II
Product
Internet Information Server
107
CVEs
0
On KEV
7.5
Max CVSS
0
New 30D
Severity mix
Critical 0High 3Medium 0Low 0
Watch
Add Internet Information Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2000-0886 | – | Dec 19 | IIS 5.0 allows remote attackers to execute arbitrary commands via a malformed request for an executable file whose name is appended with operating system commands, aka the "Web… Affected: 4.0 |
| CVE-2000-0884 | – | Dec 19 | IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary commands, via malformed URLs that contain UNICODE encoded… Affected: 4.0 |
| CVE-2000-0858 | – | Nov 14 | Vulnerability in Microsoft Windows NT 4.0 allows remote attackers to cause a denial of service in IIS by sending it a series of malformed requests which cause INETINFO.EXE to… Affected: 4.0 |
| CVE-2000-0770 | – | Oct 20 | IIS 4.0 and 5.0 does not properly restrict access to certain types of files when their parent folders have less restrictive permissions, which could allow remote attackers to… Affected: 4.0 |
| CVE-2000-0746 | – | Oct 20 | Vulnerabilities in IIS 4.0 and 5.0 do not properly protect against cross-site scripting (CSS) attacks Affected: 4.0 |
| CVE-2000-0630 | – | Jul 17 | IIS 4.0 and 5.0 allows remote attackers to obtain fragments of source code by appending a +.htr to the URL, a variant of the "File Fragment Reading via .HTR" vulnerability Affected: 4.0 |
| CVE-2000-0631 | – | Jul 14 | An administrative script from IIS 3.0, later included in IIS 4.0 and 5.0, allows remote attackers to cause a denial of service by accessing the script without a particular… Affected: 3.0; 4.0 |
| CVE-2000-0649 | – | Jul 13 | IIS 4.0 allows remote attackers to obtain the internal IP address of the server via an HTTP 1.0 request for a web page which is protected by basic authentication and has no realm… Affected: 3.0; 4.0 |
| CVE-2000-0457 | – | May 11 | ISM.DLL in IIS 4.0 and 5.0 allows remote attackers to read file contents by requesting the file and appending a large number of encoded spaces (%20) and terminated with a .htr… Affected: 4.0 |
| CVE-2000-0408 | – | May 11 | IIS 4.05 and 5.0 allow remote attackers to cause a denial of service via a long, complex URL that appears to contain a large number of file extensions, aka the "Malformed… Affected: 4.0 |
| CVE-2000-0304 | – | May 10 | Microsoft IIS 4.0 and 5.0 with the IISADMPWD virtual directory installed allows a remote attacker to cause a denial of service via a malformed request to the inetinfo.exe program,… Affected: 4.0 |
| CVE-2000-0413 | – | May 6 | The shtml.exe program in the FrontPage extensions package of IIS 4.0 and 5.0 allows remote attackers to determine the physical path of HTML, HTM, ASP, and SHTML files by… Affected: 4.0 |
| CVE-2000-0246 | – | Mar 30 | IIS 4.0 and 5.0 does not properly perform ISAPI extension processing if a virtual directory is mapped to a UNC share, which allows remote attackers to read the source code of ASP… Affected: 4.0 |
| CVE-2000-0226 | – | Mar 20 | IIS 4.0 allows attackers to cause a denial of service by requesting a large buffer in a POST or PUT command which consumes memory, aka the "Chunked Transfer Encoding Buffer… Affected: 4.0 |
| CVE-2000-0167 | – | Feb 15 | IIS Inetinfo.exe allows local users to cause a denial of service by creating a mail file with a long name and a .txt.eml extension in the pickup directory Affected: 4.0 |
| CVE-2000-0114 | – | Feb 2 | Frontpage Server Extensions allows remote attackers to determine the name of the anonymous account via an RPC POST request to shtml.dll in the /_vti_bin/ virtual directory Affected: 3.0; 4.0 |
| CVE-2000-0126 | – | Jan 26 | Sample Internet Data Query (IDQ) scripts in IIS 3 and 4 allow remote attackers to read files via a Affected: 3.0; 4.0 |
| CVE-2000-0115 | – | Jan 21 | IIS allows local users to cause a denial of service via invalid regular expressions in a Visual Basic script in an ASP page Affected: All versions, or not specified |
| CVE-2000-0071 | – | Jan 11 | IIS 4.0 allows a remote attacker to obtain the real pathname of the document root by requesting non-existent files with .ida or .idq extensions Affected: 3.0; 4.0 |
| CVE-1999-1035 | – | Dec 31 | IIS 3.0 and 4.0 on x86 and Alpha allows remote attackers to cause a denial of service (hang) via a malformed GET request, aka the IIS "GET" vulnerability Affected: 3.0; 4.0 |
| CVE-1999-1591 | – | Dec 31 | Microsoft Internet Information Services (IIS) server 4.0 SP4, without certain hotfixes released for SP4, does not require authentication credentials under certain conditions,… Affected: 4.0 |
| CVE-1999-1451 | – | Dec 31 | The Winmsdp.exe sample file in IIS 4.0 and Site Server 3.0 allows remote attackers to read arbitrary files Affected: 4.0 |
| CVE-1999-1233 | – | Dec 31 | IIS 4.0 does not properly restrict access for the initial session request from a user's IP address if the address does not resolve to a DNS domain, aka the "Domain Resolution"… Affected: 4.0 |
