Microsoft Personal Web Server vulnerabilities

5 CVEs affecting Microsoft Personal Web Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-1999-0681, published 2001-03-12.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-1999-0681, published 2001-03-12. Medium severity, CVSS 5.0. EPSS: 20.5% chance of exploitation in the next 30 days. Buffer overflow in Microsoft FrontPage Server Extensions (PWS) 3.0.2.926 on Windows 95, and possibly other versions, allows remote attackers to cause a denial of service via a long URL.
• CVE-1999-0386, published 1999-03-01. Medium severity, CVSS 5.0. EPSS: 19.1% chance of exploitation in the next 30 days. Microsoft Personal Web Server and FrontPage Personal Web Server in some Windows systems allows a remote attacker to read files on the server by using a nonstandard URL.
• CVE-1999-0012, published 1998-02-06. High severity, CVSS 7.0. EPSS: 18.5% chance of exploitation in the next 30 days. Some web servers under Microsoft Windows allow remote attackers to bypass access restrictions for files with long file names.
• CVE-2000-0153, published 1999-03-26. Medium severity, CVSS 5.0. EPSS: 13.7% chance of exploitation in the next 30 days. FrontPage Personal Web Server (PWS) allows remote attackers to read files via a .... (dot dot) attack.
• CVE-2000-0256, published 2000-04-19. High severity, CVSS 7.5. EPSS: 11.7% chance of exploitation in the next 30 days. Buffer overflows in htimage.exe and Imagemap.exe in FrontPage 97 and 98 Server Extensions allow a user to conduct activities that are not otherwise available through the web site, aka the…