Login Request a demo
Unscored severity · published Oct 20, 2000
CVE-2000-0746
Vulnerabilities in IIS 4.0 and 5.0 do not properly protect against cross-site scripting (CSS) attacks
–
CVSS
10.1%
EPSS
No
On KEV
Description
Vulnerabilities in IIS 4.0 and 5.0 do not properly protect against cross-site scripting (CSS) attacks. They allow a malicious web site operator to embed scripts in a link to a trusted site, which are returned without quoting in an error message back to the client. The client then executes those scripts in the same context as the trusted site, aka the "IIS Cross-Site Scripting" vulnerabilities.
Exploitation
Is it being used?
Exploit prediction (EPSS)10.1% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FR
Frontpage · Microsoft
All versions, or not specified · source: NVD
II
Internet Information Server · Microsoft
4.0 · source: NVD
II
Internet Information Services · Microsoft
5.0 · source: NVD
Affected product
FR
Frontpage
Microsoft
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2000-0746
CVE.org
https://www.cve.org/CVERecord?id=CVE-2000-0746
Patch
http://www.securityfocus.com/bid/1594
Patch
http://www.securityfocus.com/bid/1595
www.securityfocus.com
http://www.securityfocus.com/templates/archive.pike?list=1&msg=39A12BD6.E811BF4F%40nat.bg
docs.microsoft.com
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-060
More from Frontpage
8.8
CVE-2007-0671
Microsoft Office Excel Remote Code Execution Vulnerability
7.0
CVE-1999-0012
Some web servers under Microsoft Windows allow remote attackers to bypass access restrictions for files with long file names
–
CVE-2013-3137
Microsoft FrontPage 2003 SP3 does not properly parse DTDs, which allows remote attackers to obtain sensitive information via crafted XML data in a FrontPage document, aka "XML…
–
CVE-2008-3068
Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by using an arbitrary…
–
CVE-2007-3109
The CERN Image Map Dispatcher (htimage.exe) in Microsoft FrontPage allows remote attackers to determine the existence, and possibly partial contents, of arbitrary files under the…