
CVE-2000-0181
https://notcve.org/view.php?id=CVE-2000-0181
11 Mar 2000 — Firewall-1 3.0 and 4.0 leaks packets with private IP address information, which could allow remote attackers to determine the real IP address of the host that is making the connection. • http://archives.neohapsis.com/archives/bugtraq/2000-03/0119.html •

CVE-2000-0150
https://notcve.org/view.php?id=CVE-2000-0150
12 Feb 2000 — Check Point Firewall-1 allows remote attackers to bypass port access restrictions on an FTP server by forcing it to send malicious packets that Firewall-1 misinterprets as a valid 227 response to a client's PASV attempt. • http://www.kb.cert.org/vuls/id/328867 •

CVE-2000-0116 – Check Point Software Firewall-1 3.0 Script - Tag Checking Bypass
https://notcve.org/view.php?id=CVE-2000-0116
29 Jan 2000 — Firewall-1 does not properly filter script tags, which allows remote attackers to bypass the "Strip Script Tags" restriction by including an extra < in front of the SCRIPT tag. • https://www.exploit-db.com/exploits/19732 •

CVE-1999-0895
https://notcve.org/view.php?id=CVE-1999-0895
20 Oct 1999 — Firewall-1 does not properly restrict access to LDAP attributes. • http://www.osvdb.org/1117 •

CVE-1999-0675
https://notcve.org/view.php?id=CVE-1999-0675
09 Aug 1999 — Check Point FireWall-1 can be subjected to a denial of service via UDP packets that are sent through VPN-1 to port 0 of a host. • http://www.osvdb.org/1038 •

CVE-1999-0770 – Check Point Software Firewall-1 3.0/1 4.0 - Table Saturation Denial of Service
https://notcve.org/view.php?id=CVE-1999-0770
29 Jul 1999 — Firewall-1 sets a long timeout for connections that begin with ACK or other packets except SYN, allowing an attacker to conduct a denial of service via a large number of connection attempts to unresponsive systems. • https://www.exploit-db.com/exploits/19436 •

CVE-1999-1204
https://notcve.org/view.php?id=CVE-1999-1204
11 May 1998 — Check Point Firewall-1 does not properly handle certain restricted keywords (e.g., Mail, auth, time) in user-defined objects, which could produce a rule with a default "ANY" address and result in access to more systems than intended by the administrator. • http://marc.info/?l=bugtraq&m=90221101925912&w=2 •