec 31, 1999

  • CVE-1999-0815
    25Monitor

    Memory leak in SNMP agent in Windows NT 4.0 before SP5 allows remote attackers to conduct a denial of service (memory exhaustion) via a larg

    MediumCVSS 5.0No exploitEPSS 17%

    microsoft · windows ntDec 31, 1999

  • CVE-1999-1035
    25Monitor

    IIS 3.0 and 4.0 on x86 and Alpha allows remote attackers to cause a denial of service (hang) via a malformed GET request, aka the IIS "GET"

    MediumCVSS 5.0No exploitEPSS 17%

    microsoft · internet information serverDec 31, 1999

  • CVE-1999-1043
    24Monitor

    Microsoft Exchange Server 5.5 and 5.0 does not properly handle (1) malformed NNTP data, or (2) malformed SMTP data, which allows remote atta

    MediumCVSS 5.0No exploitEPSS 13%

    microsoft · exchange serverDec 31, 1999

  • CVE-1999-1093
    24Monitor

    Buffer overflow in the Window.External function in the JScript Scripting Engine in Internet Explorer 4.01 SP1 and earlier allows remote atta

    MediumCVSS 5.1No exploitEPSS 12%

    microsoft · internet explorerDec 31, 1999

  • CVE-1999-1094
    36Monitor

    Buffer overflow in Internet Explorer 4.01 and earlier allows remote attackers to execute arbitrary commands via a long URL with the "mk:" pr

    HighCVSS 7.5No exploitEPSS 18%

    microsoft · internet explorerDec 31, 1999

  • CVE-1999-1105
    26Monitor

    Windows 95, when Remote Administration and File Sharing for NetWare Networks is enabled, creates a share (C$) when an administrator logs in

    MediumCVSS 5.0No exploitEPSS 21%

    microsoft · windows 95Dec 31, 1999

  • CVE-1999-1127
    35Monitor

    Windows NT 4.0 does not properly shut down invalid named pipe RPC connections, which allows remote attackers to cause a denial of service (r

    HighCVSS 7.5No exploitEPSS 17%

    microsoft · windows ntDec 31, 1999

  • CVE-1999-1132
    25Monitor

    Windows NT 4.0 allows remote attackers to cause a denial of service (crash) via extra source routing data such as (1) a Routing Information

    MediumCVSS 5.0No exploitEPSS 18%

    microsoft · windows ntDec 31, 1999

  • CVE-1999-1148
    25Monitor

    FTP service in IIS 4.0 and earlier allows remote attackers to cause a denial of service (resource exhaustion) via many passive (PASV) connec

    MediumCVSS 5.0No exploitEPSS 17%

    microsoft · internet information serverDec 31, 1999

  • CVE-1999-1157
    24Monitor

    Tcpip.sys in Windows NT 4.0 before SP4 allows remote attackers to cause a denial of service via an ICMP Subnet Mask Address Request packet,

    MediumCVSS 5.0No exploitEPSS 13%

    microsoft · windows ntDec 31, 1999

  • CVE-1999-1223
    27Monitor

    IIS 3.0 allows remote attackers to cause a denial of service via a request to an ASP page in which the URL contains a large number of / (for

    MediumCVSS 5.0No exploitEPSS 23%

    microsoft · internet information serverDec 31, 1999

  • CVE-1999-1451
    25Monitor

    The Winmsdp.exe sample file in IIS 4.0 and Site Server 3.0 allows remote attackers to read arbitrary files.

    MediumCVSS 5.0No exploitEPSS 17%

    microsoft · internet information serverDec 31, 1999

  • CVE-1999-1472
    25Monitor

    Internet Explorer 4.0 allows remote attackers to read arbitrary text and HTML files on the user's machine via a small IFRAME that uses Dynam

    MediumCVSS 5.0No exploitEPSS 17%

    microsoft · internet explorerDec 31, 1999

  • CVE-1999-1588
    42Plan

    Buffer overflow in nlps_server in Sun Solaris x86 2.4, 2.5, and 2.5.1 allows remote attackers to execute arbitrary code as root via a long s

    CriticalCVSS 9.8Proof of conceptEPSS 10%

    sun · solarisDec 31, 1999

  • CVE-1999-1591
    33Monitor

    Microsoft Internet Information Services (IIS) server 4.0 SP4, without certain hotfixes released for SP4, does not require authentication cre

    HighCVSS 7.5No exploitEPSS 11%

    microsoft · internet information serverDec 31, 1999