II
Product
Internet Information Services
On CISA KEVExploited in the wild
91
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 3Medium 0Low 0
Watch
Add Internet Information Services to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-7269 In wildKEV | 9.8 | Mar 27 | Microsoft Windows Server Buffer Overflow Vulnerability Affected: 6.0 |
| CVE-2003-1567 | 7.5 | Jan 15 | The undocumented TRACK method in Microsoft Internet Information Services (IIS) 5.0 returns the content of the original request in the body of the response, which makes it easier… Affected: 5.0 |
| CVE-2002-1745 | 7.5 | Dec 31 | Off-by-one error in the CodeBrws.asp sample script in Microsoft IIS 5.0 allows remote attackers to view the source code for files with extensions containing with one additional… Affected: 5.0 |
| CVE-2000-0258 | 7.5 | Apr 12 | IIS 4.0 and 5.0 allows remote attackers to cause a denial of service by sending many URLs with a large number of escaped characters, aka the "Myriad Escaped Characters"… Affected: 5.0 |
| CVE-2014-4078 | – | Nov 11 | The IP Security feature in Microsoft Internet Information Services (IIS) 8.0 and 8.5 does not properly process wildcard allow and deny rules for domains within the "IP Address and… Affected: 8.0; 8.5 |
| CVE-2011-5279 | – | Apr 23 | CRLF injection vulnerability in the CGI implementation in Microsoft Internet Information Services (IIS) 4.x and 5.x on Windows NT and Windows 2000 allows remote attackers to… Affected: 4.0; 5.0 |
| CVE-2010-3972 | – | Dec 23 | Heap-based buffer overflow in the TELNET_STREAM_CONTEXT::OnSendData function in ftpsvc.dll in Microsoft FTP Service 7.0 and 7.5 for Internet Information Services (IIS) 7.0, and… Affected: 7.5 |
| CVE-2010-2730 | – | Sep 15 | Buffer overflow in Microsoft Internet Information Services (IIS) 7.5, when FastCGI is enabled, allows remote attackers to execute arbitrary code via crafted headers in a request,… Affected: 7.5 |
| CVE-2010-1899 | – | Sep 15 | Stack consumption vulnerability in the ASP implementation in Microsoft Internet Information Services (IIS) 5.1, 6.0, 7.0, and 7.5 allows remote attackers to cause a denial of… Affected: 7.5 |
| CVE-2009-4445 | – | Dec 29 | Microsoft Internet Information Services (IIS), when used in conjunction with unspecified third-party upload applications, allows remote attackers to create empty files with… Affected: through 6.0 |
| CVE-2009-4444 | – | Dec 29 | Microsoft Internet Information Services (IIS) 5.x and 6.x uses only the portion of a filename before a ; (semicolon) character to determine the file extension, which allows remote… Affected: 5.0; 6.0 |
| CVE-2009-2521 | – | Sep 4 | Stack consumption vulnerability in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 7.0 allows remote authenticated users to cause a denial of service… Affected: 5.0 through 7.0 |
| CVE-2009-1122 | – | Jun 10 | The WebDAV extension in Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remote attackers to bypass… Affected: 5.0 |
| CVE-2009-1535 | – | Jun 10 | The WebDAV extension in Microsoft Internet Information Services (IIS) 5.1 and 6.0 allows remote attackers to bypass URI-based protection mechanisms, and list folders or read,… Affected: 5.1; 6.0 |
| CVE-2003-1566 | – | Jan 15 | Microsoft Internet Information Services (IIS) 5.0 does not log requests that use the TRACK method, which allows remote attackers to obtain sensitive information without detection Affected: 5.0 |
| CVE-2008-1446 | – | Oct 15 | Integer overflow in the Internet Printing Protocol (IPP) ISAPI extension in Microsoft Internet Information Services (IIS) 5.0 through 7.0 on Windows 2000 SP4, XP SP2 and SP3,… Affected: 5.0 through 7.0 |
