IIS ASP caching problem releases sensitive information when two virtual servers share the same physical directory.
Max CVSS
5.0
EPSS Score
0.73%
Published
1999-01-27
Updated
2018-08-13
The installer for BackOffice Server includes account names and passwords in a setup file (reboot.ini) which is not deleted.
Max CVSS
2.1
EPSS Score
0.16%
Published
1999-02-12
Updated
2018-10-12
ICMP information such as (1) netmask and (2) timestamp is allowed from arbitrary hosts.
Max CVSS
2.1
EPSS Score
88.08%
Published
1997-08-01
Updated
2022-11-14
Internet Explorer 5 allows remote attackers to read files via an ExecCommand method called on an IFRAME.
Max CVSS
4.3
EPSS Score
0.71%
Published
1999-10-01
Updated
2021-07-22
Microsoft Java Virtual Machine allows remote attackers to read files via the getSystemResourceAsStream function.
Max CVSS
2.6
EPSS Score
0.43%
Published
2000-01-31
Updated
2008-09-10

CVE-2000-0649

Public exploit
IIS 4.0 allows remote attackers to obtain the internal IP address of the server via an HTTP 1.0 request for a web page which is protected by basic authentication and has no realm defined.
Max CVSS
2.6
EPSS Score
0.36%
Published
2000-07-13
Updated
2020-11-23
Information disclosure vulnerability in Microsoft Windows 2000 telnet service allows remote attackers to determine the existence of user accounts such as Guest, or log in to the server without specifying the domain name, via a malformed userid.
Max CVSS
7.5
EPSS Score
2.08%
Published
2001-07-21
Updated
2018-10-12
Microsoft Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to view arbitrary files that contain the "{" character via script containing the cssText property of the stylesheet object, aka "Local Information Disclosure through HTML Object" vulnerability.
Max CVSS
5.0
EPSS Score
3.30%
Published
2002-05-29
Updated
2021-07-23
Information leaks in IIS 4 through 5.1 allow remote attackers to obtain potentially sensitive information or more easily conduct brute force attacks via responses from the server in which (2) in certain configurations, the server IP address is provided as the realm for Basic authentication, which could reveal real IP addresses that were obscured by NAT, or (3) when NTLM authentication is used, the NetBIOS name of the server and its Windows NT domain are revealed in response to an Authorization request. NOTE: this entry originally contained a vector (1) in which the server reveals whether it supports Basic or NTLM authentication through 401 Access Denied error messages. CVE has REJECTED this vector; it is not a vulnerability because the information is already available through legitimate use, since authentication cannot proceed without specifying a scheme that is supported by both the client and the server.
Max CVSS
5.0
EPSS Score
2.44%
Published
2002-08-12
Updated
2020-11-23

