II
Product
Internet Information Services
On CISA KEVExploited in the wild
91
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 3Medium 0Low 0
Watch
Add Internet Information Services to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2002-0073 | – | Apr 22 | The FTP service in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows attackers who have established an FTP session to cause a denial of service via a specially crafted… Affected: 5.0 |
| CVE-2002-0074 | – | Apr 22 | Cross-site scripting vulnerability in Help File search facility for Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to embed scripts into another user's… Affected: 5.0 |
| CVE-2002-0075 | – | Apr 22 | Cross-site scripting vulnerability for Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other web users via the error… Affected: 5.0 |
| CVE-2002-0079 | – | Apr 22 | Buffer overflow in the chunked encoding transfer mechanism in Internet Information Server (IIS) 4.0 and 5.0 Active Server Pages allows attackers to cause a denial of service or… Affected: 5.0 |
| CVE-2002-0147 | – | Apr 22 | Buffer overflow in the ASP data transfer mechanism in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to cause a denial of service or execute code, aka… Affected: 5.0 |
| CVE-2002-0148 | – | Apr 22 | Cross-site scripting vulnerability in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other users via an HTTP error page Affected: 5.0 |
| CVE-2002-0149 | – | Apr 22 | Buffer overflow in ASP Server-Side Include Function in IIS 4.0, 5.0 and 5.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via long file… Affected: 5.0 |
| CVE-2001-1186 | – | Dec 11 | Microsoft IIS 5.0 allows remote attackers to cause a denial of service via an HTTP request with a content-length value that is larger than the size of the request, which prevents… Affected: 5.0 |
| CVE-2001-0902 | – | Nov 20 | Microsoft IIS 5.0 allows remote attackers to spoof web log entries via an HTTP request that includes hex-encoded newline or form-feed characters Affected: 5.0 |
| CVE-2001-0544 | – | Oct 30 | IIS 5.0 allows local users to cause a denial of service (hang) via by installing content that produces a certain invalid MIME Content-Type header, which corrupts the File Type… Affected: 5.0 |
| CVE-2001-0508 | – | Sep 20 | Vulnerability in IIS 5.0 allows remote attackers to cause a denial of service (restart) via a long, invalid WebDAV request Affected: 5.0 |
| CVE-2001-0507 | – | Sep 20 | IIS 5.0 uses relative paths to find system files that will run in-process, which allows local users to gain privileges via a Trojan horse file, aka the "System file listing… Affected: 5.0 |
| CVE-2001-0506 | – | Sep 20 | Buffer overflow in ssinc.dll in IIS 5.0 and 4.0 allows local users to gain system privileges via a Server-Side Includes (SSI) directive for a long filename, which triggers the… Affected: 5.0 |
| CVE-2001-1243 | – | Jul 4 | Scripting.FileSystemObject in asp.dll for Microsoft IIS 4.0 and 5.0 allows local or remote attackers to cause a denial of service (crash) via (1) creating an ASP program that uses… Affected: 5.0 |
| CVE-2001-0151 | – | Jun 2 | IIS 5.0 allows remote attackers to cause a denial of service via a series of malformed WebDAV requests Affected: 5.0 |
| CVE-2001-0146 | – | Jun 2 | IIS 5.0 and Microsoft Exchange 2000 allow remote attackers to cause a denial of service (memory allocation error) by repeatedly sending a series of specially formatted URL's Affected: 5.0 |
| CVE-2001-0096 | – | Feb 12 | FrontPage Server Extensions (FPSE) in IIS 4.0 and 5.0 allows remote attackers to cause a denial of service via a malformed form, aka the "Malformed Web Form Submission"… Affected: 5.0 |
| CVE-2001-0004 | – | Feb 12 | IIS 5.0 and 4.0 allows remote attackers to read the source code for executable web server programs by appending "%3F+.htr" to the requested URL, which causes the files to be… Affected: 5.0 |
| CVE-2000-1104 | – | Jan 9 | Variant of the "IIS Cross-Site Scripting" vulnerability as originally discussed in MS:MS00-060 (CVE-2000-0746) allows a malicious web site operator to embed scripts in a link to a… Affected: 5.0 |
