CVE-2006-0026: microsoft internet_information_server

EPSS trend

Probability

89.26%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 89.26% on 21-09-2026

21-09-202621-10-2026

EPSS score

89.26%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

exploit-databaselocalwindowsVerified
Microsoft IIS - ASP Stack Overflow (MS06-034)
Maturity: weaponized

References

11 links

archives.neohapsis.com/archives/bugtraq/2006-07/0316.htmlMailing ListX Refsource BUGTRAQ
docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-034Vendor AdvisoryX Refsource MS
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A435VDB EntrySignatureX Refsource OVAL
www.osvdb.org/27152VDB EntryX Refsource OSVDB
www.vupen.com/english/advisories/2006/2752VDB EntryX Refsource VUPEN
exchange.xforce.ibmcloud.com/vulnerabilities/26796VDB EntryX Refsource XF
secunia.com/advisories/21006Third Party AdvisoryX Refsource SECUNIAPatchVendor Advisory
www.securityfocus.com/bid/18858VDB EntryX Refsource BIDPatch
www.kb.cert.org/vuls/id/395588Third Party AdvisoryX Refsource CERT VNPatchUS Government Resource
securitytracker.com/id?1016466VDB EntryX Refsource SECTRACKPatch

Show all 11 references

www.us-cert.gov/cas/techalerts/TA06-192A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource

Related vulnerabilities

CVE-2003-1582microsoftinternet_information_server10.32%16y ago05-02-2010 22:13Microsoft Internet Information Services (IIS) 6.0, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject arbitrary text into log files via an HTTP request in conjunction with a crafted DNS response, as demonstrated by injecting XSS sequences, related to an "Inverse Lookup Log Corruption (ILLC)" issue.CVE-2003-1566microsoftinternet_information_services28.12%17y ago15-01-2009 00:00Microsoft Internet Information Services (IIS) 5.0 does not log requests that use the TRACK method, which allows remote attackers to obtain sensitive information without detection.CVE-2003-1567microsoftinternet_information_services25.25%17y ago15-01-2009 00:00The undocumented TRACK method in Microsoft Internet Information Services (IIS) 5.0 returns the content of the original request in the body of the response, which makes it easier for remote attackers to steal cookies and authentication credentials, or bypass the HttpOnly protection mechanism, by using TRACK to read the contents of the HTTP headers that are returned in the response, a technique that is similar to cross-site tracing (XST) using HTTP TRACE.CVE-2003-0224microsoftinternet_information_services18.27%23y ago30-05-2003 04:00Buffer overflow in ssinc.dll for Microsoft Internet Information Services (IIS) 5.0 allows local users to execute arbitrary code via a web page with a Server Side Include (SSI) directive with a long filename, aka "Server Side Include Web Pages Buffer Overrun."CVE-2003-0226microsoftinternet_information_services43.20%23y ago30-05-2003 04:00Microsoft Internet Information Services (IIS) 5.0 and 5.1 allows remote attackers to cause a denial of service via a long WebDAV request with a (1) PROPFIND or (2) SEARCH method, which generates an error condition that is not properly handled.CVE-2003-0225microsoftinternet_information_server+138.46%23y ago30-05-2003 04:00The ASP function Response.AddHeader in Microsoft Internet Information Server (IIS) 4.0 and 5.0 does not limit memory requests when constructing headers, which allow remote attackers to generate a large header to cause a denial of service (memory consumption) with an ASP page.

All vulnerabilities ininternet_information_server internet_information_services

CVE-2006-0026: microsoft internet_information_server

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References