| CVE-1999-0043 | Cri | 0.64 | 9.8 | 0.02 | | Dec 4, 1996 | Command execution via shell metachars in INN daemon (innd) 1.5 using "newgroup" and "rmgroup" control messages, and others. |
| CVE-2000-0917 | | 0.10 | — | 0.86 | | Dec 19, 2000 | Format string vulnerability in use_syslog() function in LPRng 3.6.24 allows remote attackers to execute arbitrary commands. |
| CVE-1999-0009 | | 0.09 | — | 0.80 | | Apr 8, 1998 | Inverse query buffer overflow in BIND 4.9 and BIND 8 Releases. |
| CVE-1999-0368 | | 0.07 | — | 0.48 | | Feb 9, 1999 | Buffer overflows in wuarchive ftpd (wu-ftpd) and ProFTPD lead to remote root access, a.k.a. palmetto. |
| CVE-2000-0491 | | 0.04 | — | 0.07 | | May 24, 2000 | Buffer overflow in the XDMCP parsing code of GNOME gdm, KDE kdm, and wdm allows remote attackers to execute arbitrary commands or cause a denial of service via a long FORWARD_QUERY request. |
| CVE-1999-0002 | | 0.04 | — | 0.10 | | Oct 12, 1998 | Buffer overflow in NFS mountd gives root access to remote attackers, mostly in Linux systems. |
| CVE-2000-1134 | | 0.03 | — | 0.00 | | Jan 9, 2001 | Multiple shell programs on various Unix systems, including (1) tcsh, (2) csh, (3) sh, and (4) bash, follow symlinks when processing << redirects (aka here-documents or in-here documents), which allows local users to overwrite files of other users via a symlink attack. |
| CVE-2000-0844 | | 0.03 | — | 0.01 | | Nov 14, 2000 | Some functions that implement the locale subsystem on Unix do not properly cleanse user-injected format strings, which allows local attackers to execute arbitrary commands via functions such as gettext and catopen. |
| CVE-2000-0530 | | 0.03 | — | 0.00 | | May 31, 2000 | The KApplication class in the KDE 1.1.2 configuration file management capability allows local users to overwrite arbitrary files. |
| CVE-2000-0438 | | 0.03 | — | 0.00 | | May 22, 2000 | Buffer overflow in fdmount on Linux systems allows local users in the "floppy" group to execute arbitrary commands via a long mountpoint parameter. |
| CVE-2000-0192 | | 0.03 | — | 0.04 | | Mar 5, 2000 | The default installation of Caldera OpenLinux 2.3 includes the CGI program rpm_query, which allows remote attackers to determine what packages are installed on the system. |
| CVE-2000-0218 | | 0.03 | — | 0.00 | | Feb 3, 2000 | Buffer overflow in Linux mount and umount allows local users to gain root privileges via a long relative pathname. |
| CVE-2000-0531 | | 0.03 | — | 0.00 | | Nov 23, 1999 | Linux gpm program allows local users to cause a denial of service by flooding the /dev/gpmctl device with STREAM sockets. |
| CVE-1999-0879 | | 0.03 | — | 0.05 | | Oct 1, 1999 | Buffer overflow in WU-FTPD and related FTP servers allows remote attackers to gain root privileges via macro variables in a message file. |
| CVE-1999-0769 | | 0.03 | — | 0.00 | | Aug 25, 1999 | Vixie Cron on Linux systems allows local users to set parameters of sendmail commands via the MAILTO environmental variable. |
| CVE-1999-0042 | | 0.03 | — | 0.05 | | Apr 7, 1997 | Buffer overflow in University of Washington's implementation of IMAP and POP servers. |
| CVE-2002-1199 | | 0.01 | — | 0.08 | | Oct 28, 2002 | The getdbm procedure in ypxfrd allows local users to read arbitrary files, and remote attackers to read databases outside /var/yp, via a directory traversal and symlink attack on the domain and map arguments. |
| CVE-2001-0850 | | 0.00 | — | 0.01 | | Dec 6, 2001 | A configuration error in the libdb1 package in OpenLinux 3.1 uses insecure versions of the snprintf and vsnprintf functions, which could allow local or remote users to exploit those functions with a buffer overflow. |
| CVE-2001-0851 | | 0.00 | — | 0.01 | | Dec 6, 2001 | Linux kernel 2.0, 2.2 and 2.4 with syncookies enabled allows remote attackers to bypass firewall rules by brute force guessing the cookie. |
| CVE-2000-0892 | | 0.00 | — | 0.01 | | Jul 21, 2001 | Some telnet clients allow remote telnet servers to request environment variables from the client that may contain sensitive information, or remote web servers to obtain the information via a telnet: URL. |