| CVE-2000-0970 | – | Dec 19 | IIS 4.0 and 5.0 .ASP pages send the same Session ID cookie for secure and insecure web sessions, which could allow remote attackers to hijack the secure web session of the user if… Affected: 5.0 |
| CVE-2000-0951 | – | Dec 19 | A misconfiguration in IIS 5.0 with Index Server enabled and the Index property set allows remote attackers to list directories in the web root via a Web Distributed Authoring and… Affected: 5.0 |
| CVE-2000-0886 | – | Dec 19 | IIS 5.0 allows remote attackers to execute arbitrary commands via a malformed request for an executable file whose name is appended with operating system commands, aka the "Web… Affected: 5.0 |
| CVE-2000-0884 | – | Dec 19 | IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary commands, via malformed URLs that contain UNICODE encoded… Affected: 5.0 |
| CVE-2000-0778 | – | Oct 20 | IIS 5.0 allows remote attackers to obtain source code for .ASP files and other scripts via an HTTP GET request with a "Translate: f" header, aka the "Specialized Header"… Affected: 5.0 |
| CVE-2000-0770 | – | Oct 20 | IIS 4.0 and 5.0 does not properly restrict access to certain types of files when their parent folders have less restrictive permissions, which could allow remote attackers to… Affected: 5.0 |
| CVE-2000-0746 | – | Oct 20 | Vulnerabilities in IIS 4.0 and 5.0 do not properly protect against cross-site scripting (CSS) attacks Affected: 5.0 |
| CVE-2000-0630 | – | Jul 17 | IIS 4.0 and 5.0 allows remote attackers to obtain fragments of source code by appending a +.htr to the URL, a variant of the "File Fragment Reading via .HTR" vulnerability Affected: 5.0 |
| CVE-2000-0631 | – | Jul 14 | An administrative script from IIS 3.0, later included in IIS 4.0 and 5.0, allows remote attackers to cause a denial of service by accessing the script without a particular… Affected: 5.0 |
| CVE-2000-0649 | – | Jul 13 | IIS 4.0 allows remote attackers to obtain the internal IP address of the server via an HTTP 1.0 request for a web page which is protected by basic authentication and has no realm… Affected: 2.0; 5.0 |
| CVE-2000-0457 | – | May 11 | ISM.DLL in IIS 4.0 and 5.0 allows remote attackers to read file contents by requesting the file and appending a large number of encoded spaces (%20) and terminated with a .htr… Affected: 5.0 |
| CVE-2000-0408 | – | May 11 | IIS 4.05 and 5.0 allow remote attackers to cause a denial of service via a long, complex URL that appears to contain a large number of file extensions, aka the "Malformed… Affected: 5.0 |
| CVE-2000-0304 | – | May 10 | Microsoft IIS 4.0 and 5.0 with the IISADMPWD virtual directory installed allows a remote attacker to cause a denial of service via a malformed request to the inetinfo.exe program,… Affected: 5.0 |
| CVE-2000-0413 | – | May 6 | The shtml.exe program in the FrontPage extensions package of IIS 4.0 and 5.0 allows remote attackers to determine the physical path of HTML, HTM, ASP, and SHTML files by… Affected: 5.0 |
| CVE-2000-0246 | – | Mar 30 | IIS 4.0 and 5.0 does not properly perform ISAPI extension processing if a virtual directory is mapped to a UNC share, which allows remote attackers to read the source code of ASP… Affected: 5.0 |
| CVE-2000-0071 | – | Jan 11 | IIS 4.0 allows a remote attacker to obtain the real pathname of the document root by requesting non-existent files with .ida or .idq extensions Affected: 5.0 |
| CVE-1999-0154 | – | Dec 31 | IIS 2.0 and 3.0 allows remote attackers to read the source code for ASP pages by appending a Affected: 2.0 |
| CVE-1999-0412 | – | Feb 19 | In IIS and other web servers, an attacker can attack commands as SYSTEM if the server is running as SYSTEM and loading an ISAPI extension Affected: 2.0 |
| CVE-1999-0450 | – | Jan 26 | In IIS, an attacker could determine a real path using a request for a non-existent URL that would be interpreted by Perl (perl.exe) Affected: 2.0; 5.0 |
| CVE-1999-0281 | – | Jun 1 | Denial of service in IIS using long URLs Affected: 2.0 |
| CVE-1999-0253 | – | Jan 1 | IIS 3.0 with the iis-fix hotfix installed allows remote intruders to read source code for ASP programs by using a %2e instead of a Affected: 1.0; 2.0 |
| CVE-1999-0233 | – | Feb 25 | IIS 1.0 allows users to execute arbitrary commands using .bat or .cmd files Affected: 1.0 |