Internet Information Services (Microsoft) - vulnerabilities (CVEs)

91 CVEs, 0 in the last 30 days, 13 known versions, newest CVE from 2017-03-27. Vendor: Microsoft.

CVEs of Internet Information Services

CVE-2017-7269 - CVSS 9.8 (critical), 2017-03-27: Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2…
CVE-2014-4078 - CVSS 5.1 (medium), 2014-11-11: The IP Security feature in Microsoft Internet Information Services (IIS) 8.0 and 8.5 does not properly process wildcard allow and deny rules for domains…
CVE-2011-5279 - CVSS 5 (medium), 2014-04-23: CRLF injection vulnerability in the CGI implementation in Microsoft Internet Information Services (IIS) 4.x and 5.x on Windows NT and Windows 2000 allows…
CVE-2010-3972 - CVSS 10 (critical), 2010-12-23: Heap-based buffer overflow in the TELNET_STREAM_CONTEXT::OnSendData function in ftpsvc.dll in Microsoft FTP Service 7.0 and 7.5 for Internet Information…
CVE-2010-2730 - CVSS 9.3 (critical), 2010-09-15: Buffer overflow in Microsoft Internet Information Services (IIS) 7.5, when FastCGI is enabled, allows remote attackers to execute arbitrary code via crafted…
CVE-2010-1899 - CVSS 4.3 (medium), 2010-09-15: Stack consumption vulnerability in the ASP implementation in Microsoft Internet Information Services (IIS) 5.1, 6.0, 7.0, and 7.5 allows remote attackers to…
CVE-2009-4444 - CVSS 6 (medium), 2009-12-29: Microsoft Internet Information Services (IIS) 5.x and 6.x uses only the portion of a filename before a ; (semicolon) character to determine the file…
CVE-2009-4445 - CVSS 6 (medium), 2009-12-29: Microsoft Internet Information Services (IIS), when used in conjunction with unspecified third-party upload applications, allows remote attackers to create…
CVE-2009-2521 - CVSS 5 (medium), 2009-09-04: Stack consumption vulnerability in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 7.0 allows remote authenticated users to cause…
CVE-2009-1122 - CVSS 7.5 (high), 2009-06-10: The WebDAV extension in Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remote attackers to…
CVE-2009-1535 - CVSS 7.5 (high), 2009-06-10: The WebDAV extension in Microsoft Internet Information Services (IIS) 5.1 and 6.0 allows remote attackers to bypass URI-based protection mechanisms, and list…
CVE-2003-1567 - CVSS 7.5 (high), 2009-01-15: The undocumented TRACK method in Microsoft Internet Information Services (IIS) 5.0 returns the content of the original request in the body of the response,…
CVE-2003-1566 - CVSS 5 (medium), 2009-01-15: Microsoft Internet Information Services (IIS) 5.0 does not log requests that use the TRACK method, which allows remote attackers to obtain sensitive…
CVE-2008-1446 - CVSS 9 (critical), 2008-10-15: Integer overflow in the Internet Printing Protocol (IPP) ISAPI extension in Microsoft Internet Information Services (IIS) 5.0 through 7.0 on Windows 2000 SP4,…
CVE-2008-4301 - CVSS 10 (critical), 2008-09-29: A certain ActiveX control in iisext.dll in Microsoft Internet Information Services (IIS) allows remote attackers to set a password via a string argument to…
CVE-2008-4300 - CVSS 5 (medium), 2008-09-29: A certain ActiveX control in adsiis.dll in Microsoft Internet Information Services (IIS) allows remote attackers to cause a denial of service (browser crash)…
CVE-2008-0074 - CVSS 7.2 (high), 2008-02-12: Unspecified vulnerability in Microsoft Internet Information Services (IIS) 5.0 through 7.0 allows local users to gain privileges via unknown vectors related…
CVE-2007-2815 - CVSS 10 (critical), 2007-05-22: The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services (IIS) Web Server 5.0 only uses Windows NT ACL configuration,…
CVE-2006-6579 - CVSS 4.4 (medium), 2006-12-15: Microsoft Windows XP has weak permissions (FILE_WRITE_DATA and FILE_READ_DATA for Everyone) for %WINDIR%\pchealth\ERRORREP\QHEADLES, which allows local users…
