II
Product
Internet Information Server
107
CVEs
0
On KEV
7.5
Max CVSS
0
New 30D
Severity mix
Critical 0High 3Medium 0Low 0
Watch
Add Internet Information Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2001-0334 | 7.5 | Jun 27 | FTP service in IIS 5.0 and earlier allows remote attackers to cause a denial of service via a wildcard sequence that generates a long string when it is expanded Affected: through 5.0 |
| CVE-2000-0258 | 7.5 | Apr 12 | IIS 4.0 and 5.0 allows remote attackers to cause a denial of service by sending many URLs with a large number of escaped characters, aka the "Myriad Escaped Characters"… Affected: 4.0 |
| CVE-1999-0012 | 7.0 | Feb 6 | Some web servers under Microsoft Windows allow remote attackers to bypass access restrictions for files with long file names Affected: 4.0 |
| CVE-2010-1899 | – | Sep 15 | Stack consumption vulnerability in the ASP implementation in Microsoft Internet Information Services (IIS) 5.1, 6.0, 7.0, and 7.5 allows remote attackers to cause a denial of… Affected: 6.0 |
| CVE-2010-1256 | – | Jun 8 | Unspecified vulnerability in Microsoft IIS 6.0, 7.0, and 7.5, when Extended Protection for Authentication is enabled, allows remote authenticated users to execute arbitrary code… Affected: 6.0 |
| CVE-2003-1582 | – | Feb 5 | Microsoft Internet Information Services (IIS) 6.0, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject arbitrary text into log files via an… Affected: 6.0 |
| CVE-2009-3023 | – | Aug 31 | Buffer overflow in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 6.0 allows remote authenticated users to execute arbitrary code via a crafted NLST… Affected: 5.0 through 6.0 |
| CVE-2008-0074 | – | Feb 12 | Unspecified vulnerability in Microsoft Internet Information Services (IIS) 5.0 through 7.0 allows local users to gain privileges via unknown vectors related to file change… Affected: 6.0; 6.0 |
| CVE-2008-0075 | – | Feb 12 | Unspecified vulnerability in Microsoft Internet Information Services (IIS) 5.1 through 6.0 allows remote attackers to execute arbitrary code via crafted inputs to ASP pages Affected: 6.0; 6.0 |
| CVE-2007-2897 | – | May 30 | Microsoft Internet Information Services (IIS) 6.0 allows remote attackers to cause a denial of service (server instability or device hang), and possibly obtain sensitive… Affected: 6.0 |
| CVE-2007-0087 | – | Jan 5 | Microsoft Internet Information Services (IIS), when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of service (network… Affected: All versions, or not specified |
| CVE-2006-6579 | – | Dec 15 | Microsoft Windows XP has weak permissions (FILE_WRITE_DATA and FILE_READ_DATA for Everyone) for %WINDIR%\pchealth\ERRORREP\QHEADLES, which allows local users to write and read… Affected: through 5.0; 3.0; 4.0; 4.0 |
| CVE-2006-0026 | – | Jul 11 | Buffer overflow in Microsoft Internet Information Services (IIS) 5.0, 5.1, and 6.0 allows local and possibly remote attackers to execute arbitrary code via crafted Active Server… Affected: 6.0 |
| CVE-2005-2678 | – | Aug 23 | Microsoft IIS 5.1 and 6 allows remote attackers to spoof the SERVER_NAME variable to bypass security checks and conduct various attacks via a GET request with an http://localhost… Affected: 6.0 |
| CVE-2003-0718 | – | Nov 3 | The WebDAV Message Handler for Internet Information Services (IIS) 5.0, 5.1, and 6.0 allows remote attackers to cause a denial of service (memory and CPU exhaustion, application… Affected: 6.0 |
| CVE-2004-0205 | – | Aug 6 | Buffer overflow in Microsoft Internet Information Server (IIS) 4.0 allows local users to execute arbitrary code via the redirect function Affected: 4.0 |
| CVE-2003-0223 | – | Jun 9 | Cross-site scripting vulnerability (XSS) in the ASP function responsible for redirection in Microsoft Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers… Affected: 4.0 |
| CVE-2003-0225 | – | Jun 9 | The ASP function Response.AddHeader in Microsoft Internet Information Server (IIS) 4.0 and 5.0 does not limit memory requests when constructing headers, which allow remote… Affected: 4.0 |
| CVE-2002-1695 | – | Dec 31 | Norton Internet Security 2001 opens log files with FILE_SHARE_READ and FILE_SHARE_WRITE permissions, which could allow remote attackers to modify the log file contents while… Affected: 4.0 |
| CVE-2002-1790 | – | Dec 31 | The SMTP service in Microsoft Internet Information Services (IIS) 4.0 and 5.0 allows remote attackers to bypass anti-relaying rules and send spam or spoofed messages via… Affected: 4.0 |
| CVE-2002-1694 | – | Dec 31 | Microsoft Internet Information Server (IIS) 4.0 opens log files with FILE_SHARE_READ and FILE_SHARE_WRITE permissions, which could allow remote attackers to modify the log file… Affected: 4.0; 4.0 |
| CVE-2002-0869 | – | Nov 12 | Unknown vulnerability in the hosting process (dllhost.exe) for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allows remote attackers to gain privileges by executing… Affected: 4.0 |
| CVE-2002-1181 | – | Nov 12 | Multiple cross-site scripting (XSS) vulnerabilities in the administrative web pages for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allow remote attackers to… Affected: 4.0 |
| CVE-2002-0419 | – | Aug 12 | Information leaks in IIS 4 through 5.1 allow remote attackers to obtain potentially sensitive information or more easily conduct brute force attacks via responses from the server… Affected: 4.0; 4.0 |
