CVE-2002-0079: Undefined Security Weakness

Buffer overflow in the chunked encoding transfer mechanism in Internet Information Server IIS 4.0 and 5.0 Active Server Pages allows attackers to cause a denial of service or execute arbitrary code...

CVE-2002-1717

Microsoft Internet Information Server IIS 5.1 allows remote attackers to view path information via a GET request to 1 /vtipvt/access.cnf, 2 /vtipvt/botinfs.cnf, 3 /vtipvt/bots.cnf, or 4 /vtipvt/linkinfo.cnf...

CVE-2002-1718

Microsoft Internet Information Server IIS 5.1 may allow remote attackers to view the contents of a Frontpage Server Extension FPSE file, as claimed using an HTTP request for colegal.htm that contains .. dot dot sequences...

VulnCheck KEV: CVE-2002-1717

Microsoft Internet Information Server IIS 5.1 allows remote attackers to view path information via a GET request to 1 /vtipvt/access.cnf, 2 /vtipvt/botinfs.cnf, 3 /vtipvt/bots.cnf, or 4 /vtipvt/linkinfo.cnf...

CVE-2002-0869

Unknown vulnerability in the hosting process dllhost.exe for Microsoft Internet Information Server IIS 4.0 through 5.1 allows remote attackers to gain privileges by executing an out of process application that acquires LocalSystem privileges, aka "Out of Process Privilege Elevation."...

CVE-2002-1180

A typographical error in the script source access permissions for Internet Information Server IIS 5.0 does not properly exclude .COM files, which allows attackers with only write permissions to upload malicious .COM files, aka "Script Source Access Vulnerability."...

CVE-2002-1181

Multiple cross-site scripting XSS vulnerabilities in the administrative web pages for Microsoft Internet Information Server IIS 4.0 through 5.1 allow remote attackers to execute HTML script as other users through 1 a certain ASP file in the IISHELP virtual directory, or 2 possibly other unknown...

CVE-2002-0869

Unknown vulnerability in the hosting process dllhost.exe for Microsoft Internet Information Server IIS 4.0 through 5.1 allows remote attackers to gain privileges by executing an out of process application that acquires LocalSystem privileges, aka "Out of Process Privilege Elevation."...

CVE-2002-1181

Multiple cross-site scripting XSS vulnerabilities in the administrative web pages for Microsoft Internet Information Server IIS 4.0 through 5.1 allow remote attackers to execute HTML script as other users through 1 a certain ASP file in the IISHELP virtual directory, or 2 possibly other unknown...

CVE-2002-0869: Undefined Security Weakness

Unknown vulnerability in the hosting process dllhost.exe for Microsoft Internet Information Server IIS 4.0 through 5.1 allows remote attackers to gain privileges by executing an out of process application that acquires LocalSystem privileges, aka "Out of Process Privilege Elevation."...

CVE-2002-1181: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in the administrative web pages for Microsoft Internet Information Server IIS 4.0 through 5.1 allow remote attackers to execute HTML script as other users through 1 a certain ASP file in the IISHELP virtual directory, or 2 possibly other unknown...

DLA-25-06-2002.txt

Digit-Labs Security Advisory http://www.digit-labs.org/ Advisory Name: IIS Administration Web Site redirect exploits Release Date: 25.June-2002 Application: Microsoft Internet Information Server 5.0 Platform: Windows 2000 Professional Severity: Low/Medium Authors: GoLLuM.no...

Security Bulletin MS02-028: Heap Overrun in HTR Chunked Encoding Could Enable Web Server Compromise (Q321599)

---------------------------------------------------------------------- Title: Heap Overrun in HTR Chunked Encoding Could Enable Web Server Compromise Q321599 Date: 12 June 2002 Software: Internet Information Server Impact: Run Code of Attacker's Choice Max Risk: Moderate Bulletin: MS02-028...

servletexec-4.1.txt

Westpoint Security Advisory Title: Multiple vulnerabilities in NewAtlanta ServletExec ISAPI 4.1 Risk Rating: High Software: ServletExec 4.1 ISAPI / IIS 4 & 5 Platforms: Win2k / WinNT 4 Vendor URL: www.newatlanta.com Author: Matt Moore Date: 22 May 2002 Advisory ID: wp-02-0006.txt Overview:...

CVE-2002-0071

Buffer overflow in the ism.dll ISAPI extension that implements HTR scripting in Internet Information Server IIS 4.0 and 5.0 allows attackers to cause a denial of service or execute arbitrary code via HTR requests with long variable names...

CVE-2002-0075

Cross-site scripting vulnerability for Internet Information Server IIS 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other web users via the error message used in a URL redirect ""302 Object Moved" message...

CVE-2002-0147

Buffer overflow in the ASP data transfer mechanism in Internet Information Server IIS 4.0, 5.0, and 5.1 allows remote attackers to cause a denial of service or execute code, aka "Microsoft-discovered variant of Chunked Encoding buffer overrun."...

CVE-2002-0148

Cross-site scripting vulnerability in Internet Information Server IIS 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other users via an HTTP error page...

CVE-2002-0150

Buffer overflow in Internet Information Server IIS 4.0, 5.0, and 5.1 allows remote attackers to spoof the safety check for HTTP headers and cause a denial of service or execute arbitrary code via HTTP header field values...

CVE-2002-0073

The FTP service in Internet Information Server IIS 4.0, 5.0 and 5.1 allows attackers who have established an FTP session to cause a denial of service via a specially crafted status request containing glob characters...