internet information services vulnerabilities and exploits

(subscribe to this query)

7.5

CVSSv2

IIS 3.0 with the iis-fix hotfix installed allows remote intruders to read source code for ASP programs by using a %2e instead of a . (dot) in the URL.

Microsoft Internet Information Server 3.0 Microsoft Internet Information Services 1.0 Microsoft Internet Information Services 2.0

7.5

CVSSv2

In IIS, an attacker could determine a real path using a request for a non-existent URL that would be interpreted by Perl (perl.exe).

Microsoft Internet Information Server 3.0 Microsoft Internet Information Services 5.0 Microsoft Internet Information Services 2.0 Microsoft Internet Information Server 4.0

1 EDB exploit

2.6

CVSSv2

IIS 4.0 allows remote malicious users to obtain the internal IP address of the server via an HTTP 1.0 request for a web page which is protected by basic authentication and has no realm defined.

Microsoft Internet Information Services 2.0 Microsoft Internet Information Server 3.0 Microsoft Internet Information Server 4.0 Microsoft Internet Information Services 5.0

1 EDB exploit1 Metasploit module7 Github repositories

4.4

CVSSv2

Microsoft Windows XP has weak permissions (FILE_WRITE_DATA and FILE_READ_DATA for Everyone) for %WINDIR%\pchealth\ERRORREP\QHEADLES, which allows local users to write and read files in this folder, as demonstrated by an ASP shell that has write access by IWAM_machine and read acc...

Microsoft Internet Information Server 3.0 Microsoft Internet Information Server 4.0 Microsoft Internet Information Server Microsoft Internet Information Services 1.0 Microsoft Internet Information Services 2.0

6

CVSSv2

Microsoft Internet Information Services (IIS) 5.x and 6.x uses only the portion of a filename before a ; (semicolon) character to determine the file extension, which allows remote malicious users to bypass intended extension restrictions of third-party upload applications via a f...

Microsoft Internet Information Services 5.0 Microsoft Internet Information Services 6.0

4.3

CVSSv2

Microsoft IIS 5.0 and 6.0 allows remote malicious users to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes IIS to inco...

Microsoft Internet Information Services 5.0 Microsoft Internet Information Services 6.0

5.1

CVSSv2

The IP Security feature in Microsoft Internet Information Services (IIS) 8.0 and 8.5 does not properly process wildcard allow and deny rules for domains within the "IP Address and Domain Restrictions" list, which makes it easier for remote malicious users to bypass an i...

Microsoft Internet Information Services 8.5 Microsoft Internet Information Services 8.0

2 Github repositories

7.5

CVSSv2

In IIS and other web servers, an attacker can attack commands as SYSTEM if the server is running as SYSTEM and loading an ISAPI extension.

Microsoft Internet Information Services 2.0 Microsoft Internet Information Server 3.0 Microsoft Internet Information Server 4.0

1 EDB exploit

5

CVSSv2

An administrative script from IIS 3.0, later included in IIS 4.0 and 5.0, allows remote malicious users to cause a denial of service by accessing the script without a particular argument, aka the "Absent Directory Browser Argument" vulnerability.

Microsoft Internet Information Services 5.0 Microsoft Internet Information Server 3.0 Microsoft Internet Information Server 4.0

5

CVSSv2

IIS 4.0 allows a remote malicious user to obtain the real pathname of the document root by requesting non-existent files with .ida or .idq extensions.

Microsoft Internet Information Server 4.0 Microsoft Internet Information Services 5.0 Microsoft Internet Information Server 3.0

Get Started

1 2 3 4 5 6 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook