Microsoft Internet Information Services vulnerabilities

91 CVEs affecting Microsoft Internet Information Services, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-7269, published 2017-03-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-7269: Microsoft Windows Server Buffer Overflow Vulnerability, published 2017-03-27. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 99.8% chance of exploitation in the next 30 days. Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary…
CVE-2009-1122, published 2009-06-10. High severity, CVSS 7.5. EPSS: 98.4% chance of exploitation in the next 30 days. The WebDAV extension in Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remote attackers to bypass authentication, and possibly read…
CVE-2009-1535, published 2009-06-10. High severity, CVSS 7.5. EPSS: 98.1% chance of exploitation in the next 30 days. The WebDAV extension in Microsoft Internet Information Services (IIS) 5.1 and 6.0 allows remote attackers to bypass URI-based protection mechanisms, and list folders or read, create, or modify files,…
CVE-2010-3972, published 2010-12-23. High severity, CVSS 10.0. EPSS: 94.5% chance of exploitation in the next 30 days. Heap-based buffer overflow in the TELNET_STREAM_CONTEXT::OnSendData function in ftpsvc.dll in Microsoft FTP Service 7.0 and 7.5 for Internet Information Services (IIS) 7.0, and IIS 7.5, allows remote…
CVE-2006-0026, published 2006-07-11. Medium severity, CVSS 6.5. EPSS: 89.3% chance of exploitation in the next 30 days. Buffer overflow in Microsoft Internet Information Services (IIS) 5.0, 5.1, and 6.0 allows local and possibly remote attackers to execute arbitrary code via crafted Active Server Pages (ASP).
CVE-2003-0718, published 2004-11-03. Medium severity, CVSS 5.0. EPSS: 87.9% chance of exploitation in the next 30 days. The WebDAV Message Handler for Internet Information Services (IIS) 5.0, 5.1, and 6.0 allows remote attackers to cause a denial of service (memory and CPU exhaustion, application crash) via a PROPFIND…
CVE-2000-0778, published 2000-10-20. Medium severity, CVSS 5.0. EPSS: 87.3% chance of exploitation in the next 30 days. IIS 5.0 allows remote attackers to obtain source code for .ASP files and other scripts via an HTTP GET request with a "Translate: f" header, aka the "Specialized Header" vulnerability.
CVE-2005-4360, published 2005-12-20. High severity, CVSS 7.8. EPSS: 86.7% chance of exploitation in the next 30 days. The URL parser in Microsoft Internet Information Services (IIS) 5.1 on Windows XP Professional SP2 allows remote attackers to execute arbitrary code via multiple requests to ".dll" followed by…
CVE-2009-2521, published 2009-09-04. Medium severity, CVSS 5.0. EPSS: 82.3% chance of exploitation in the next 30 days. Stack consumption vulnerability in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 7.0 allows remote authenticated users to cause a denial of service (daemon crash) via a…
CVE-2000-0246, published 2000-03-30. Medium severity, CVSS 5.0. EPSS: 80% chance of exploitation in the next 30 days. IIS 4.0 and 5.0 does not properly perform ISAPI extension processing if a virtual directory is mapped to a UNC share, which allows remote attackers to read the source code of ASP and other files, aka…

Latest

CVE-2014-4078, published 2014-11-11. Medium severity, CVSS 5.1. EPSS: 20.1% chance of exploitation in the next 30 days. The IP Security feature in Microsoft Internet Information Services (IIS) 8.0 and 8.5 does not properly process wildcard allow and deny rules for domains within the "IP Address and Domain…
CVE-2011-5279, published 2014-04-23. Medium severity, CVSS 5.0. EPSS: 19.6% chance of exploitation in the next 30 days. CRLF injection vulnerability in the CGI implementation in Microsoft Internet Information Services (IIS) 4.x and 5.x on Windows NT and Windows 2000 allows remote attackers to modify arbitrary…
CVE-2010-2730, published 2010-09-15. High severity, CVSS 9.3. EPSS: 32.8% chance of exploitation in the next 30 days. Buffer overflow in Microsoft Internet Information Services (IIS) 7.5, when FastCGI is enabled, allows remote attackers to execute arbitrary code via crafted headers in a request, aka "Request Header…
CVE-2010-1899, published 2010-09-15. Medium severity, CVSS 4.3. EPSS: 57.2% chance of exploitation in the next 30 days. Stack consumption vulnerability in the ASP implementation in Microsoft Internet Information Services (IIS) 5.1, 6.0, 7.0, and 7.5 allows remote attackers to cause a denial of service (daemon outage)…
CVE-2009-4445, published 2009-12-29. Medium severity, CVSS 6.0. EPSS: 12.8% chance of exploitation in the next 30 days. Microsoft Internet Information Services (IIS), when used in conjunction with unspecified third-party upload applications, allows remote attackers to create empty files with arbitrary extensions via a…
CVE-2009-4444, published 2009-12-29. Medium severity, CVSS 6.0. EPSS: 63.6% chance of exploitation in the next 30 days. Microsoft Internet Information Services (IIS) 5.x and 6.x uses only the portion of a filename before a ; (semicolon) character to determine the file extension, which allows remote attackers to bypass…