CVE-2000-1199

MediumCVSS 4.6/10Last modified Jun 16, 2026

Description

PostgreSQL stores usernames and passwords in plaintext in (1) pg_shadow and (2) pg_pwd, which allows attackers with sufficient privileges to gain access to databases.

Metrics

CVSS 2.0 4.6/10AV:L/AC:L/Au:N/C:P/I:P/A:P

Affected software

No affected versions have been published.

Timeline

Published
Aug 31, 2001
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2000

CVE-2000-12005.0Windows NT allows remote attackers to list all users in a domain by obtaining the domain SID with the LsaQueryInformationPolicy policy functCVE-2000-12015.0Check Point FireWall-1 allows remote attackers to cause a denial of service (high CPU) via a flood of packets to port 264.CVE-2000-12027.2ikeyman in IBM IBMHSSSB 1.0 sets the CLASSPATH environmental variable to include the user's own CLASSPATH directories before the system's diCVE-2000-12035.0Lotus Domino SMTP server 4.63 through 5.08 allows remote attackers to cause a denial of service (CPU consumption) by forging an email messagCVE-2000-12045.0Vulnerability in the mod_vhost_alias virtual hosting module for Apache 1.3.9, 1.3.11 and 1.3.12 allows remote attackers to obtain the sourceCVE-2000-12054.3Cross site scripting vulnerabilities in Apache 1.3.0 through 1.3.11 allow remote attackers to execute script as other web site visitors via CVE-2000-12065.0Vulnerability in Apache httpd before 1.3.11, when configured for mass virtual hosting using mod_rewrite, or mod_vhost_alias in Apache 1.3.9,CVE-2000-12077.2userhelper in the usermode package on Red Hat Linux executes non-setuid programs as root, which does not activate the security measures in gCVE-2000-12087.2Format string vulnerability in startprinting() function of printjob.c in BSD-based lpr lpd package may allow local users to gain privileges CVE-2000-120910.0The "sa" account is installed with a default null password on (1) Microsoft SQL Server 2000, (2) SQL Server 7.0, and (3) Data Engine (MSDE) CVE-2000-12105.0Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. (dot doCVE-2000-12117.5Zope 2.2.0 through 2.2.4 does not properly perform security registration for legacy names of object constructors such as DTML method objects