Microsoft w3who.dll vulnerabilities

2 CVEs affecting Microsoft w3who.dll, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2004-1134, published 2005-01-10.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2004-1134, published 2005-01-10. High severity, CVSS 10.0. EPSS: 72.3% chance of exploitation in the next 30 days. Buffer overflow in the Microsoft W3Who ISAPI (w3who.dll) allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long query string.
• CVE-2004-1133, published 2005-01-10. Medium severity, CVSS 6.8. EPSS: 9.8% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in Microsoft W3Who ISAPI (w3who.dll) allow remote attackers to inject arbitrary HTML and web script via (1) HTTP headers such as "Connection" or…