CVE-2003-1567

The undocumented TRACK method in Microsoft Internet Information Services IIS 5.0 returns the content of the original request in the body of the response, which makes it easier for remote attackers to steal cookies and authentication credentials, or bypass the HttpOnly protection mechanism, by usi...

sISAPILocation vulnerability bypasses HTTP header rewrite function

Overview sISAPILocation, an ISAPI Internet Server Application Program Interface filter, contains a vulnerability that allows the HTTP header rewrite function to be bypassed. sISAPILocation, developed by an individual developer, is an ISAPI filter for IIS Internet Information Services...

CVE-2008-4301

A certain ActiveX control in iisext.dll in Microsoft Internet Information Services IIS allows remote attackers to set a password via a string argument to the SetPassword method. NOTE: this issue could not be reproduced by a reliable third party. In addition, the original researcher is unreliable...

CVE-2008-4300

CVE-2008-4300 affects a specific ActiveX control in adsiis.dll used by Microsoft Internet Information Services (IIS). The vulnerability allows remote attackers to cause a denial of service (browser crash) by sending a long string as the second argument to the GetObject method. The description not...

PT-2008-5562 · Microsoft · Internet Information Services

Name of the Vulnerable Software and Affected Versions: Microsoft Internet Information Services IIS affected versions not specified Description: A certain ActiveX control in iisext.dll allows remote attackers to set a password via a string argument to the SetPassword method. However, this issue...

Microsoft Windows Indexing Service cross-site scripting vulnerability

Overview Microsoft Windows Indexing Service contains a cross-site scripting vulnerability. Impact If the Indexing Service in Internet Information Services IIS provides search capabilities, an arbitrary script could be executed on the user's web browser. Solution None...

RSA Authentication Agent for Web 5.3 - Open Redirection

source: https://www.securityfocus.com/bid/28907/info RSA Authentication Agent for Web is prone to a remote URI-redirection vulnerability because the application fails to adequately sanitize user-supplied input. A successful attack may aid in phishing-style attacks. This issue affects RSA...

RSA Authentication Agent for Web 5.3 - Open Redirection

RSA Authentication Agent for Web 5.3 - Open Redirection source: https://www.securityfocus.com/bid/28907/info RSA Authentication Agent for Web is prone to a remote URI-redirection vulnerability because the application fails to adequately sanitize user-supplied input. A successful attack may aid in...

Privilege escalation

Microsoft Windows XP Professional SP2, Vista, and Server 2003 and 2008 does not properly assign activities to the 1 NetworkService and 2 LocalService accounts, which might allow context-dependent attackers to gain privileges by using one service process to capture a resource from a second service...

Preemptive Protection against Microsoft Internet Information Services Cross-Site Scripting Vulnerability (MS08-006)

A cross-site scripting XSS vulnerability exists in Microsoft Internet Information Services IIS. IIS is a popular set of Internet-based services for Microsoft Windows servers. Successful exploitation of this vulnerability could result in execution of arbitrary code on the IIS server...

Microsoft Security Bulletin MS08-005 – Important Vulnerability in Internet Information Services Could Allow Elevation of Privilege (942831)

Microsoft Security Bulletin MS08-005 – Important Vulnerability in Internet Information Services Could Allow Elevation of Privilege 942831 Published: February 12, 2008 Version: 1.0 General Information Executive Summary This important update resolves a privately reported vulnerability in Internet...

MS08-005: Vulnerability in Internet Information Services Could Allow Elevation of Privilege (942831)

The remote host contains a version of Microsoft Internet Information Services IIS that is vulnerable to a security flaw that could allow a local user to elevate his privileges to SYSTEM due to a bug in the way IIS handles file change notifications in the FTPRoot, NNTPFile\Root and WWWRoot folders...

Debian: Security Advisory (DSA-180)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 180-1 (nis)

The remote host is missing an update to nis announced via advisory DSA 180-1. OpenVAS Vulnerability Test $Id: deb1801.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 180-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

CMD build under virtual directory-vulnerability warning-the black bar safety net

The following is an ugly beggarweb data separation web and data separated,there was Pcanywhere,the database server has IIS, cscript.exe c:\inetpub\adminscripts\adsutil.vbs get w3svc/1/serverbindings first Web service port cscript.exe c:\inetpub\adminscripts\adsutil.vbs create w3svc/1/root/wodexi/...

Microsoft Security Bulletin MS07-041 - Important Vulnerability in Microsoft Internet Information Services Could Allow Remote Code Execution (939373)

Microsoft Security Bulletin MS07-041 - Important Vulnerability in Microsoft Internet Information Services Could Allow Remote Code Execution 939373 Published: July 10, 2007 Version: 1.0 General Information Executive Summary This important security update resolves a privately reported vulnerability...

MS07-041: Vulnerability in Microsoft Internet Information Services Could Allow Remote Code Execution (939373)

The remote host has a version of IIS that is vulnerable to a remote flaw that could allow an attacker to take the control of the remote web server and execute arbitrary commands on the remote host with the SYSTEM privileges. Tenable Network Security, Inc. include"compat.inc"; if description...

[ISecAuditors Security Advisories] Microsoft IIS5 NTLM and Basic authentication bypass

============================================= INTERNET SECURITY AUDITORS ALERT 2006-013 - Original release date: December 15, 2006 - Last revised: May 22, 2007 - Discovered by: Jesus Olmos Gonzalez - Severity: 5/5 ============================================= I. VULNERABILITY...

Microsoft Internet Information Server点击高亮验证绕过漏洞

Microsoft Internet Information Services IIS是一款功能强大的WEB服务程序。 Microsoft IIS由于对'Hit-highlighting'实现存在问题，远程攻击者可以利用漏洞绕过部分验证访问私有文件，获得敏感信息。 由于对"Hit-highlighting"功能实现存在问题，通过使用"Hit-highlighting"高亮，任何Internet用户可以访问私有WEB目录和任意IISv5 WEB文件。 1. 在 IIS 5.0 Service Pack 2 SP 2, 创建网站根目录 （例如, C:\Inetpub\WWWRoot） 中命名...

CVE-2007-2815

The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services IIS Web Server 5.0 only uses Windows NT ACL configuration, which allows remote attackers to bypass NTLM and basic authentication mechanisms and access private web directories via the CiWebhitsfile...