| CVE-2008-4301 | – | Sep 29 | A certain ActiveX control in iisext.dll in Microsoft Internet Information Services (IIS) allows remote attackers to set a password via a string argument to the SetPassword method Affected: All versions, or not specified |
| CVE-2008-4300 | – | Sep 29 | A certain ActiveX control in adsiis.dll in Microsoft Internet Information Services (IIS) allows remote attackers to cause a denial of service (browser crash) via a long string in… Affected: All versions, or not specified |
| CVE-2008-0074 | – | Feb 12 | Unspecified vulnerability in Microsoft Internet Information Services (IIS) 5.0 through 7.0 allows local users to gain privileges via unknown vectors related to file change… Affected: 5.0 |
| CVE-2007-2815 | – | May 22 | The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services (IIS) Web Server 5.0 only uses Windows NT ACL configuration, which allows remote… Affected: 5.0 |
| CVE-2006-6579 | – | Dec 15 | Microsoft Windows XP has weak permissions (FILE_WRITE_DATA and FILE_READ_DATA for Everyone) for %WINDIR%\pchealth\ERRORREP\QHEADLES, which allows local users to write and read… Affected: 1.0; 2.0 |
| CVE-2006-6578 | – | Dec 15 | Microsoft Internet Information Services (IIS) 5.1 permits the IUSR_Machine account to execute non-EXE files such as .COM files, which allows attackers to execute arbitrary… Affected: 5.1 |
| CVE-2006-0026 | – | Jul 11 | Buffer overflow in Microsoft Internet Information Services (IIS) 5.0, 5.1, and 6.0 allows local and possibly remote attackers to execute arbitrary code via crafted Active Server… Affected: 5.0 |
| CVE-2005-4360 | – | Dec 20 | The URL parser in Microsoft Internet Information Services (IIS) 5.1 on Windows XP Professional SP2 allows remote attackers to execute arbitrary code via multiple requests to… Affected: 5.1 |
| CVE-2005-2678 | – | Aug 23 | Microsoft IIS 5.1 and 6 allows remote attackers to spoof the SERVER_NAME variable to bypass security checks and conduct various attacks via a GET request with an http://localhost… Affected: 5.0 |
| CVE-2005-2089 | – | Jul 5 | Microsoft IIS 5.0 and 6.0 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a… Affected: 5.0; 6.0 |
| CVE-2003-0718 | – | Nov 3 | The WebDAV Message Handler for Internet Information Services (IIS) 5.0, 5.1, and 6.0 allows remote attackers to cause a denial of service (memory and CPU exhaustion, application… Affected: 5.0 |
| CVE-2003-0224 | – | Jun 9 | Buffer overflow in ssinc.dll for Microsoft Internet Information Services (IIS) 5.0 allows local users to execute arbitrary code via a web page with a Server Side Include (SSI)… Affected: 5.0 |
| CVE-2003-0223 | – | Jun 9 | Cross-site scripting vulnerability (XSS) in the ASP function responsible for redirection in Microsoft Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers… Affected: 5.0 |
| CVE-2003-0226 | – | Jun 9 | Microsoft Internet Information Services (IIS) 5.0 and 5.1 allows remote attackers to cause a denial of service via a long WebDAV request with a (1) PROPFIND or (2) SEARCH method,… Affected: 5.0 |
| CVE-2003-0225 | – | Jun 9 | The ASP function Response.AddHeader in Microsoft Internet Information Server (IIS) 4.0 and 5.0 does not limit memory requests when constructing headers, which allow remote… Affected: 5.0 |
| CVE-2002-1700 | – | Dec 31 | Cross-site scripting vulnerability (XSS) in the missing template handler in Macromedia ColdFusion MX allows remote attackers to execute arbitrary script as other users by… Affected: 5.0 |
| CVE-2002-1694 | – | Dec 31 | Microsoft Internet Information Server (IIS) 4.0 opens log files with FILE_SHARE_READ and FILE_SHARE_WRITE permissions, which could allow remote attackers to modify the log file… Affected: 5.0 |
