Microsoft Internet Information Server vulnerabilities

107 CVEs affecting Microsoft Internet Information Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2010-1899, published 2010-09-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2001-0500, published 2001-07-21. High severity, CVSS 10.0. EPSS: 96.7% chance of exploitation in the next 30 days. Buffer overflow in ISAPI extension (idq.dll) in Index Server 2.0 and Indexing Service 2000 in IIS 6.0 beta and earlier allows remote attackers to execute arbitrary commands via a long argument to…
CVE-2009-3023, published 2009-08-31. High severity, CVSS 9.0. EPSS: 90.9% chance of exploitation in the next 30 days. Buffer overflow in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 6.0 allows remote authenticated users to execute arbitrary code via a crafted NLST (NAME LIST) command…
CVE-2001-0333, published 2001-06-27. High severity, CVSS 7.5. EPSS: 90.8% chance of exploitation in the next 30 days. Directory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding .. (dot dot) and "\" characters twice.
CVE-2006-0026, published 2006-07-11. Medium severity, CVSS 6.5. EPSS: 89.3% chance of exploitation in the next 30 days. Buffer overflow in Microsoft Internet Information Services (IIS) 5.0, 5.1, and 6.0 allows local and possibly remote attackers to execute arbitrary code via crafted Active Server Pages (ASP).
CVE-2003-0718, published 2004-11-03. Medium severity, CVSS 5.0. EPSS: 87.9% chance of exploitation in the next 30 days. The WebDAV Message Handler for Internet Information Services (IIS) 5.0, 5.1, and 6.0 allows remote attackers to cause a denial of service (memory and CPU exhaustion, application crash) via a PROPFIND…
CVE-2000-0246, published 2000-03-30. Medium severity, CVSS 5.0. EPSS: 80% chance of exploitation in the next 30 days. IIS 4.0 and 5.0 does not properly perform ISAPI extension processing if a virtual directory is mapped to a UNC share, which allows remote attackers to read the source code of ASP and other files, aka…
CVE-2002-0079, published 2002-04-22. High severity, CVSS 7.5. EPSS: 77.3% chance of exploitation in the next 30 days. Buffer overflow in the chunked encoding transfer mechanism in Internet Information Server (IIS) 4.0 and 5.0 Active Server Pages allows attackers to cause a denial of service or execute arbitrary code.
CVE-1999-1011, published 1999-07-19. High severity, CVSS 10.0. EPSS: 77.1% chance of exploitation in the next 30 days. The Remote Data Service (RDS) DataFactory component of Microsoft Data Access Components (MDAC) in IIS 3.x and 4.x exposes unsafe methods, which allows remote attackers to execute arbitrary commands.
CVE-2000-0649, published 2000-07-13. Low severity, CVSS 2.6. EPSS: 76.6% chance of exploitation in the next 30 days. IIS 4.0 allows remote attackers to obtain the internal IP address of the server via an HTTP 1.0 request for a web page which is protected by basic authentication and has no realm defined.
CVE-1999-0874, published 1999-06-16. High severity, CVSS 10.0. EPSS: 74.7% chance of exploitation in the next 30 days. Buffer overflow in IIS 4.0 allows remote attackers to cause a denial of service via a malformed request for files with .HTR, .IDC, or .STM extensions.

Latest

CVE-2010-1899, published 2010-09-15. Medium severity, CVSS 4.3. EPSS: 57.2% chance of exploitation in the next 30 days. Stack consumption vulnerability in the ASP implementation in Microsoft Internet Information Services (IIS) 5.1, 6.0, 7.0, and 7.5 allows remote attackers to cause a denial of service (daemon outage)…
CVE-2010-1256, published 2010-06-08. High severity, CVSS 8.5. EPSS: 28.2% chance of exploitation in the next 30 days. Unspecified vulnerability in Microsoft IIS 6.0, 7.0, and 7.5, when Extended Protection for Authentication is enabled, allows remote authenticated users to execute arbitrary code via unknown vectors…
CVE-2003-1582, published 2010-02-05. Low severity, CVSS 2.6. EPSS: 10.3% chance of exploitation in the next 30 days. Microsoft Internet Information Services (IIS) 6.0, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject arbitrary text into log files via an HTTP request in…
CVE-2008-0075, published 2008-02-12. High severity, CVSS 10.0. EPSS: 57.2% chance of exploitation in the next 30 days. Unspecified vulnerability in Microsoft Internet Information Services (IIS) 5.1 through 6.0 allows remote attackers to execute arbitrary code via crafted inputs to ASP pages.
CVE-2008-0074, published 2008-02-12. High severity, CVSS 7.2. EPSS: 5.4% chance of exploitation in the next 30 days. Unspecified vulnerability in Microsoft Internet Information Services (IIS) 5.0 through 7.0 allows local users to gain privileges via unknown vectors related to file change notifications in the…
CVE-2007-2897, published 2007-05-30. High severity, CVSS 7.5. EPSS: 74% chance of exploitation in the next 30 days. Microsoft Internet Information Services (IIS) 6.0 allows remote attackers to cause a denial of service (server instability or device hang), and possibly obtain sensitive information (device…
CVE-2007-0087, published 2007-01-05. High severity, CVSS 7.8. EPSS: 24.4% chance of exploitation in the next 30 days. Microsoft Internet Information Services (IIS), when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of service (network bandwidth consumption)…
CVE-2006-6579, published 2006-12-15. Medium severity, CVSS 4.4. EPSS: 1.4% chance of exploitation in the next 30 days. Microsoft Windows XP has weak permissions (FILE_WRITE_DATA and FILE_READ_DATA for Everyone) for %WINDIR%\pchealth\ERRORREP\QHEADLES, which allows local users to write and read files in this folder,…