Microsoft: >> Internet Information Services Security Vulnerabilities
IIS 5.0 allows local users to cause a denial of service (hang) via by installing content that produces a certain invalid MIME Content-Type header, which corrupts the File Type table.
CVSS Score
2.1
EPSS Score
0.005
Published
2001-10-30
Buffer overflow in ssinc.dll in IIS 5.0 and 4.0 allows local users to gain system privileges via a Server-Side Includes (SSI) directive for a long filename, which triggers the overflow when the directory name is added, aka the "SSI privilege elevation" vulnerability.
CVSS Score
7.2
EPSS Score
0.379
Published
2001-09-20
IIS 5.0 uses relative paths to find system files that will run in-process, which allows local users to gain privileges via a Trojan horse file, aka the "System file listing privilege elevation" vulnerability.
CVSS Score
7.2
EPSS Score
0.012
Published
2001-09-20
Vulnerability in IIS 5.0 allows remote attackers to cause a denial of service (restart) via a long, invalid WebDAV request.
CVSS Score
5.0
EPSS Score
0.199
Published
2001-09-20
Scripting.FileSystemObject in asp.dll for Microsoft IIS 4.0 and 5.0 allows local or remote attackers to cause a denial of service (crash) via (1) creating an ASP program that uses Scripting.FileSystemObject to open a file with an MS-DOS device name, or (2) remotely injecting the device name into ASP programs that internally use Scripting.FileSystemObject.
CVSS Score
5.0
EPSS Score
0.084
Published
2001-07-04
IIS 5.0 and Microsoft Exchange 2000 allow remote attackers to cause a denial of service (memory allocation error) by repeatedly sending a series of specially formatted URL's.
CVSS Score
5.0
EPSS Score
0.133
Published
2001-06-02
IIS 5.0 allows remote attackers to cause a denial of service via a series of malformed WebDAV requests.
CVSS Score
5.0
EPSS Score
0.198
Published
2001-06-02
IIS 5.0 and 4.0 allows remote attackers to read the source code for executable web server programs by appending "%3F+.htr" to the requested URL, which causes the files to be parsed by the .HTR ISAPI extension, aka a variant of the "File Fragment Reading via .HTR" vulnerability.
CVSS Score
5.0
EPSS Score
0.33
Published
2001-02-12
FrontPage Server Extensions (FPSE) in IIS 4.0 and 5.0 allows remote attackers to cause a denial of service via a malformed form, aka the "Malformed Web Form Submission" vulnerability.
CVSS Score
5.0
EPSS Score
0.111
Published
2001-02-12
Variant of the "IIS Cross-Site Scripting" vulnerability as originally discussed in MS:MS00-060 (CVE-2000-0746) allows a malicious web site operator to embed scripts in a link to a trusted site, which are returned without quoting in an error message back to the client. The client then executes those scripts in the same context as the trusted site.
CVSS Score
7.5
EPSS Score
0.063
Published
2001-01-09