Outfront Spooky 2.x - Login SQL Query Manipulation Password

Outfront Spooky 2.x - Login SQL Query Manipulation Password source: https://www.securityfocus.com/bid/4661/info Spooky Login is a commerical web access control and account management software package. It is distributed and maintained by Outfront, and is designed for Microsoft IIS Webservers. Unde...

Microsoft IIS 4.05.0 - Chunked Encoding Transfer Heap Overflow (4)

Microsoft IIS 4.05.0 - Chunked Encoding Transfer Heap Overflow 4 / source: https://www.securityfocus.com/bid/4485/info A heap overflow condition in the 'chunked encoding transfer mechanism' related to Active Server Pages has been reported for Microsoft IIS Internet Information Services. This...

iisfux0r.txt

/ iisfux0r.c - Microsoft IIS W3SVC Denial of Service, c Filip Maertens - PoC BUG-ID : 2002009 CVE : CAN-2002-0072 Advisory : Peter Grundle @ KPMG Dave Aitel @ AtStake This will bring down the Inetinfo.exe process, in which you create a Denial of Service condition on your webserver. Please, confir...

Security Advisory: Microsoft IIS Vulnerabilities in Cisco Products - MS02-018

-----BEGIN PGP SIGNED MESSAGE----- Cisco - Microsoft IIS Vulnerabilities in Cisco Products - MS02-018 Revision 1.0 Public Release 2002 April 15 18:00 UTC -0400 - ------------------------------------------------------------------------------- Contents Summary Affected Products Details Impact...

Microsoft IIS 5.0 CodeBrws.asp Source Disclosure

-- Microsoft IIS 5.0 CodeBrws.asp Source Disclosure Summary: Microsoft's IIS 5.0 web server is shipped with a set of sample files to demonstrate different features of the ASP language. One of these sample files allows a remote user to view the source of any file in the web root with the extension...

Microsoft IIS 5.0 - CodeBrws.asp Source Code Disclosure

Microsoft IIS 5.0 - CodeBrws.asp Source Code Disclosure source: https://www.securityfocus.com/bid/4525/info Microsoft IIS 5.0 ships with a sample script that may be used to view the source code of other scripts in the sample scripts /IISSAMPLES directory. However, this script CodeBrws.asp does no...

Microsoft IIS 5.0 - 'CodeBrws.asp' Source Code Disclosure

source: https://www.securityfocus.com/bid/4525/info Microsoft IIS 5.0 ships with a sample script that may be used to view the source code of other scripts in the sample scripts /IISSAMPLES directory. However, this script CodeBrws.asp does not adequately filter unicode representations of directory...

Microsoft IIS Vulnerabilities in Cisco Products - MS02-018

...

Microsoft IIS 4.0/5.0 - Chunked Encoding Transfer Heap Overflow (2)

// source: https://www.securityfocus.com/bid/4485/info A heap overflow condition in the 'chunked encoding transfer mechanism' related to Active Server Pages has been reported for Microsoft IIS Internet Information Services. This condition affects IIS 4.0 and IIS 5.0. Exploitation of this...

Microsoft IIS 4.05.0 - Chunked Encoding Transfer Heap Overflow (2)

Microsoft IIS 4.05.0 - Chunked Encoding Transfer Heap Overflow 2 // source: https://www.securityfocus.com/bid/4485/info A heap overflow condition in the 'chunked encoding transfer mechanism' related to Active Server Pages has been reported for Microsoft IIS Internet Information Services. This...

Advisory CA-2002-09 Multiple Vulnerabilities in Microsoft IIS

CERT Advisory CA-2002-09 Multiple Vulnerabilities in Microsoft IIS Original release date: April 11, 2002 Last revised: -- Source: CERT/CC A complete revision history can be found at the end of this file. Systems Affected Microsoft IIS 4.0, 5.0, and 5.1 Overview A variety of vulnerabilities exist ...

Cgisecurity Advisory #9: Novell Websearch, and Microsoft IIS XSS Issues

Just two XSS holes. I only bothered releasing them because both microsoft and novell seemed to suffer a similar problem. I like to know about a hole no matter how small it is, if its in a product I use. Advisory www.cgisecurity.com/advisory/9.txt - [email protected] NOTE: Novell issued a patch...

KPMG-2002010: Microsoft IIS .htr ISAPI buffer overrun

-------------------------------------------------------------------- -=Microsoft IIS .htr ISAPI buffer overrun=- courtesy of KPMG Denmark BUG-ID: 2002010 CVE: CAN-2002-0071 Released: 11th Apr 2002 -------------------------------------------------------------------- Problem: ======== There is a...

Microsoft IIS Multiple Remote DoS (MS02-018 / Q319733)

There's a denial of service vulnerability on the remote host in the Front Page ISAPI filter. An attacker may use this flaw to prevent the remote service from working properly. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Thanks to: SPIKE v2.1 : MS02-018 supercedes : MS01-043, MS01-025,...

Microsoft IIS ASP ISAPI Filter Multiple Overflows

There's a buffer overflow in the remote web server through the ASP ISAPI filter. It is possible to overflow the remote web server and execute commands as user 'SYSTEM'. C Tenable Network Security, Inc. Thanks to: Marc Maiffret - his post on vuln-dev saved a lot of my time See the Nessus Scripts...

MS02-018: Microsoft IIS FTP Status Request DoS (uncredentialed check)

It was possible to make the remote FTP server crash by sending the command 'STAT ?AAAAA....AAAAA'. There is a bug in certain versions of Microsoft's FTP server that can be exploited in this fashion. Other FTP servers may also react adversely to such a string. An attacker may leverage this issue t...

Microsoft Internet Information Server (IIS) contains cross-site scripting vulnerability in HTTP error page results

Overview Visitors to web sites that use Microsoft IIS and also use the default error pages are vulnerable to cross-site scripting attacks. Description Cross-site scripting is a form of attack in which an intruder leverages the trust between a victim and a web-site the victim trusts. Quoting from...

Microsoft IIS 4.0/5.0 - Chunked Encoding Transfer Heap Overflow (3)

// source: https://www.securityfocus.com/bid/4485/info A heap overflow condition in the 'chunked encoding transfer mechanism' related to Active Server Pages has been reported for Microsoft IIS Internet Information Services. This condition affects IIS 4.0 and IIS 5.0. Exploitation of this...

Microsoft IIS 4.0/5.0 - HTTP Error Page Cross-Site Scripting

source: https://www.securityfocus.com/bid/4486/info A Cross Site Scripting issue exists in some versions of IIS. The HTTP Error Page created by IIS may, under some circumstances, contain HTML content which includes unsanitized user supplied input. An attacker may construct a link to a vulnerable...

Microsoft IIS 4.05.0 - Chunked Encoding Transfer Heap Overflow (1)

Microsoft IIS 4.05.0 - Chunked Encoding Transfer Heap Overflow 1 // source: https://www.securityfocus.com/bid/4485/info A heap overflow condition in the 'chunked encoding transfer mechanism' related to Active Server Pages has been reported for Microsoft IIS Internet Information Services. This...