2839 matches found
Microsoft IIS 5.0 - User Existence Disclosure (1)
source: https://www.securityfocus.com/bid/7492/info Microsoft IIS is prone to an issue where the existence of users may be revealed to remote attackers. The vulnerability exists when users attempt to authenticate against a vulnerable system. IIS will generate an error page if authentication fails...
Microsoft IIS 5.0 - User Existence Disclosure (2)
Microsoft IIS 5.0 - User Existence Disclosure 2 source: https://www.securityfocus.com/bid/7492/info Microsoft IIS is prone to an issue where the existence of users may be revealed to remote attackers. The vulnerability exists when users attempt to authenticate against a vulnerable system. IIS wil...
Microsoft IIS 5.0 - User Existence Disclosure (2)
source: https://www.securityfocus.com/bid/7492/info Microsoft IIS is prone to an issue where the existence of users may be revealed to remote attackers. The vulnerability exists when users attempt to authenticate against a vulnerable system. IIS will generate an error page if authentication fails...
CVE-1999-0412
In IIS and other web servers, an attacker can attack commands as SYSTEM if the server is running as SYSTEM and loading an ISAPI extension...
Microsoft IIS 3.04.0 - Using ASP and FSO To Read Server Files
Microsoft IIS 3.04.0 - Using ASP and FSO To Read Server Files source: https://www.securityfocus.com/bid/230/info The File System Object FSO may be called from an Active Server Page ASP to display files that exist outside of the web server's root directory. FSO allows calls to be made utilizing...
Microsoft IIS 3.0/4.0 - Using ASP and FSO To Read Server Files
source: https://www.securityfocus.com/bid/230/info The File System Object FSO may be called from an Active Server Page ASP to display files that exist outside of the web server's root directory. FSO allows calls to be made utilizing "../" to exit the local directory path. An example of this synta...
CVE-1999-0407
By default, IIS 4.0 has a virtual directory /IISADMPWD which contains files that can be used as proxies for brute force password attacks, or to identify valid users on the system...
Microsoft Site Server 2.0 with IIS 4.0 - Arbitrary File Upload
Microsoft Site Server 2.0 with IIS 4.0 - Arbitrary File Upload source: https://www.securityfocus.com/bid/1811/info Microsoft Site Server is an intranet server designed for an NT Server with IIS. Site Server enables users to locate and view information stored in various locations through...
Microsoft Site Server 2.0 with IIS 4.0 - Arbitrary File Upload
source: https://www.securityfocus.com/bid/1811/info Microsoft Site Server is an intranet server designed for an NT Server with IIS. Site Server enables users to locate and view information stored in various locations through personalized web pages and emails. The 'Users' directory, if not already...
CVE-1999-0348
IIS ASP caching problem releases sensitive information when two virtual servers share the same physical directory...
CVE-1999-0450
In IIS, an attacker could determine a real path using a request for a non-existent URL that would be interpreted by Perl perl.exe...
CVE-1999-0449
The ExAir sample site in IIS 4 allows remote attackers to cause a denial of service CPU consumption via a direct request to the 1 advsearch.asp, 2 query.asp, or 3 search.asp scripts...
CVE-1999-1544
Buffer overflow in FTP server in Microsoft IIS 3.0 and 4.0 allows local and sometimes remote attackers to cause a denial of service via a long NLST ls command...
Microsoft IIS 4 (Windows NT) - Log Avoidance
// source: https://www.securityfocus.com/bid/191/info An http get request against an IIS4 server will not be logged if the request is longer than 10150 bytes long. / Compile with eg Visual C++ and link with wsock32.lib include include include int main int argc, char argv int snd, rcv, err,...
CVE-1999-1376
Buffer overflow in fpcount.exe in IIS 4.0 with FrontPage Server Extensions allows remote attackers to execute arbitrary commands...
CVE-1999-1538
When IIS 2 or 3 is upgraded to IIS 4, ism.dll is inadvertently left in /scripts/iisadmin, which does not restrict access to the local machine and allows an unauthorized user to gain access to sensitive server information, including the Administrator's password...
Microsoft IIS 4 (Windows NT) - Remote Web-Based Administration
source: https://www.securityfocus.com/bid/189/info Web-based administration for IIS 4.0 is, by default, limited to the local loopback address, 127.0.0.1. In instances where IIS4.0 was installed as an upgrade to IIS 2.0 or 3.0, a legacy ISAPI DLL ISM.DLL is left in the /scripts/iisadmin directory...
Microsoft IIS 4 (Windows NT) - Remote Web-Based Administration
Microsoft IIS 4 Windows NT - Remote Web-Based Administration source: https://www.securityfocus.com/bid/189/info Web-based administration for IIS 4.0 is, by default, limited to the local loopback address, 127.0.0.1. In instances where IIS4.0 was installed as an upgrade to IIS 2.0 or 3.0, a legacy...