CVSS: 7.2EPSS: 54%CPEs: 2EXPL: 2CVE-2001-0506 – Microsoft IIS 4.0/5.0 - SSI Buffer Overrun Privilege Escalation
https://notcve.org/view.php?id=CVE-2001-0506
Buffer overflow in ssinc.dll in IIS 5.0 and 4.0 allows local users to gain system privileges via a Server-Side Includes (SSI) directive for a long filename, which triggers the overflow when the directory name is added, aka the "SSI privilege elevation" vulnerability. • https://www.exploit-db.com/exploits/21071 http://marc.info/?l=bugtraq&m=99802093532233&w=2 http://online.securityfocus.com/archive/1/242541 http://www.ciac.org/ciac/bulletins/l-132.shtml http://www.securityfocus.com/bid/3190 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-044 https://exchange.xforce.ibmcloud.com/vulnerabilities/6984 •
CVSS: 5.0EPSS: 14%CPEs: 1EXPL: 0CVE-2001-0709
https://notcve.org/view.php?id=CVE-2001-0709
Microsoft IIS 4.0 and before, when installed on a FAT partition, allows a remote attacker to obtain source code of ASP files via a URL encoded with Unicode. • http://www.securityfocus.com/archive/1/192802 http://www.securityfocus.com/bid/2909 https://exchange.xforce.ibmcloud.com/vulnerabilities/6742 •
CVSS: 10.0EPSS: 96%CPEs: 3EXPL: 6CVE-2001-0500 – Microsoft Index Server 2.0 / Indexing Service (Windows 2000) - ISAPI Extension Buffer Overflow (PoC)
https://notcve.org/view.php?id=CVE-2001-0500
Buffer overflow in ISAPI extension (idq.dll) in Index Server 2.0 and Indexing Service 2000 in IIS 6.0 beta and earlier allows remote attackers to execute arbitrary commands via a long argument to Internet Data Administration (.ida) and Internet Data Query (.idq) files such as default.ida, as commonly exploited by Code Red. • https://www.exploit-db.com/exploits/20930 https://www.exploit-db.com/exploits/16472 https://www.exploit-db.com/exploits/20931 https://www.exploit-db.com/exploits/20933 https://www.exploit-db.com/exploits/20932 http://www.cert.org/advisories/CA-2001-13.html http://www.ciac.org/ciac/bulletins/l-098.shtml http://www.iss.net/security_center/static/6705.php http://www.securityfocus.com/archive/1/191873 http://www.securityfocus.com/bid/2880 https://docs.microso •
CVSS: 5.0EPSS: 5%CPEs: 2EXPL: 3CVE-2001-1243 – Microsoft IIS 4.0/5.0 - Device File Local Denial of Service
https://notcve.org/view.php?id=CVE-2001-1243
Scripting.FileSystemObject in asp.dll for Microsoft IIS 4.0 and 5.0 allows local or remote attackers to cause a denial of service (crash) via (1) creating an ASP program that uses Scripting.FileSystemObject to open a file with an MS-DOS device name, or (2) remotely injecting the device name into ASP programs that internally use Scripting.FileSystemObject. • https://www.exploit-db.com/exploits/20989 https://www.exploit-db.com/exploits/20991 http://www.iss.net/security_center/static/6800.php http://www.securityfocus.com/archive/1/194919 http://www.securityfocus.com/bid/2973 •
CVSS: 5.0EPSS: 2%CPEs: 1EXPL: 0CVE-2001-0335
https://notcve.org/view.php?id=CVE-2001-0335
FTP service in IIS 5.0 and earlier allows remote attackers to enumerate Guest accounts in trusted domains by preceding the username with a special sequence of characters. • http://www.securityfocus.com/bid/2719 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-026 https://exchange.xforce.ibmcloud.com/vulnerabilities/6545 •