CVE-2002-1973

The CVE-2002-1973 entry describes a buffer overflow in CHttpServer::OnParseError of the ISAPI extension (Isapi.cpp) when built with MFC static libraries in Visual C++ 5.0 and 6.0 before SP3. This flaw, present in multiple products (including BadBlue), can be triggered by a long query string that ...

CVE-2002-1685

CVE-2002-1685 : BadBlue Enterprise Edition and Personal Edition versions 1.7 and 1.7.2 are affected by a cross-site scripting (XSS) vulnerability in the ext.dll ISAPI. The flaw enables an attacker to execute arbitrary script in the context of other users by injecting script via the ext.dll ISAPI ...

CVE-2002-1685: Undefined Security Weakness

Cross-site scripting vulnerability XSS in BadBlue Enterprise Edition and Personal Edition 1.7 and 1.7.2 allows remote attackers to execute arbitrary script as other users by injecting script into ext.dll ISAPI...

Microsoft IIS 5.0 - .printer ISAPI Extension Buffer Overflow (3)

Microsoft IIS 5.0 - .printer ISAPI Extension Buffer Overflow 3 / source: https://www.securityfocus.com/bid/2674/info Windows 2000 Internet printing ISAPI extension contains msw3prt.dll which handles user requests. Due to an unchecked buffer in msw3prt.dll, a maliciously crafted HTTP .printer...

CVE-2004-1134

Buffer overflow in the Microsoft W3Who ISAPI w3who.dll allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long query string...

CVE-2004-1133

CVE-2004-1133 describes multiple remote vulnerabilities in Microsoft W3Who ISAPI (w3who.dll): two XSS flaws and a buffer overflow. OpenVAS/Nessus details indicate the w3who.dll ISAPI may allow an attacker to execute arbitrary commands on affected Windows hosts via a buffer overflow, or mount XSS ...

CVE-2004-1134

CVE-2004-1134 covers a stack/ buffer overflow in the Microsoft IIS ISAPI w3who.dll (W3Who) triggered by long query strings. The root cause is lack of input sanitization for CGI variables, enabling remote attackers to cause denial of service and potentially execute arbitrary code with IIS privileg...

CVE-2004-1133: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Microsoft W3Who ISAPI w3who.dll allow remote attackers to inject arbitrary HTML and web script via 1 HTTP headers such as "Connection" or 2 invalid parameters whose values are echoed in the resulting error message...

Microsoft IIS ISAPI w3who.dll Query String Overflow

This module exploits a stack buffer overflow in the w3who.dll ISAPI application. This vulnerability was discovered Nicolas Gregoire and this code has been successfully tested against Windows 2000 and Windows XP SP2. When exploiting Windows XP, the payload must call RevertToSelf before it will be...

[Full-Disclosure] Multiple vulnerabilities in w3who ISAPI DLL

Exaprobe www.exaprobe.com Security Advisory Advisory Name: Multiple vulnerabilities in w3who Release Date: 6 December 2004 Application: Microsoft ISAPI extension w3who.dll Platform: Windows 2000/XP Resource Kit Severity: Remote code execution Author: Nicolas Gregoire [email protected] Vendor...

Microsoft W3Who ISAPI w3who.dll Multiple Remote Vulnerabilities

The Windows 2000 Resource Kit ships with a DLL that displays the browser client context. It lists security identifiers, privileges and $ENV variables. Nessus has determined that this file is installed on the remote host. The w3who.dll ISAPI may allow an attacker to execute arbitrary commands on...

BadBlue < 2.3 ISAPI Module Remote Administrative Interface Access

Binary data 2177.prm...

BadBlue < 2.3 ISAPI Extension Administrative Actions Bypass

Binary data 1500.prm...

MS03-051 Microsoft IIS ISAPI FrontPage fp30reg.dll Chunked Overflow

This is an exploit for the chunked encoding buffer overflow described in MS03-051 and originally reported by Brett Moore. This particular modules works against versions of Windows 2000 between SP0 and SP3. Service Pack 4 fixes the issue. Module Options msf use...

CVE-2003-0702

Vulnerability CVE-2003-0702 affects ISS Server Sensor 7.0 XPU (versions 20.16, 20.18; likely other versions before 20.19) in conjunction with Microsoft IIS over SSL. Affects a specific ISAPI plugin that, when accessed via a certain URL, can cause a denial of service (crash) and potentially allow ...

CVE-2003-0702

Unknown vulnerability in an ISAPI plugin for ISS Server Sensor 7.0 XPU 20.16, 20.18, and possibly other versions before 20.19, allows remote attackers to cause a denial of service crash and possibly execute arbitrary code in Internet Information Server IIS via a certain URL through SSL...

CVE-2003-0702: Undefined Security Weakness

Unknown vulnerability in an ISAPI plugin for ISS Server Sensor 7.0 XPU 20.16, 20.18, and possibly other versions before 20.19, allows remote attackers to cause a denial of service crash and possibly execute arbitrary code in Internet Information Server IIS via a certain URL through SSL...

Microsoft URLScan 2.5/RSA Security SecurID 5.0 - Configuration Enumeration

source: https://www.securityfocus.com/bid/8419/info A weakness has been discovered in Microsoft URLScan and RSA Security SecurID when used in conjunction on a web server. The problem is said to occur due to the order in which the products are placed within the global ISAPI filter list. When the...

CVE-2003-0349

Buffer overflow in the streaming media component for logging multicast requests in the ISAPI for the logging capability of Microsoft Windows Media Services nsiislog.dll, as installed in IIS 5.0, allows remote attackers to execute arbitrary code via a large POST request to nsiislog.dll...

CVE-2003-0349: Undefined Security Weakness

Buffer overflow in the streaming media component for logging multicast requests in the ISAPI for the logging capability of Microsoft Windows Media Services nsiislog.dll, as installed in IIS 5.0, allows remote attackers to execute arbitrary code via a large POST request to nsiislog.dll...