CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Microsoft » Internet Information Server » * * * * : Security Vulnerabilities

Cpe Name:cpe:2.3:a:microsoft:internet_information_server:*:*:*:*:*:*:*:*
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2007-0087 DoS 2007-01-05 2018-10-16
7.8
None Remote Low Not required None None Complete
** DISPUTED ** Microsoft Internet Information Services (IIS), when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of service (network bandwidth consumption) via a Range header that specifies multiple copies of the same fragment. NOTE: the severity of this issue has been disputed by third parties, who state that the large window size required by the attack is not normally supported or configured by the server, or that a DDoS-style attack would accomplish the same goal.
2 CVE-2006-6579 2006-12-15 2020-11-23
4.4
None Local Medium Not required Partial Partial Partial
Microsoft Windows XP has weak permissions (FILE_WRITE_DATA and FILE_READ_DATA for Everyone) for %WINDIR%\pchealth\ERRORREP\QHEADLES, which allows local users to write and read files in this folder, as demonstrated by an ASP shell that has write access by IWAM_machine and read access by IUSR_Machine.
3 CVE-2001-0709 2001-09-20 2017-12-19
5.0
None Remote Low Not required Partial None None
Microsoft IIS 4.0 and before, when installed on a FAT partition, allows a remote attacker to obtain source code of ASP files via a URL encoded with Unicode.
4 CVE-2001-0337 DoS 2001-06-27 2018-10-12
5.0
None Remote Low Not required None None Partial
The Microsoft MS01-014 and MS01-016 patches for IIS 5.0 and earlier introduce a memory leak which allows attackers to cause a denial of service via a series of requests.
5 CVE-2001-0336 DoS 2001-06-27 2018-10-12
5.0
None Remote Low Not required None None Partial
The Microsoft MS00-060 patch for IIS 5.0 and earlier introduces an error which allows attackers to cause a denial of service via a malformed request.
6 CVE-2001-0335 2001-06-27 2018-10-12
5.0
None Remote Low Not required Partial None None
FTP service in IIS 5.0 and earlier allows remote attackers to enumerate Guest accounts in trusted domains by preceding the username with a special sequence of characters.
7 CVE-2001-0334 DoS 2001-06-27 2018-10-12
5.0
None Remote Low Not required None None Partial
FTP service in IIS 5.0 and earlier allows remote attackers to cause a denial of service via a wildcard sequence that generates a long string when it is expanded.
8 CVE-2001-0333 Exec Code Dir. Trav. 2001-06-27 2018-10-12
7.5
None Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding .. (dot dot) and "\" characters twice.
9 CVE-2000-0115 DoS 2000-01-21 2008-09-10
5.0
None Remote Low Not required None None Partial
IIS allows local users to cause a denial of service via invalid regular expressions in a Visual Basic script in an ASP page.
10 CVE-1999-1148 DoS 1999-12-31 2018-10-12
5.0
None Remote Low Not required None None Partial
FTP service in IIS 4.0 and earlier allows remote attackers to cause a denial of service (resource exhaustion) via many passive (PASV) connections at the same time.
11 CVE-1999-0229 DoS 1999-05-12 2008-09-09
5.0
None Remote Low Not required None None Partial
Denial of service in Windows NT IIS server using ..\..
Total number of vulnerabilities : 11   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.