| CVE-2002-0364 | – | Jul 3 | Buffer overflow in the chunked encoding transfer mechanism in IIS 4.0 and 5.0 allows attackers to execute arbitrary code via the processing of HTR request sessions, aka "Heap… Affected: 4.0 |
| CVE-2002-0071 | – | Apr 22 | Buffer overflow in the ism.dll ISAPI extension that implements HTR scripting in Internet Information Server (IIS) 4.0 and 5.0 allows attackers to cause a denial of service or… Affected: 4.0 |
| CVE-2002-0150 | – | Apr 22 | Buffer overflow in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to spoof the safety check for HTTP headers and cause a denial of service or execute… Affected: 4.0 |
| CVE-2002-0149 | – | Apr 22 | Buffer overflow in ASP Server-Side Include Function in IIS 4.0, 5.0 and 5.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via long file… Affected: 4.0 |
| CVE-2002-0148 | – | Apr 22 | Cross-site scripting vulnerability in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other users via an HTTP error page Affected: 4.0 |
| CVE-2002-0147 | – | Apr 22 | Buffer overflow in the ASP data transfer mechanism in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to cause a denial of service or execute code, aka… Affected: 4.0 |
| CVE-2002-0079 | – | Apr 22 | Buffer overflow in the chunked encoding transfer mechanism in Internet Information Server (IIS) 4.0 and 5.0 Active Server Pages allows attackers to cause a denial of service or… Affected: 4.0 |
| CVE-2002-0075 | – | Apr 22 | Cross-site scripting vulnerability for Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other web users via the error… Affected: 4.0 |
| CVE-2002-0074 | – | Apr 22 | Cross-site scripting vulnerability in Help File search facility for Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to embed scripts into another user's… Affected: 4.0 |
| CVE-2002-0073 | – | Apr 22 | The FTP service in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows attackers who have established an FTP session to cause a denial of service via a specially crafted… Affected: 4.0 |
| CVE-2002-0072 | – | Apr 22 | The w3svc.dll ISAPI filter in Front Page Server Extensions and ASP.NET for Internet Information Server (IIS) 4.0, 5.0, and 5.1 does not properly handle the error condition when a… Affected: 4.0 |
| CVE-2001-0545 | – | Oct 30 | IIS 4.0 with URL redirection enabled allows remote attackers to cause a denial of service (crash) via a malformed request that specifies a length that is different than the actual… Affected: 4.0 |
| CVE-2001-0506 | – | Sep 20 | Buffer overflow in ssinc.dll in IIS 5.0 and 4.0 allows local users to gain system privileges via a Server-Side Includes (SSI) directive for a long filename, which triggers the… Affected: 4.0 |
| CVE-2001-0709 | – | Sep 20 | Microsoft IIS 4.0 and before, when installed on a FAT partition, allows a remote attacker to obtain source code of ASP files via a URL encoded with Unicode Affected: through 4.0 |
| CVE-2001-0500 | – | Jul 21 | Buffer overflow in ISAPI extension (idq.dll) in Index Server 2.0 and Indexing Service 2000 in IIS 6.0 beta and earlier allows remote attackers to execute arbitrary commands via a… Affected: through 6.0 |
| CVE-2001-1243 | – | Jul 4 | Scripting.FileSystemObject in asp.dll for Microsoft IIS 4.0 and 5.0 allows local or remote attackers to cause a denial of service (crash) via (1) creating an ASP program that uses… Affected: 4.0 |
| CVE-2001-0333 | – | Jun 27 | Directory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding Affected: through 5.0; 4.0 |
| CVE-2001-0337 | – | Jun 27 | The Microsoft MS01-014 and MS01-016 patches for IIS 5.0 and earlier introduce a memory leak which allows attackers to cause a denial of service via a series of requests Affected: through 5.0 |
| CVE-2001-0336 | – | Jun 27 | The Microsoft MS00-060 patch for IIS 5.0 and earlier introduces an error which allows attackers to cause a denial of service via a malformed request Affected: through 5.0 |
| CVE-2001-0335 | – | Jun 27 | FTP service in IIS 5.0 and earlier allows remote attackers to enumerate Guest accounts in trusted domains by preceding the username with a special sequence of characters Affected: through 5.0 |
| CVE-2001-0004 | – | Feb 12 | IIS 5.0 and 4.0 allows remote attackers to read the source code for executable web server programs by appending "%3F+.htr" to the requested URL, which causes the files to be… Affected: 4.0 |
| CVE-2001-0096 | – | Feb 12 | FrontPage Server Extensions (FPSE) in IIS 4.0 and 5.0 allows remote attackers to cause a denial of service via a malformed form, aka the "Malformed Web Form Submission"… Affected: 4.0 |
| CVE-2000-1090 | – | Feb 12 | Microsoft IIS for Far East editions 4.0 and 5.0 allows remote attackers to read source code for parsed pages via a malformed URL that uses the lead-byte of a double-byte character Affected: 4.0; 5.0 |
| CVE-2000-1147 | – | Jan 9 | Buffer overflow in IIS ISAPI .ASP parsing mechanism allows attackers to execute arbitrary commands via a long string to the "LANGUAGE" argument in a script tag Affected: 4.0 |
| CVE-2000-1104 | – | Jan 9 | Variant of the "IIS Cross-Site Scripting" vulnerability as originally discussed in MS:MS00-060 (CVE-2000-0746) allows a malicious web site operator to embed scripts in a link to a… Affected: 4.0 |
| CVE-2000-0970 | – | Dec 19 | IIS 4.0 and 5.0 .ASP pages send the same Session ID cookie for secure and insecure web sessions, which could allow remote attackers to hijack the secure web session of the user if… Affected: 4.0 |