Microsoft Commercial Internet System vulnerabilities

6 CVEs affecting Microsoft Commercial Internet System, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2000-0246, published 2000-03-30.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2000-0246, published 2000-03-30. Medium severity, CVSS 5.0. EPSS: 80% chance of exploitation in the next 30 days. IIS 4.0 and 5.0 does not properly perform ISAPI extension processing if a virtual directory is mapped to a UNC share, which allows remote attackers to read the source code of ASP and other files, aka…
• CVE-1999-0867, published 1999-08-11. Medium severity, CVSS 5.0. EPSS: 21.5% chance of exploitation in the next 30 days. Denial of service in IIS 4.0 via a flood of HTTP requests with malformed headers.
• CVE-2000-0053, published 2000-01-04. High severity, CVSS 7.5. EPSS: 14.7% chance of exploitation in the next 30 days. Microsoft Commercial Internet System (MCIS) IMAP server allows remote attackers to cause a denial of service via a malformed IMAP request.
• CVE-1999-0777, published 1999-09-23. High severity, CVSS 7.5. EPSS: 12% chance of exploitation in the next 30 days. IIS FTP servers may allow a remote attacker to read or delete files on the server, even if they have "No Access" permissions.
• CVE-1999-0910, published 1999-09-10. Medium severity, CVSS 5.0. EPSS: 5.8% chance of exploitation in the next 30 days. Microsoft Site Server and Commercial Internet System (MCIS) do not set an expiration for a cookie, which could then be cached by a proxy and inadvertently used by a different user.
• CVE-1999-0861, published 1999-08-11. Low severity, CVSS 2.6. EPSS: 3.2% chance of exploitation in the next 30 days. Race condition in the SSL ISAPI filter in IIS and other servers may leak information in plaintext.