SS
Product
Site Server
16
CVEs
0
On KEV
–
Max CVSS
0
New 30D
Severity mix
Critical 0High 0Medium 0Low 0
Watch
Add Site Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2002-1769 | – | Dec 31 | Microsoft Site Server 3.0 prior to SP4 installs a default user, LDAP_Anonymous, with a default password of LdapPassword_1, which allows remote attackers the "Log on locally"… Affected: 3.0; 3.0; 3.0; 3.0; 3.0; 3.0; +2 more |
| CVE-2002-2073 | – | Dec 31 | Cross-site scripting (XSS) vulnerability in the default ASP pages on Microsoft Site Server 3.0 on Windows NT 4.0 allows remote attackers to inject arbitrary web script or HTML via… Affected: 3.0 |
| CVE-2002-2081 | – | Dec 31 | cphost.dll in Microsoft Site Server 3.0 allows remote attackers to cause a denial of service (disk consumption) via an HTTP POST of a file with a long TargetURL parameter, which… Affected: 3.0; 3.0; 3.0; 3.0; 3.0; 3.0; +4 more |
| CVE-2000-0246 | – | Mar 30 | IIS 4.0 and 5.0 does not properly perform ISAPI extension processing if a virtual directory is mapped to a UNC share, which allows remote attackers to read the source code of ASP… Affected: 3.0 |
| CVE-2000-0161 | – | Feb 18 | Sample web sites on Microsoft Site Server 3.0 Commerce Edition do not validate an identification number, which allows remote attackers to execute SQL commands Affected: 3.0 |
| CVE-1999-1451 | – | Dec 31 | The Winmsdp.exe sample file in IIS 4.0 and Site Server 3.0 allows remote attackers to read arbitrary files Affected: 3.0 |
| CVE-1999-1246 | – | Dec 31 | Direct Mailer feature in Microsoft Site Server 3.0 saves user domain names and passwords in plaintext in the TMLBQueue network share, which has insecure default permissions,… Affected: 3.0 |
| CVE-2000-0025 | – | Dec 21 | IIS 4.0 and Site Server 3.0 allow remote attackers to read source code for ASP files if the file is in a virtual directory whose name includes extensions such as .com, .exe, .sh,… Affected: 3.0 |
| CVE-2000-0024 | – | Dec 21 | IIS does not properly canonicalize URLs, potentially allowing remote attackers to bypass access restrictions in third-party software via escape characters, aka the "Escape… Affected: 3.0 |
| CVE-1999-0910 | – | Sep 10 | Microsoft Site Server and Commercial Internet System (MCIS) do not set an expiration for a cookie, which could then be cached by a proxy and inadvertently used by a different user Affected: 3.0 |
| CVE-1999-0867 | – | Aug 11 | Denial of service in IIS 4.0 via a flood of HTTP requests with malformed headers Affected: 3.0 |
| CVE-1999-0861 | – | Aug 11 | Race condition in the SSL ISAPI filter in IIS and other servers may leak information in plaintext Affected: 3.0 |
| CVE-1999-1011 | – | Jul 19 | The Remote Data Service (RDS) DataFactory component of Microsoft Data Access Components (MDAC) in IIS 3.x and 4.x exposes unsafe methods, which allows remote attackers to execute… Affected: 3.0 |
| CVE-1999-1520 | – | May 11 | A configuration problem in the Ad Server Sample directory (AdSamples) in Microsoft Site Server 3.0 allows an attacker to obtain the SITE.CSC file, which exposes sensitive SQL… Affected: 3.0 |
| CVE-1999-0360 | – | Jan 30 | MS Site Server 2.0 with IIS 4 can allow users to upload content, including ASP, to the target web site, thus allowing them to execute commands remotely Affected: 2.0 |
| CVE-1999-0007 | – | Jun 26 | Information from SSL-encrypted sessions via PKCS #1 Affected: 3.0 |
Showing 16