| CVE-2002-1695 | – | Dec 31 | Norton Internet Security 2001 opens log files with FILE_SHARE_READ and FILE_SHARE_WRITE permissions, which could allow remote attackers to modify the log file contents while… Affected: 5.0 |
| CVE-2002-1908 | – | Dec 31 | Microsoft IIS 5.0 and 5.1 allows remote attackers to cause a denial of service (CPU consumption) via an HTTP request with a Host header that contains a large number of "/"… Affected: 5.0 |
| CVE-2002-1790 | – | Dec 31 | The SMTP service in Microsoft Internet Information Services (IIS) 4.0 and 5.0 allows remote attackers to bypass anti-relaying rules and send spam or spoofed messages via… Affected: 5.0 |
| CVE-2002-1744 | – | Dec 31 | Directory traversal vulnerability in CodeBrws.asp in Microsoft IIS 5.0 allows remote attackers to view source code and determine the existence of arbitrary files via a hex-encoded… Affected: 5.0 |
| CVE-2002-1718 | – | Dec 31 | Microsoft Internet Information Server (IIS) 5.1 may allow remote attackers to view the contents of a Frontpage Server Extension (FPSE) file, as claimed using an HTTP request for… Affected: 5.1 |
| CVE-2002-1717 | – | Dec 31 | Microsoft Internet Information Server (IIS) 5.1 allows remote attackers to view path information via a GET request to (1) /_vti_pvt/access.cnf, (2) /_vti_pvt/botinfs.cnf, (3)… Affected: 5.1 |
| CVE-2002-1180 | – | Nov 12 | A typographical error in the script source access permissions for Internet Information Server (IIS) 5.0 does not properly exclude .COM files, which allows attackers with only… Affected: 5.0 |
| CVE-2002-1182 | – | Nov 12 | IIS 5.0 and 5.1 allows remote attackers to cause a denial of service (crash) via malformed WebDAV requests that cause a large amount of memory to be assigned Affected: 5.0 |
| CVE-2002-1181 | – | Nov 12 | Multiple cross-site scripting (XSS) vulnerabilities in the administrative web pages for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allow remote attackers to… Affected: 5.0 |
| CVE-2002-0869 | – | Nov 12 | Unknown vulnerability in the hosting process (dllhost.exe) for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allows remote attackers to gain privileges by executing… Affected: 5.0 |
| CVE-2002-0422 | – | Aug 12 | IIS 5 and 5.1 supporting WebDAV methods allows remote attackers to determine the internal IP address of the system (which may be obscured by NAT) via (1) a PROPFIND HTTP request… Affected: 5.0 |
| CVE-2002-0419 | – | Aug 12 | Information leaks in IIS 4 through 5.1 allow remote attackers to obtain potentially sensitive information or more easily conduct brute force attacks via responses from the server… Affected: 5.0 |
| CVE-2002-0364 | – | Jul 3 | Buffer overflow in the chunked encoding transfer mechanism in IIS 4.0 and 5.0 allows attackers to execute arbitrary code via the processing of HTR request sessions, aka "Heap… Affected: 5.0 |
| CVE-2002-0224 | – | May 16 | The MSDTC (Microsoft Distributed Transaction Service Coordinator) for Microsoft Windows 2000, Microsoft IIS 5.0 and SQL Server 6.5 through SQL 2000 0.0 allows remote attackers to… Affected: 5.0 |
| CVE-2002-0150 | – | Apr 22 | Buffer overflow in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to spoof the safety check for HTTP headers and cause a denial of service or execute… Affected: 5.0 |
| CVE-2002-0071 | – | Apr 22 | Buffer overflow in the ism.dll ISAPI extension that implements HTR scripting in Internet Information Server (IIS) 4.0 and 5.0 allows attackers to cause a denial of service or… Affected: 5.0 |
| CVE-2002-0072 | – | Apr 22 | The w3svc.dll ISAPI filter in Front Page Server Extensions and ASP.NET for Internet Information Server (IIS) 4.0, 5.0, and 5.1 does not properly handle the error condition when a… Affected: 5.0 |