CveMateVulnerability intelligence

Microsoft Internet Information Services vulnerabilities

91 vulnerabilities

Known vulnerabilities in Microsoft Internet Information Services, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

CVE-2003-1566microsoftinternet_information_services17y ago15-01-2009 00:00

Microsoft Internet Information Services (IIS) 5.0 does not log requests that use the TRACK method, which allows remote attackers to obtain sensitive information without detection.CVE-2003-1567microsoftinternet_information_services17y ago15-01-2009 00:00

The undocumented TRACK method in Microsoft Internet Information Services (IIS) 5.0 returns the content of the original request in the body of the response, which makes it easier for remote attackers to steal cookies and authentication credentials, or bypass the HttpOnly protection mechanism, by using TRACK to read the contents of the HTTP headers that are returned in the response, a technique that is similar to cross-site tracing (XST) using HTTP TRACE.CVE-2003-0224microsoftinternet_information_services23y ago30-05-2003 04:00

Buffer overflow in ssinc.dll for Microsoft Internet Information Services (IIS) 5.0 allows local users to execute arbitrary code via a web page with a Server Side Include (SSI) directive with a long filename, aka "Server Side Include Web Pages Buffer Overrun."CVE-2003-0226microsoftinternet_information_services23y ago30-05-2003 04:00

Microsoft Internet Information Services (IIS) 5.0 and 5.1 allows remote attackers to cause a denial of service via a long WebDAV request with a (1) PROPFIND or (2) SEARCH method, which generates an error condition that is not properly handled.CVE-2003-0225microsoftinternet_information_server+123y ago30-05-2003 04:00

The ASP function Response.AddHeader in Microsoft Internet Information Server (IIS) 4.0 and 5.0 does not limit memory requests when constructing headers, which allow remote attackers to generate a large header to cause a denial of service (memory consumption) with an ASP page.CVE-2003-0223microsoftinternet_information_server+123y ago30-05-2003 04:00

Cross-site scripting vulnerability (XSS) in the ASP function responsible for redirection in Microsoft Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to embed a URL containing script in a redirection message.CVE-2003-0718microsoftinternet_information_server+122y ago16-10-2004 04:00

The WebDAV Message Handler for Internet Information Services (IIS) 5.0, 5.1, and 6.0 allows remote attackers to cause a denial of service (memory and CPU exhaustion, application crash) via a PROPFIND request with an XML message containing XML elements with a large number of attributes.CVE-2007-2815microsoftinternet_information_services19y ago22-05-2007 19:00

The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services (IIS) Web Server 5.0 only uses Windows NT ACL configuration, which allows remote attackers to bypass NTLM and basic authentication mechanisms and access private web directories via the CiWebhitsfile parameter to null.htw.CVE-2014-4078microsoftinternet_information_services11y ago11-11-2014 22:00

The IP Security feature in Microsoft Internet Information Services (IIS) 8.0 and 8.5 does not properly process wildcard allow and deny rules for domains within the "IP Address and Domain Restrictions" list, which makes it easier for remote attackers to bypass an intended rule set via an HTTP request, aka "IIS Security Feature Bypass Vulnerability."CVE-2001-1243microsoftinternet_information_server+124y ago03-05-2002 04:00

Scripting.FileSystemObject in asp.dll for Microsoft IIS 4.0 and 5.0 allows local or remote attackers to cause a denial of service (crash) via (1) creating an ASP program that uses Scripting.FileSystemObject to open a file with an MS-DOS device name, or (2) remotely injecting the device name into ASP programs that internally use Scripting.FileSystemObject.CVE-2001-1186microsoftinternet_information_services22y ago01-09-2004 04:00

Microsoft IIS 5.0 allows remote attackers to cause a denial of service via an HTTP request with a content-length value that is larger than the size of the request, which prevents IIS from timing out the connection.CVE-2001-0544microsoftinternet_information_services24y ago09-03-2002 05:00

IIS 5.0 allows local users to cause a denial of service (hang) via by installing content that produces a certain invalid MIME Content-Type header, which corrupts the File Type table.CVE-2001-0902microsoftinternet_information_services22y ago01-09-2004 04:00

Microsoft IIS 5.0 allows remote attackers to spoof web log entries via an HTTP request that includes hex-encoded newline or form-feed characters.CVE-2001-0096microsoftinternet_information_server+125y ago07-05-2001 04:00

FrontPage Server Extensions (FPSE) in IIS 4.0 and 5.0 allows remote attackers to cause a denial of service via a malformed form, aka the "Malformed Web Form Submission" vulnerability.CVE-2001-0507microsoftinternet_information_services24y ago09-03-2002 05:00

IIS 5.0 uses relative paths to find system files that will run in-process, which allows local users to gain privileges via a Trojan horse file, aka the "System file listing privilege elevation" vulnerability.CVE-2001-0004microsoftinternet_information_server+125y ago18-09-2001 04:00

IIS 5.0 and 4.0 allows remote attackers to read the source code for executable web server programs by appending "%3F+.htr" to the requested URL, which causes the files to be parsed by the .HTR ISAPI extension, aka a variant of the "File Fragment Reading via .HTR" vulnerability.CVE-2001-0151microsoftinternet_information_services25y ago07-05-2001 04:00

IIS 5.0 allows remote attackers to cause a denial of service via a series of malformed WebDAV requests.CVE-2001-0506microsoftinternet_information_server+124y ago09-03-2002 05:00

Buffer overflow in ssinc.dll in IIS 5.0 and 4.0 allows local users to gain system privileges via a Server-Side Includes (SSI) directive for a long filename, which triggers the overflow when the directory name is added, aka the "SSI privilege elevation" vulnerability.CVE-2001-0508microsoftinternet_information_services24y ago25-06-2002 04:00

Vulnerability in IIS 5.0 allows remote attackers to cause a denial of service (restart) via a long, invalid WebDAV request.CVE-2001-0146microsoftexchange_server+125y ago09-03-2001 05:00

IIS 5.0 and Microsoft Exchange 2000 allow remote attackers to cause a denial of service (memory allocation error) by repeatedly sending a series of specially formatted URL's.