CVE-2006-6578 - CVSS 7.5 (high), 2006-12-15: Microsoft Internet Information Services (IIS) 5.1 permits the IUSR_Machine account to execute non-EXE files such as .COM files, which allows attackers to…
CVE-2006-0026 - CVSS 6.5 (medium), 2006-07-11: Buffer overflow in Microsoft Internet Information Services (IIS) 5.0, 5.1, and 6.0 allows local and possibly remote attackers to execute arbitrary code via…
CVE-2005-4360 - CVSS 7.8 (high), 2005-12-20: The URL parser in Microsoft Internet Information Services (IIS) 5.1 on Windows XP Professional SP2 allows remote attackers to execute arbitrary code via…
CVE-2005-2678 - CVSS 5 (medium), 2005-08-23: Microsoft IIS 5.1 and 6 allows remote attackers to spoof the SERVER_NAME variable to bypass security checks and conduct various attacks via a GET request with…
CVE-2005-2089 - CVSS 4.3 (medium), 2005-07-05: Microsoft IIS 5.0 and 6.0 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP…
CVE-2003-0718 - CVSS 5 (medium), 2004-11-03: The WebDAV Message Handler for Internet Information Services (IIS) 5.0, 5.1, and 6.0 allows remote attackers to cause a denial of service (memory and CPU…
CVE-2003-0224 - CVSS 10 (critical), 2003-06-09: Buffer overflow in ssinc.dll for Microsoft Internet Information Services (IIS) 5.0 allows local users to execute arbitrary code via a web page with a Server…
CVE-2003-0223 - CVSS 6.8 (medium), 2003-06-09: Cross-site scripting vulnerability (XSS) in the ASP function responsible for redirection in Microsoft Internet Information Server (IIS) 4.0, 5.0, and 5.1…
CVE-2003-0226 - CVSS 5 (medium), 2003-06-09: Microsoft Internet Information Services (IIS) 5.0 and 5.1 allows remote attackers to cause a denial of service via a long WebDAV request with a (1) PROPFIND…
CVE-2003-0225 - CVSS 5 (medium), 2003-06-09: The ASP function Response.AddHeader in Microsoft Internet Information Server (IIS) 4.0 and 5.0 does not limit memory requests when constructing headers, which…
CVE-2002-1695 - CVSS 5 (medium), 2002-12-31: Norton Internet Security 2001 opens log files with FILE_SHARE_READ and FILE_SHARE_WRITE permissions, which could allow remote attackers to modify the log file…
CVE-2002-1718 - CVSS 5 (medium), 2002-12-31: Microsoft Internet Information Server (IIS) 5.1 may allow remote attackers to view the contents of a Frontpage Server Extension (FPSE) file, as claimed using…
CVE-2002-1790 - CVSS 5 (medium), 2002-12-31: The SMTP service in Microsoft Internet Information Services (IIS) 4.0 and 5.0 allows remote attackers to bypass anti-relaying rules and send spam or spoofed…
CVE-2002-1694 - CVSS 5 (medium), 2002-12-31: Microsoft Internet Information Server (IIS) 4.0 opens log files with FILE_SHARE_READ and FILE_SHARE_WRITE permissions, which could allow remote attackers to…
CVE-2002-1717 - CVSS 5 (medium), 2002-12-31: Microsoft Internet Information Server (IIS) 5.1 allows remote attackers to view path information via a GET request to (1) /_vti_pvt/access.cnf, (2)…
CVE-2002-1745 - CVSS 7.5 (high), 2002-12-31: Off-by-one error in the CodeBrws.asp sample script in Microsoft IIS 5.0 allows remote attackers to view the source code for files with extensions containing…
CVE-2002-1700 - CVSS 4.3 (medium), 2002-12-31: Cross-site scripting vulnerability (XSS) in the missing template handler in Macromedia ColdFusion MX allows remote attackers to execute arbitrary script as…
CVE-2002-1744 - CVSS 5 (medium), 2002-12-31: Directory traversal vulnerability in CodeBrws.asp in Microsoft IIS 5.0 allows remote attackers to view source code and determine the existence of arbitrary…
CVE-2002-1908 - CVSS 5 (medium), 2002-12-31: Microsoft IIS 5.0 and 5.1 allows remote attackers to cause a denial of service (CPU consumption) via an HTTP request with a Host header that contains a large…
