Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: December 2000

33 records · 0 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2000-0999
    44Plan

    Format string vulnerabilities in OpenBSD ssh program (and possibly other BSD-based operating systems) allow attackers to gain root privilege

    CriticalCVSS 10.0No exploitEPSS 11%

    openbsd · opensshDec 11, 2000

  • CVE-2000-1003
    14Monitor

    NETBIOS client in Windows 95 and Windows 98 allows a remote attacker to cause a denial of service by changing a file sharing service to retu

    LowCVSS 2.6No exploitEPSS 12%

    microsoft · windows 95Dec 11, 2000

  • CVE-2000-1006
    24Monitor

    Microsoft Exchange Server 5.5 does not properly handle a MIME header with a blank charset specified, which allows remote attackers to cause

    MediumCVSS 5.0No exploitEPSS 14%

    microsoft · exchange serverDec 11, 2000

  • CVE-2000-1014
    33Monitor

    Format string vulnerability in the search97.cgi CGI script in SCO help http server for Unixware 7 allows remote attackers to execute arbitra

    HighCVSS 7.5Proof of conceptEPSS 11%

    sco · unixwareDec 11, 2000

  • CVE-2000-1029
    44Plan

    Buffer overflow in host command allows a remote attacker to execute arbitrary commands via a long response to an AXFR query.

    CriticalCVSS 10.0Proof of conceptEPSS 14%

    isc · bindDec 11, 2000

  • CVE-2000-1034
    48Plan

    Buffer overflow in the System Monitor ActiveX control in Windows 2000 allows remote attackers to execute arbitrary commands via a long LogFi

    CriticalCVSS 10.0No exploitEPSS 27%

    microsoft · windows 2000Dec 11, 2000

  • CVE-2000-1035
    44Plan

    Buffer overflows in TYPSoft FTP Server 0.78 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary

    CriticalCVSS 10.0Proof of conceptEPSS 12%

    typsoft · typsoftDec 11, 2000

  • CVE-2000-1053
    43Plan

    Allaire JRun 2.3.3 server allows remote attackers to compile and execute JSP code by inserting it via a cross-site scripting (CSS) attack an

    CriticalCVSS 10.0Proof of conceptEPSS 10%

    macromedia · jrunDec 11, 2000

  • CVE-2000-1058
    25Monitor

    Buffer overflow in OverView5 CGI program in HP OpenView Network Node Manager (NNM) 6.1 and earlier allows remote attackers to cause a denial

    MediumCVSS 5.0Proof of conceptEPSS 16%

    hp · openview network node managerDec 11, 2000

  • CVE-2000-1061
    23Monitor

    Microsoft Virtual Machine (VM) in Internet Explorer 4.x and 5.x allows an unsigned applet to create and use ActiveX controls, which allows a

    MediumCVSS 5.1Proof of conceptEPSS 10%

    microsoft · ieDec 11, 2000

  • CVE-1999-1579
    27Monitor

    The Cenroll ActiveX control (xenroll.dll) for Terminal Server Editions of Windows NT 4.0 and Windows NT Server 4.0 before SP6 allows remote

    MediumCVSS 5.0No exploitEPSS 21%

    microsoft · windows ntDec 14, 2000

  • CVE-2000-0817
    35Monitor

    Buffer overflow in the HTTP protocol parser for Microsoft Network Monitor (Netmon) allows remote attackers to execute arbitrary commands via

    HighCVSS 7.5No exploitEPSS 15%

    microsoft · network monitorDec 19, 2000

  • CVE-2000-0884
    49Plan

    IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary commands, via malformed UR

    HighCVSS 7.5Proof of conceptEPSS 63%

    microsoft · internet information serverDec 19, 2000

  • CVE-2000-0885
    34Monitor

    Buffer overflows in Microsoft Network Monitor (Netmon) allow remote attackers to execute arbitrary commands via a long Browser Name in a CIF

    HighCVSS 7.5No exploitEPSS 12%

    microsoft · systems management serverDec 19, 2000

  • CVE-2000-0886
    51Plan

    IIS 5.0 allows remote attackers to execute arbitrary commands via a malformed request for an executable file whose name is appended with ope

    HighCVSS 7.5Proof of conceptEPSS 68%

    microsoft · internet information serverDec 19, 2000

  • CVE-2000-0887
    27Monitor

    named in BIND 8.2 through 8.2.2-P6 allows remote attackers to cause a denial of service by making a compressed zone transfer (ZXFR) request

    MediumCVSS 5.0Proof of conceptEPSS 22%

    isc · bindDec 19, 2000

  • CVE-2000-0909
    33Monitor

    Buffer overflow in the automatic mail checking component of Pine 4.21 and earlier allows remote attackers to execute arbitrary commands via

    HighCVSS 7.5Proof of conceptEPSS 11%

    university of washington · pineDec 19, 2000

  • CVE-2000-0913
    31Monitor

    mod_rewrite in Apache 1.3.12 and earlier allows remote attackers to read arbitrary files if a RewriteRule directive is expanded to include a

    MediumCVSS 5.0No exploitEPSS 35%

    apache · http serverDec 19, 2000

  • CVE-2000-0917
    64This week

    Format string vulnerability in use_syslog() function in LPRng 3.6.24 allows remote attackers to execute arbitrary commands.

