2834 matches found
Exploit for Classic Buffer Overflow in Microsoft
PoC exploit for CVE-2017-7269, a vulnerability in Microsoft Inte...
PT-2025-38499
CVE-2025-10572 - Microsoft IIS Unvalidated Redirect CVE ID : CVE-2025-10572 Published : Sept. 16, 2025, 6:15 p.m. | 43 minutes ago Description : Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2025-9199. Reason: This candidate is a reservation duplicate of CVE-2025-9199...
GhostRedirector Hacks 65 Windows Servers Using Rungan Backdoor and Gamshen IIS Module
Cybersecurity researchers have lifted the lid on a previously undocumented threat cluster dubbed GhostRedirector that has managed to compromise at least 65 Windows servers primarily located in Brazil, Thailand, and Vietnam. The attacks, per Slovak cybersecurity company ESET, led to the deployment...
CVE-2010-20112 Amlibweb NetOpacs webquery.dll Stack Buffer Overflow
Amlib’s NetOpacs webquery.dll contains a stack-based buffer overflow vulnerability triggered by improper handling of HTTP GET parameters. Specifically, the application fails to enforce bounds on input supplied to the app parameter, allowing excessive data to overwrite memory structures including...
CVE-2025-8516 Kingdee Cloud-Starry-Sky Enterprise Edition IIS-K3CloudMiniApp FileUploadAction.class path traversal
A security vulnerability has been detected in Kingdee Cloud-Starry-Sky Enterprise Edition up to 8.2. This issue affects the function BaseServiceFactory.getFileUploadService.deleteFileAction of the file...
CVE-2025-52891 ModSecurity empty XML tag causes segmentation fault
ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2.9.11, an empty XML tag can cause a segmentation fault. If SecParseXmlIntoArgs is set to On or OnlyArgs, and the request type is application/xml, and at least...
Trimble Cityworks 15.x < 15.8.9 / 23.x < 23.10 Deserialization RCE
The version of Trimble Cityworks installed on the remote host is 15.x prior to 15.8.9, or 23.x prior to 23.10. It is, therefore, affected by a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer's Microsoft Internet...
Citrix Director Infrastructure Monitoring - Incorrect IIS Certificate Validity status
When admin checks Storefront metrics in Citrix Director under Infrastructure Monitoring, incorrect IIS Certificate Validity status is displayed. All other metrics are displayed correctly. Example: StoreFront Details: Storefront is configured with correct certificate and a certificate chain is...
CVE-2025-2407 Missing Authentication & Authorization in Web-API allows adversary unrestricted access
Missing Authentication & Authorization in Web-API in Mobatime AMX MTAPI v6 on IIS allows adversaries to unrestricted access via the network. The vulnerability is fixed in Version 1.5...
CVE-2022-36664
Password Manager for IIS 2.0 has a cross-site scripting XSS vulnerability via the /isapi/PasswordManager.dll ResultURL parameter...
CVE-2020-0645
A tampering vulnerability exists when Microsoft IIS Server improperly handles malformed request headers, aka 'Microsoft IIS Server Tampering Vulnerability'...
CVE-2010-1886
Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 SP2 and R2, and Windows 7 allow local users to gain privileges by leveraging access to a process with NetworkService credentials, as demonstrated by TAPI Server, SQL Server, and IIS processes...
CVE-2019-1365
An elevation of privilege vulnerability exists when Microsoft IIS Server fails to check the length of a buffer prior to copying memory to it.An attacker who successfully exploited this vulnerability can allow an unprivileged function ran by the user to execute code in the context of NT...
CVE-2019-11989
A security vulnerability in HPE IceWall SSO Agent Option and IceWall MFA Agent module could be exploited remotely to cause a denial of service. The versions and platforms of Agent Option modules that are impacted are as follows: 10.0 for Apache 2.2 on RHEL 5 and 6, 10.0 for Apache 2.4 on RHEL 7,...
CVE-2003-1567
The undocumented TRACK method in Microsoft Internet Information Services IIS 5.0 returns the content of the original request in the body of the response, which makes it easier for remote attackers to steal cookies and authentication credentials, or bypass the HttpOnly protection mechanism, by usi...
CVE-2002-1876
Microsoft Exchange 2000 allows remote authenticated attackers to cause a denial of service via a large number of rapid requests, which consumes all of the licenses that are granted to Exchange by IIS...
CVE-2025-47947
ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in one special case in stable released versions: when the payload's content type is application/json, and there is at...
CVE-2002-1992
Buffer overflow in jrun.dll in ColdFusion MX, when used with IIS 4 or 5, allows remote attackers to cause a denial of service in IIS via 1 a long template file name or 2 a long HTTP header...
CVE-2002-1908
Microsoft IIS 5.0 and 5.1 allows remote attackers to cause a denial of service CPU consumption via an HTTP request with a Host header that contains a large number of "/" forward slash characters...