| CVE-1999-1223 | – | Dec 31 | IIS 3.0 allows remote attackers to cause a denial of service via a request to an ASP page in which the URL contains a large number of / (forward slash) characters Affected: 3.0 |
| CVE-1999-1148 | – | Dec 31 | FTP service in IIS 4.0 and earlier allows remote attackers to cause a denial of service (resource exhaustion) via many passive (PASV) connections at the same time Affected: through 4.0 |
| CVE-1999-0154 | – | Dec 31 | IIS 2.0 and 3.0 allows remote attackers to read the source code for ASP pages by appending a Affected: 3.0 |
| CVE-2000-0025 | – | Dec 21 | IIS 4.0 and Site Server 3.0 allow remote attackers to read source code for ASP files if the file is in a virtual directory whose name includes extensions such as .com, .exe, .sh,… Affected: 4.0 |
| CVE-2000-0024 | – | Dec 21 | IIS does not properly canonicalize URLs, potentially allowing remote attackers to bypass access restrictions in third-party software via escape characters, aka the "Escape… Affected: 4.0 |
| CVE-1999-0777 | – | Sep 23 | IIS FTP servers may allow a remote attacker to read or delete files on the server, even if they have "No Access" permissions Affected: 4.0 |
| CVE-1999-0725 | – | Aug 19 | When IIS is run with a default language of Chinese, Korean, or Japanese, it allows a remote attacker to view the source code of certain files, a.k.a Affected: 3.0; 3.0; 3.0; 4.0; 4.0; 4.0 |
| CVE-1999-0867 | – | Aug 11 | Denial of service in IIS 4.0 via a flood of HTTP requests with malformed headers Affected: 4.0 |
| CVE-1999-0861 | – | Aug 11 | Race condition in the SSL ISAPI filter in IIS and other servers may leak information in plaintext Affected: 4.0 |
| CVE-1999-1011 | – | Jul 19 | The Remote Data Service (RDS) DataFactory component of Microsoft Data Access Components (MDAC) in IIS 3.x and 4.x exposes unsafe methods, which allows remote attackers to execute… Affected: 3.0; 4.0 |
| CVE-1999-1537 | – | Jul 7 | IIS 3.x and 4.x does not distinguish between pages requiring encryption and those that do not, which allows remote attackers to cause a denial of service (resource exhaustion) via… Affected: 3.0; 4.0 |
| CVE-1999-1478 | – | Jul 6 | The Sun HotSpot Performance Engine VM allows a remote attacker to cause a denial of service on any server running HotSpot via a URL that includes the [ character Affected: 3.0; 4.0 |
| CVE-1999-0874 | – | Jun 16 | Buffer overflow in IIS 4.0 allows remote attackers to cause a denial of service via a malformed request for files with .HTR, .IDC, or .STM extensions Affected: 4.0 |
| CVE-1999-0229 | – | May 12 | Denial of service in Windows NT IIS server using ..\ Affected: All versions, or not specified |
| CVE-1999-0736 | – | May 7 | The showcode.asp sample file in IIS and Site Server allows remote attackers to read arbitrary files Affected: 4.0 |
| CVE-1999-0739 | – | May 7 | The codebrws.asp sample file in IIS and Site Server allows remote attackers to read arbitrary files Affected: 4.0 |
| CVE-1999-0738 | – | May 7 | The code.asp sample file in IIS and Site Server allows remote attackers to read arbitrary files Affected: 4.0 |
| CVE-1999-0737 | – | May 7 | The viewcode.asp sample file in IIS and Site Server allows remote attackers to read arbitrary files Affected: 4.0 |
| CVE-1999-0412 | – | Feb 19 | In IIS and other web servers, an attacker can attack commands as SYSTEM if the server is running as SYSTEM and loading an ISAPI extension Affected: 3.0; 4.0 |
| CVE-1999-1375 | – | Feb 11 | FileSystemObject (FSO) in the showfile.asp Active Server Page (ASP) allows remote attackers to read arbitrary files by specifying the name in the file parameter Affected: 3.0; 4.0 |
| CVE-1999-0407 | – | Feb 9 | By default, IIS 4.0 has a virtual directory /IISADMPWD which contains files that can be used as proxies for brute force password attacks, or to identify valid users on the system Affected: 4.0 |
| CVE-1999-0349 | – | Jan 27 | A buffer overflow in the FTP list (ls) command in IIS allows remote attackers to conduct a denial of service and, in some cases, execute arbitrary commands Affected: 3.0; 4.0 |
| CVE-1999-0348 | – | Jan 27 | IIS ASP caching problem releases sensitive information when two virtual servers share the same physical directory Affected: 4.0 |
| CVE-1999-0449 | – | Jan 26 | The ExAir sample site in IIS 4 allows remote attackers to cause a denial of service (CPU consumption) via a direct request to the (1) advsearch.asp, (2) query.asp, or (3)… Affected: 4.0 |
| CVE-1999-0450 | – | Jan 26 | In IIS, an attacker could determine a real path using a request for a non-existent URL that would be interpreted by Perl (perl.exe) Affected: 3.0; 4.0 |
| CVE-1999-1544 | – | Jan 24 | Buffer overflow in FTP server in Microsoft IIS 3.0 and 4.0 allows local and sometimes remote attackers to cause a denial of service via a long NLST (ls) command Affected: 3.0; 4.0 |
| CVE-1999-1538 | – | Jan 14 | When IIS 2 or 3 is upgraded to IIS 4, ism.dll is inadvertently left in /scripts/iisadmin, which does not restrict access to the local machine and allows an unauthorized user to… Affected: 4.0 |