    CriticalCVSS 10.0WeaponizedEPSS 78%

    caldera · openlinux ebuilderDec 19, 2000

  • CVE-2000-0929
    24Monitor

    Microsoft Windows Media Player 7 allows attackers to cause a denial of service in RTF-enabled email clients via an embedded OCX control that

    MediumCVSS 5.0Proof of conceptEPSS 14%

    microsoft · windows media playerDec 19, 2000

  • CVE-2000-0941
    44Plan

    Kootenay Web KW Whois 1.0 CGI program allows remote attackers to execute arbitrary commands via shell metacharacters in the "whois" paramete

    CriticalCVSS 10.0Proof of conceptEPSS 13%

    kootenay web inc · kootenay web inc whoisDec 19, 2000

  • CVE-2000-0942
    27Monitor

    The CiWebHitsFile component in Microsoft Indexing Services for Windows 2000 allows remote attackers to conduct a cross site scripting (CSS)

    MediumCVSS 5.1Proof of conceptEPSS 22%

    microsoft · indexing serviceDec 19, 2000

  • CVE-2000-0944
    42Plan

    CGI Script Center News Update 1.1 does not properly validate the original news administration password during a password change operation, w

    CriticalCVSS 9.8Proof of conceptEPSS 11%

    cgi · script center news updateDec 19, 2000

  • CVE-2000-0945
    62This week

    The web configuration interface for Catalyst 3500 XL switches allows remote attackers to execute arbitrary commands without authentication w

    CriticalCVSS 10.0WeaponizedEPSS 72%

    cisco · catalyst 3500 xlDec 19, 2000

  • CVE-2000-0951
    33Monitor

    A misconfiguration in IIS 5.0 with Index Server enabled and the Index property set allows remote attackers to list directories in the web ro

    MediumCVSS 5.0Proof of conceptEPSS 44%

    microsoft · internet information servicesDec 19, 2000

  • CVE-2000-0967
    46Plan

    PHP 3 and 4 do not properly cleanse user-injected format strings, which allows remote attackers to execute arbitrary commands by triggering

    CriticalCVSS 10.0Proof of conceptEPSS 20%

    php · phpDec 19, 2000

  • CVE-2000-0970
    44Plan

    IIS 4.0 and 5.0 .ASP pages send the same Session ID cookie for secure and insecure web sessions, which could allow remote attackers to hijac

    HighCVSS 7.5No exploitEPSS 45%

    microsoft · internet information serverDec 19, 2000

  • CVE-2000-0973
    45Plan

    Buffer overflow in curl earlier than 6.0-1.1, and curl-ssl earlier than 6.0-1.2, allows remote attackers to execute arbitrary commands by fo

    CriticalCVSS 10.0Proof of conceptEPSS 18%

    daniel stenberg · curlDec 19, 2000

  • CVE-2000-0979
    48Plan

    File and Print Sharing service in Windows 95, Windows 98, and Windows Me does not properly check the password for a file share, which allows

    MediumCVSS 6.4WeaponizedEPSS 75%

    microsoft · windows 95Dec 19, 2000

  • CVE-2000-0980
    24Monitor

    NMPI (Name Management Protocol on IPX) listener in Microsoft NWLink does not properly filter packets from a broadcast address, which allows

    MediumCVSS 5.0No exploitEPSS 13%

    microsoft · windows 95Dec 19, 2000

  • CVE-2000-0982
    34Monitor

    Internet Explorer before 5.5 forwards cached user credentials for a secure web site to insecure pages on the same web site, which could allo

    HighCVSS 7.5No exploitEPSS 12%

    microsoft · internet explorerDec 19, 2000

  • CVE-2000-0983
    26Monitor

    Microsoft NetMeeting with Remote Desktop Sharing enabled allows remote attackers to cause a denial of service (CPU utilization) via a sequen

    MediumCVSS 5.0Proof of conceptEPSS 20%

    microsoft · netmeetingDec 19, 2000

  • CVE-2000-1227
    24Monitor

    Windows NT 4.0 and Windows 2000 hosts allow remote attackers to cause a denial of service (unavailable connections) by sending multiple SMB

    MediumCVSS 5.0No exploitEPSS 13%

    microsoft · windows 2000Dec 31, 2000