Microsoft Internet Information Server vulnerabilities, page 4
104 vulnerabilities
Known vulnerabilities in Microsoft Internet Information Server, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-1999-0007c2netstonghold_web_server+12
EPSS score7.64%
Information from SSL-encrypted sessions via PKCS #1.CVE-1999-0450microsoftinternet_information_server+1EPSS score19.03%
In IIS, an attacker could determine a real path using a request for a non-existent URL that would be interpreted by Perl (perl.exe).CVE-1999-0725microsoftinternet_information_serverEPSS score24.85%
When IIS is run with a default language of Chinese, Korean, or Japanese, it allows a remote attacker to view the source code of certain files, a.k.a. "Double Byte Code Page".CVE-1999-0154microsoftinternet_information_server+1EPSS score40.02%
IIS 2.0 and 3.0 allows remote attackers to read the source code for ASP pages by appending a . (dot) to the end of the URL.CVE-1999-0736microsoftinternet_information_serverEPSS score44.84%
The showcode.asp sample file in IIS and Site Server allows remote attackers to read arbitrary files.CVE-1999-0739microsoftinternet_information_serverEPSS score28.74%
The codebrws.asp sample file in IIS and Site Server allows remote attackers to read arbitrary files.CVE-1999-0281microsoftinternet_information_server+1EPSS score12.83%
Denial of service in IIS using long URLs.CVE-1999-0737microsoftinternet_information_serverEPSS score28.08%
The viewcode.asp sample file in IIS and Site Server allows remote attackers to read arbitrary files.CVE-1999-0867microsoftcommercial_internet_system+2EPSS score21.52%
Denial of service in IIS 4.0 via a flood of HTTP requests with malformed headers.CVE-1999-0874microsoftinternet_information_server+1EPSS score74.65%
Buffer overflow in IIS 4.0 allows remote attackers to cause a denial of service via a malformed request for files with .HTR, .IDC, or .STM extensions.CVE-1999-0777microsoftcommercial_internet_system+1EPSS score11.99%
IIS FTP servers may allow a remote attacker to read or delete files on the server, even if they have "No Access" permissions.CVE-1999-0407microsoftinternet_information_serverEPSS score5.13%
By default, IIS 4.0 has a virtual directory /IISADMPWD which contains files that can be used as proxies for brute force password attacks, or to identify valid users on the system.CVE-1999-0861microsoftcommercial_internet_system+3EPSS score3.21%
Race condition in the SSL ISAPI filter in IIS and other servers may leak information in plaintext.CVE-1999-0191microsoftinternet_information_serverEPSS score53.30%
IIS newdsn.exe CGI script allows remote users to overwrite files.CVE-1999-0348microsoftinternet_information_serverEPSS score10.56%
IIS ASP caching problem releases sensitive information when two virtual servers share the same physical directory.CVE-1999-0448microsoftinternet_information_serverEPSS score24.61%
IIS 4.0 and Apache log HTTP request methods, regardless of how long they are, allowing a remote attacker to hide the URL they really request.CVE-1999-0738microsoftinternet_information_serverEPSS score28.74%
The code.asp sample file in IIS and Site Server allows remote attackers to read arbitrary files.CVE-1999-0412microsoftinternet_information_server+1EPSS score10.24%
In IIS and other web servers, an attacker can attack commands as SYSTEM if the server is running as SYSTEM and loading an ISAPI extension.CVE-1999-0012microsoftinternet_information_server+3EPSS score18.53%
Some web servers under Microsoft Windows allow remote attackers to bypass access restrictions for files with long file names.CVE-1999-0449microsoftinternet_information_serverEPSS score49.25%
The ExAir sample site in IIS 4 allows remote attackers to cause a denial of service (CPU consumption) via a direct request to the (1) advsearch.asp, (2) query.asp, or (3) search.asp scripts.