CVE-2002-0422

Public exploit
IIS 5 and 5.1 supporting WebDAV methods allows remote attackers to determine the internal IP address of the system (which may be obscured by NAT) via (1) a PROPFIND HTTP request with a blank Host header, which leaks the address in an HREF property in a 207 Multi-Status response, or (2) via the WRITE or MKCOL method, which leaks the IP in the Location server header.
Max CVSS
2.6
EPSS Score
1.55%
Published
2002-08-12
Updated
2020-11-23
Microsoft Word and Excel allow remote attackers to steal sensitive information via certain field codes that insert the information when the document is returned to the attacker, as demonstrated in Word using (1) INCLUDETEXT or (2) INCLUDEPICTURE, aka "Flaw in Word Fields and Excel External Updates Could Lead to Information Disclosure."
Max CVSS
5.0
EPSS Score
3.41%
Published
2003-04-11
Updated
2018-10-12
Internet Explorer 5.01 through 6.0 does not properly perform security checks on certain encoded characters within a URL, which allows a remote attacker to steal potentially sensitive information from a user by redirecting the user to another site that has that information, aka "Encoded Characters Information Disclosure."
Max CVSS
5.0
EPSS Score
75.35%
Published
2002-12-11
Updated
2021-07-23
Microsoft Internet Information Server (IIS) 5.1 allows remote attackers to view path information via a GET request to (1) /_vti_pvt/access.cnf, (2) /_vti_pvt/botinfs.cnf, (3) /_vti_pvt/bots.cnf, or (4) /_vti_pvt/linkinfo.cnf.
Max CVSS
5.0
EPSS Score
1.02%
Published
2002-12-31
Updated
2020-12-09
Microsoft Internet Information Server (IIS) 5.1 may allow remote attackers to view the contents of a Frontpage Server Extension (FPSE) file, as claimed using an HTTP request for colegal.htm that contains .. (dot dot) sequences.
Max CVSS
5.0
EPSS Score
0.47%
Published
2002-12-31
Updated
2020-12-09
NetDSL ADSL Modem 800 with Microsoft Network firmware 5.5.11 allows remote attackers to gain access to configuration menus by sniffing undocumented usernames and passwords from network traffic.
Max CVSS
6.4
EPSS Score
1.99%
Published
2002-12-31
Updated
2008-09-05
The Cascading Style Sheets (CSS) implementation in Microsoft Internet Explorer 8.0 and earlier does not properly handle the :visited pseudo-class, which allows remote attackers to obtain sensitive information about visited web pages via a crafted HTML document, a related issue to CVE-2010-2264.
Max CVSS
4.3
EPSS Score
0.58%
Published
2011-12-07
Updated
2021-07-23
Multiple ethernet Network Interface Card (NIC) device drivers do not pad frames with null bytes, which allows remote attackers to obtain information from previous packets or kernel memory by using malformed packets, as demonstrated by Etherleak.
Max CVSS
5.0
EPSS Score
2.33%
Published
2003-01-17
Updated
2019-04-30
Microsoft Outlook 2002 does not properly handle requests to encrypt email messages with V1 Exchange Server Security certificates, which causes Outlook to send the email in plaintext, aka "Flaw in how Outlook 2002 handles V1 Exchange Server Security Certificates could lead to Information Disclosure."
Max CVSS
5.0
EPSS Score
0.31%
Published
2003-02-07
Updated
2018-10-12
Microsoft Exchange 2003 and Outlook Web Access (OWA), when configured to use NTLM authentication, does not properly reuse HTTP connections, which can cause OWA users to view mailboxes of other users when Kerberos has been disabled as an authentication method for IIS 6.0, e.g. when SharePoint Services 2.0 is installed.
Max CVSS
6.0
EPSS Score
0.53%
Published
2004-01-20
Updated
2020-04-09
Microsoft Internet Explorer 5.22, and other 5 through 6 SP1 versions, sends Referer headers containing https:// URLs in requests for http:// URLs, which allows remote attackers to obtain potentially sensitive information by reading Referer log data.
Max CVSS
5.0
EPSS Score
2.13%
Published
2003-12-31
Updated
2021-07-23
The undocumented TRACK method in Microsoft Internet Information Services (IIS) 5.0 returns the content of the original request in the body of the response, which makes it easier for remote attackers to steal cookies and authentication credentials, or bypass the HttpOnly protection mechanism, by using TRACK to read the contents of the HTTP headers that are returned in the response, a technique that is similar to cross-site tracing (XST) using HTTP TRACE.
Max CVSS
5.8
EPSS Score
4.23%
Published
2009-01-15
Updated
2009-01-16
Microsoft Internet Explorer allows remote attackers to bypass cross-domain security restrictions and obtain sensitive information by using the @import directive to download files from other domains that are not valid Cascading Style Sheets (CSS) files, as demonstrated using Google Desktop, aka "CSSXSS" and "CSS Cross-Domain Information Disclosure Vulnerability."
Max CVSS
7.1
EPSS Score
95.76%
Published
2005-12-08
Updated
2021-07-23
The Server Service (SRV.SYS driver) in Microsoft Windows 2000 SP4, XP SP1 and SP2, Server 2003 up to SP1, and other products, allows remote attackers to obtain sensitive information via crafted requests that leak information in SMB buffers, which are not properly initialized, aka "SMB Information Disclosure Vulnerability."
Max CVSS
5.0
EPSS Score
10.94%
Published
2006-07-11
Updated
2018-10-18
A component in Microsoft Outlook Express 6 allows remote attackers to bypass domain restrictions and obtain sensitive information via redirections with the mhtml: URI handler, as originally reported for Internet Explorer 6 and 7, aka "URL Redirect Cross Domain Information Disclosure Vulnerability."
Max CVSS
4.3
EPSS Score
7.87%
Published
2006-05-01
Updated
2018-10-18
Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to conduct spoofing and phishing attacks by using a modal browser window in a way that preserves the original address bar and trusted UI of a trusted site, even after the browser has been navigated to a malicious site, aka the "Address Bar Spoofing Vulnerability."
Max CVSS
4.3
EPSS Score
13.35%
Published
2006-06-13
Updated
2021-07-23
1357 vulnerabilities found
1 2 3 4 5 6 ...... 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!