Product:

Internet_information_server

(Microsoft)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 108
Date Id Summary Products Score Patch Annotated
2001-02-12 CVE-2000-1090 Microsoft IIS for Far East editions 4.0 and 5.0 allows remote attackers to read source code for parsed pages via a malformed URL that uses the lead-byte of a double-byte character. Internet_information_server N/A
2000-12-19 CVE-2000-0970 IIS 4.0 and 5.0 .ASP pages send the same Session ID cookie for secure and insecure web sessions, which could allow remote attackers to hijack the secure web session of the user if that user moves to an insecure session, aka the "Session ID Cookie Marking" vulnerability. Internet_information_server, Internet_information_services N/A
2000-12-19 CVE-2000-0886 IIS 5.0 allows remote attackers to execute arbitrary commands via a malformed request for an executable file whose name is appended with operating system commands, aka the "Web Server File Request Parsing" vulnerability. Internet_information_server, Internet_information_services N/A
2000-12-19 CVE-2000-0884 IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary commands, via malformed URLs that contain UNICODE encoded characters, aka the "Web Server Folder Traversal" vulnerability. Internet_information_server, Internet_information_services N/A
2000-11-14 CVE-2000-0858 Vulnerability in Microsoft Windows NT 4.0 allows remote attackers to cause a denial of service in IIS by sending it a series of malformed requests which cause INETINFO.EXE to fail, aka the "Invalid URL" vulnerability. Internet_information_server, Windows_nt N/A
2000-10-20 CVE-2000-0770 IIS 4.0 and 5.0 does not properly restrict access to certain types of files when their parent folders have less restrictive permissions, which could allow remote attackers to bypass access restrictions to some files, aka the "File Permission Canonicalization" vulnerability. Internet_information_server, Internet_information_services N/A
2000-07-14 CVE-2000-0631 An administrative script from IIS 3.0, later included in IIS 4.0 and 5.0, allows remote attackers to cause a denial of service by accessing the script without a particular argument, aka the "Absent Directory Browser Argument" vulnerability. Internet_information_server, Internet_information_services N/A
2000-07-17 CVE-2000-0630 IIS 4.0 and 5.0 allows remote attackers to obtain fragments of source code by appending a +.htr to the URL, a variant of the "File Fragment Reading via .HTR" vulnerability. Internet_information_server, Internet_information_services N/A
2000-05-11 CVE-2000-0457 ISM.DLL in IIS 4.0 and 5.0 allows remote attackers to read file contents by requesting the file and appending a large number of encoded spaces (%20) and terminated with a .htr extension, aka the ".HTR File Fragment Reading" or "File Fragment Reading via .HTR" vulnerability. Internet_information_server, Internet_information_services N/A
2000-05-06 CVE-2000-0413 The shtml.exe program in the FrontPage extensions package of IIS 4.0 and 5.0 allows remote attackers to determine the physical path of HTML, HTM, ASP, and SHTML files by requesting a file that does not exist, which generates an error message that reveals the path. Frontpage, Internet_information_server, Internet_information_services N/A