CVE-2002-1181 - CVSS 6.8 (medium), 2002-11-12: Multiple cross-site scripting (XSS) vulnerabilities in the administrative web pages for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allow…
CVE-2002-1180 - CVSS 7.5 (high), 2002-11-12: A typographical error in the script source access permissions for Internet Information Server (IIS) 5.0 does not properly exclude .COM files, which allows…
CVE-2002-0869 - CVSS 7.5 (high), 2002-11-12: Unknown vulnerability in the hosting process (dllhost.exe) for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allows remote attackers to gain…
CVE-2002-1182 - CVSS 5 (medium), 2002-11-12: IIS 5.0 and 5.1 allows remote attackers to cause a denial of service (crash) via malformed WebDAV requests that cause a large amount of memory to be assigned.
CVE-2002-0419 - CVSS 5 (medium), 2002-08-12: Information leaks in IIS 4 through 5.1 allow remote attackers to obtain potentially sensitive information or more easily conduct brute force attacks via…
CVE-2002-0422 - CVSS 2.6 (low), 2002-08-12: IIS 5 and 5.1 supporting WebDAV methods allows remote attackers to determine the internal IP address of the system (which may be obscured by NAT) via (1) a…
CVE-2002-0364 - CVSS 7.5 (high), 2002-07-03: Buffer overflow in the chunked encoding transfer mechanism in IIS 4.0 and 5.0 allows attackers to execute arbitrary code via the processing of HTR request…
CVE-2002-0224 - CVSS 5 (medium), 2002-05-16: The MSDTC (Microsoft Distributed Transaction Service Coordinator) for Microsoft Windows 2000, Microsoft IIS 5.0 and SQL Server 6.5 through SQL 2000 0.0 allows…
CVE-2002-0071 - CVSS 7.5 (high), 2002-04-22: Buffer overflow in the ism.dll ISAPI extension that implements HTR scripting in Internet Information Server (IIS) 4.0 and 5.0 allows attackers to cause a…
CVE-2002-0074 - CVSS 7.5 (high), 2002-04-22: Cross-site scripting vulnerability in Help File search facility for Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to embed…
CVE-2002-0147 - CVSS 7.5 (high), 2002-04-22: Buffer overflow in the ASP data transfer mechanism in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to cause a denial of service…
CVE-2002-0150 - CVSS 7.5 (high), 2002-04-22: Buffer overflow in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to spoof the safety check for HTTP headers and cause a denial…
CVE-2002-0073 - CVSS 5 (medium), 2002-04-22: The FTP service in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows attackers who have established an FTP session to cause a denial of service via a…
CVE-2002-0079 - CVSS 7.5 (high), 2002-04-22: Buffer overflow in the chunked encoding transfer mechanism in Internet Information Server (IIS) 4.0 and 5.0 Active Server Pages allows attackers to cause a…
CVE-2002-0149 - CVSS 7.5 (high), 2002-04-22: Buffer overflow in ASP Server-Side Include Function in IIS 4.0, 5.0 and 5.1 allows remote attackers to cause a denial of service and possibly execute…
CVE-2002-0072 - CVSS 5 (medium), 2002-04-22: The w3svc.dll ISAPI filter in Front Page Server Extensions and ASP.NET for Internet Information Server (IIS) 4.0, 5.0, and 5.1 does not properly handle the…
CVE-2002-0075 - CVSS 7.5 (high), 2002-04-22: Cross-site scripting vulnerability for Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other web…
CVE-2002-0148 - CVSS 7.5 (high), 2002-04-22: Cross-site scripting vulnerability in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other users…
CVE-2001-1186 - CVSS 5 (medium), 2001-12-11: Microsoft IIS 5.0 allows remote attackers to cause a denial of service via an HTTP request with a content-length value that is larger than the size of the…
CVE-2001-0902 - CVSS 7.5 (high), 2001-11-20: Microsoft IIS 5.0 allows remote attackers to spoof web log entries via an HTTP request that includes hex-encoded newline or form-feed characters.
