CVE Database - 2000

Browse known vulnerabilities with WAF coverage analysis. See which CVEs are detectable by Web Application Firewalls and their OWASP CRS rules.

5
Matching CVEs
15853
Critical
26962
High
69389
High WAF Coverage
Severity: All Critical (15853) High (26962) Medium (41242) Low (855)
Attack: Authentication Bypass (3246) CSRF (7960) Code Injection (4249) Command Injection (3187) Cross-Site Scripting (XSS) (37475) HTTP Response Splitting (79) Incorrect Authorization (2764) Input Validation (8673) Insecure Deserialization (2555) Missing Authorization (7641) OS Command Injection (5400) Open Redirect (1432) Path Traversal (6855) Privilege Escalation (2590) Remote File Inclusion (1113) Resource Exhaustion (2791) SQL Injection (14737) SSRF (2370) Unrestricted File Upload (3980) XXE (1206)
Year: 1990 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2012 2014 2016 2017 2018 2019 2020 2021 2022 2023 2024 2025 2026
WAF: High (69389) Medium (23730) Low (23337)
Clear filter

CVE-2000-0400

HIGH
7.50 CVSS 2.0

The Microsoft Active Movie ActiveX Control in Internet Explorer 5 does not restrict which file types can be downloaded, which allows an attacker to download any type of file to a user's system by encoding it within an email message or news post.

Improper Input Validation
WAF: Medium

CVE-2000-0380

HIGH
7.10 CVSS 2.0

The IOS HTTP service in Cisco routers and switches running IOS 11.1 through 12.1 allows remote attackers to cause a denial of service by requesting a URL that contains a %% string.

Improper Input Validation
WAF: Medium

CVE-2000-0258

HIGH
7.50 CVSS 3.0

IIS 4.0 and 5.0 allows remote attackers to cause a denial of service by sending many URLs with a large number of escaped characters, aka the "Myriad Escaped Characters" Vulnerability.

Improper Input Validation
WAF: Medium

CVE-2000-0155

HIGH
7.20 CVSS 2.0

Windows NT Autorun executes the autorun.inf file on non-removable media, which allows local attackers to specify an alternate program to execute when other users access a drive.

Code Injection
WAF: Medium

CVE-2000-1205

MEDIUM
4.30 CVSS 2.0

Cross site scripting vulnerabilities in Apache 1.3.0 through 1.3.11 allow remote attackers to execute script as other web site visitors via (1) the printenv CGI (printenv.pl), which does not encode its output, (2) pages generated by the ap_send_error_response function such as a default 404, which does not add an explicit charset, or (3) various messages that are generated by certain Apache modules or core code. NOTE: the printenv issue might still exist for web browsers that can render text/plain content types as HTML, such as Internet Explorer, but CVE regards this as a design limitation of those browsers, not Apache. The printenv.pl/acuparam vector, discloser on 20070724, is one such variant.

Cross-Site Scripting (XSS)
WAF: High