CVE-2001-0544 - CVSS 2.1 (low), 2001-10-30: IIS 5.0 allows local users to cause a denial of service (hang) via by installing content that produces a certain invalid MIME Content-Type header, which…
CVE-2001-0508 - CVSS 5 (medium), 2001-09-20: Vulnerability in IIS 5.0 allows remote attackers to cause a denial of service (restart) via a long, invalid WebDAV request.
CVE-2001-0507 - CVSS 7.2 (high), 2001-09-20: IIS 5.0 uses relative paths to find system files that will run in-process, which allows local users to gain privileges via a Trojan horse file, aka the…
CVE-2001-0506 - CVSS 7.2 (high), 2001-09-20: Buffer overflow in ssinc.dll in IIS 5.0 and 4.0 allows local users to gain system privileges via a Server-Side Includes (SSI) directive for a long filename,…
CVE-2001-1243 - CVSS 5 (medium), 2001-07-04: Scripting.FileSystemObject in asp.dll for Microsoft IIS 4.0 and 5.0 allows local or remote attackers to cause a denial of service (crash) via (1) creating an…
CVE-2001-0151 - CVSS 5 (medium), 2001-06-02: IIS 5.0 allows remote attackers to cause a denial of service via a series of malformed WebDAV requests.
CVE-2001-0146 - CVSS 5 (medium), 2001-06-02: IIS 5.0 and Microsoft Exchange 2000 allow remote attackers to cause a denial of service (memory allocation error) by repeatedly sending a series of specially…
CVE-2001-0096 - CVSS 5 (medium), 2001-02-12: FrontPage Server Extensions (FPSE) in IIS 4.0 and 5.0 allows remote attackers to cause a denial of service via a malformed form, aka the "Malformed Web Form…
CVE-2001-0004 - CVSS 5 (medium), 2001-02-12: IIS 5.0 and 4.0 allows remote attackers to read the source code for executable web server programs by appending "%3F+.htr" to the requested URL, which causes…
CVE-2000-1104 - CVSS 7.5 (high), 2001-01-09: Variant of the "IIS Cross-Site Scripting" vulnerability as originally discussed in MS:MS00-060 (CVE-2000-0746) allows a malicious web site operator to embed…
CVE-2000-0884 - CVSS 7.5 (high), 2000-12-19: IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary commands, via malformed URLs that contain…
CVE-2000-0970 - CVSS 7.5 (high), 2000-12-19: IIS 4.0 and 5.0 .ASP pages send the same Session ID cookie for secure and insecure web sessions, which could allow remote attackers to hijack the secure web…
CVE-2000-0951 - CVSS 5 (medium), 2000-12-19: A misconfiguration in IIS 5.0 with Index Server enabled and the Index property set allows remote attackers to list directories in the web root via a Web…
CVE-2000-0886 - CVSS 7.5 (high), 2000-12-19: IIS 5.0 allows remote attackers to execute arbitrary commands via a malformed request for an executable file whose name is appended with operating system…
CVE-2000-0778 - CVSS 5 (medium), 2000-10-20: IIS 5.0 allows remote attackers to obtain source code for .ASP files and other scripts via an HTTP GET request with a "Translate: f" header, aka the…
CVE-2000-0770 - CVSS 6.4 (medium), 2000-10-20: IIS 4.0 and 5.0 does not properly restrict access to certain types of files when their parent folders have less restrictive permissions, which could allow…
CVE-2000-0746 - CVSS 7.5 (high), 2000-10-20: Vulnerabilities in IIS 4.0 and 5.0 do not properly protect against cross-site scripting (CSS) attacks. They allow a malicious web site operator to embed…
CVE-2000-0630 - CVSS 5 (medium), 2000-07-17: IIS 4.0 and 5.0 allows remote attackers to obtain fragments of source code by appending a +.htr to the URL, a variant of the "File Fragment Reading via .HTR"…
CVE-2000-0631 - CVSS 5 (medium), 2000-07-14: An administrative script from IIS 3.0, later included in IIS 4.0 and 5.0, allows remote attackers to cause a denial of service by accessing the script without…
CVE-2000-0649 - CVSS 2.6 (low), 2000-07-13: IIS 4.0 allows remote attackers to obtain the internal IP address of the server via an HTTP 1.0 request for a web page which is protected by basic…
CVE-2000-0457 - CVSS 7.5 (high), 2000-05-11: ISM.DLL in IIS 4.0 and 5.0 allows remote attackers to read file contents by requesting the file and appending a large number of encoded spaces (%20) and…
CVE-2000-0408 - CVSS 5 (medium), 2000-05-11: IIS 4.05 and 5.0 allow remote attackers to cause a denial of service via a long, complex URL that appears to contain a large number of file extensions, aka…
CVE-2000-0304 - CVSS 5 (medium), 2000-05-10: Microsoft IIS 4.0 and 5.0 with the IISADMPWD virtual directory installed allows a remote attacker to cause a denial of service via a malformed request to the…
CVE-2000-0413 - CVSS 5 (medium), 2000-05-06: The shtml.exe program in the FrontPage extensions package of IIS 4.0 and 5.0 allows remote attackers to determine the physical path of HTML, HTM, ASP, and…
CVE-2000-0258 - CVSS 7.5 (high), 2000-04-12: IIS 4.0 and 5.0 allows remote attackers to cause a denial of service by sending many URLs with a large number of escaped characters, aka the "Myriad Escaped…
CVE-2000-0246 - CVSS 5 (medium), 2000-03-30: IIS 4.0 and 5.0 does not properly perform ISAPI extension processing if a virtual directory is mapped to a UNC share, which allows remote attackers to read…
CVE-2000-0071 - CVSS 5 (medium), 2000-01-11: IIS 4.0 allows a remote attacker to obtain the real pathname of the document root by requesting non-existent files with .ida or .idq extensions.
CVE-1999-0154 - CVSS 5 (medium), 1999-12-31: IIS 2.0 and 3.0 allows remote attackers to read the source code for ASP pages by appending a . (dot) to the end of the URL.
CVE-1999-0412 - CVSS 7.5 (high), 1999-02-19: In IIS and other web servers, an attacker can attack commands as SYSTEM if the server is running as SYSTEM and loading an ISAPI extension.
CVE-1999-0450 - CVSS 7.5 (high), 1999-01-26: In IIS, an attacker could determine a real path using a request for a non-existent URL that would be interpreted by Perl (perl.exe).
CVE-1999-0281 - CVSS 5 (medium), 1997-06-01: Denial of service in IIS using long URLs.
CVE-1999-0253 - CVSS 7.5 (high), 1997-01-01: IIS 3.0 with the iis-fix hotfix installed allows remote intruders to read source code for ASP programs by using a %2e instead of a . (dot) in the URL.
CVE-1999-0233 - CVSS 10 (critical), 1996-02-25: IIS 1.0 allows users to execute arbitrary commands using .bat or .cmd files.