All the vulnerabilites related to microsoft - site_server_commerce
Vulnerability from fkie_nvd
Published
1999-12-21 05:00
Modified
2024-11-20 23:31
Severity ?
Summary
IIS does not properly canonicalize URLs, potentially allowing remote attackers to bypass access restrictions in third-party software via escape characters, aka the "Escape Character Parsing" vulnerability.
References
cve@mitre.orghttp://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ246401
cve@mitre.orghttp://www.acrossecurity.com/aspr/ASPR-1999-11-10-1-PUB.txt
cve@mitre.orghttps://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-061
af854a3a-2127-422b-91ae-364da2661108http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ246401
af854a3a-2127-422b-91ae-364da2661108http://www.acrossecurity.com/aspr/ASPR-1999-11-10-1-PUB.txt
af854a3a-2127-422b-91ae-364da2661108https://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-061
Impacted products
Vendor Product Version
microsoft internet_information_server 4.0
microsoft site_server 3.0
microsoft site_server_commerce 3.0


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:internet_information_server:4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "5D47E9C4-5439-4A82-BBD8-D6B482B47E51",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:site_server:3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "4A503018-356B-46D9-965F-60750B5B7484",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:site_server_commerce:3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DD78B678-82A4-4485-BC4A-809A5FB105E9",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IIS does not properly canonicalize URLs, potentially allowing remote attackers to bypass access restrictions in third-party software via escape characters, aka the \"Escape Character Parsing\" vulnerability."
    }
  ],
  "id": "CVE-2000-0024",
  "lastModified": "2024-11-20T23:31:33.050",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 6.4,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 4.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "1999-12-21T05:00:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ246401"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.acrossecurity.com/aspr/ASPR-1999-11-10-1-PUB.txt"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-061"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ246401"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.acrossecurity.com/aspr/ASPR-1999-11-10-1-PUB.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-061"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
1999-12-21 05:00
Modified
2024-11-20 23:31
Severity ?
Summary
IIS 4.0 and Site Server 3.0 allow remote attackers to read source code for ASP files if the file is in a virtual directory whose name includes extensions such as .com, .exe, .sh, .cgi, or .dll, aka the "Virtual Directory Naming" vulnerability.
References
cve@mitre.orghttp://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ238606
cve@mitre.orghttp://www.osvdb.org/8098
cve@mitre.orghttps://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-058
af854a3a-2127-422b-91ae-364da2661108http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ238606
af854a3a-2127-422b-91ae-364da2661108http://www.osvdb.org/8098
af854a3a-2127-422b-91ae-364da2661108https://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-058
Impacted products
Vendor Product Version
microsoft internet_information_server 4.0
microsoft site_server 3.0
microsoft site_server_commerce 3.0


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:internet_information_server:4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "5D47E9C4-5439-4A82-BBD8-D6B482B47E51",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:site_server:3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "4A503018-356B-46D9-965F-60750B5B7484",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:site_server_commerce:3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DD78B678-82A4-4485-BC4A-809A5FB105E9",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IIS 4.0 and Site Server 3.0 allow remote attackers to read source code for ASP files if the file is in a virtual directory whose name includes extensions such as .com, .exe, .sh, .cgi, or .dll, aka the \"Virtual Directory Naming\" vulnerability."
    }
  ],
  "id": "CVE-2000-0025",
  "lastModified": "2024-11-20T23:31:33.197",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "1999-12-21T05:00:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ238606"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.osvdb.org/8098"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-058"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ238606"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.osvdb.org/8098"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-058"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2002-12-31 05:00
Modified
2024-11-20 23:42
Severity ?
Summary
cphost.dll in Microsoft Site Server 3.0 allows remote attackers to cause a denial of service (disk consumption) via an HTTP POST of a file with a long TargetURL parameter, which causes Site Server to abort and leaves the uploaded file in c:\temp.
References
cve@mitre.orghttp://archives.neohapsis.com/archives/vulnwatch/2002-q1/0033.html
cve@mitre.orghttp://www.iss.net/security_center/static/8053.php
cve@mitre.orghttp://www.securityfocus.com/bid/4002
af854a3a-2127-422b-91ae-364da2661108http://archives.neohapsis.com/archives/vulnwatch/2002-q1/0033.html
af854a3a-2127-422b-91ae-364da2661108http://www.iss.net/security_center/static/8053.php
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/4002
Impacted products
Vendor Product Version
microsoft site_server 3.0
microsoft site_server 3.0
microsoft site_server 3.0
microsoft site_server 3.0
microsoft site_server 3.0
microsoft site_server 3.0
microsoft site_server 3.0
microsoft site_server 3.0
microsoft site_server 3.0
microsoft site_server 3.0
microsoft site_server_commerce 3.0
microsoft site_server_commerce 3.0
microsoft site_server_commerce 3.0
microsoft site_server_commerce 3.0
microsoft site_server_commerce 3.0
microsoft site_server_commerce 3.0


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:site_server:3.0:*:i386:*:*:*:*:*",
              "matchCriteriaId": "91135137-B22A-4781-B00F-16694DCD79E1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:site_server:3.0:apha:*:*:*:*:*:*",
              "matchCriteriaId": "FB1FE371-F651-4C19-AF3B-010377CA1317",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:site_server:3.0:sp1:i386:*:*:*:*:*",
              "matchCriteriaId": "C564694A-4F12-4F60-927A-3A44285F9CE1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:site_server:3.0:sp1_alpha:*:*:*:*:*:*",
              "matchCriteriaId": "AC0E3DFF-4350-4D9B-8A71-F40F53309C79",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:site_server:3.0:sp2:i386:*:*:*:*:*",
              "matchCriteriaId": "C2E57145-267A-4821-96AC-547C8DD760AC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:site_server:3.0:sp2_alpha:*:*:*:*:*:*",
              "matchCriteriaId": "AE95FF1F-DC1E-4F88-8787-E3BE137672DC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:site_server:3.0:sp3:i386:*:*:*:*:*",
              "matchCriteriaId": "68595843-FF27-4BBC-9F41-84C18C4F38A1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:site_server:3.0:sp3_alpha:*:*:*:*:*:*",
              "matchCriteriaId": "9A2D72A5-8C8F-4461-B8F8-3ECC8CE50F23",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:site_server:3.0:sp4:i386:*:*:*:*:*",
              "matchCriteriaId": "FEE4B545-9001-4420-AA0C-F2B59C13BC59",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:site_server:3.0:sp4_alpha:*:*:*:*:*:*",
              "matchCriteriaId": "41CAE3CE-1784-42B0-8458-1C6DCE5995C6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:site_server_commerce:3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DD78B678-82A4-4485-BC4A-809A5FB105E9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:site_server_commerce:3.0:alpha:*:*:*:*:*:*",
              "matchCriteriaId": "35EBE0A3-F521-4B04-95B7-3C57D3090A20",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:site_server_commerce:3.0:sp1_alpha:*:*:*:*:*:*",
              "matchCriteriaId": "FF88B4B1-509D-42BE-9694-B42CBA3F0F99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:site_server_commerce:3.0:sp2_alpha:*:*:*:*:*:*",
              "matchCriteriaId": "5E666F3A-DB90-451F-B65F-618F51308E42",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:site_server_commerce:3.0:sp3_alpha:*:*:*:*:*:*",
              "matchCriteriaId": "20BC46F5-9CDD-44B5-8979-57F811C52C0E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:site_server_commerce:3.0:sp4_alpha:*:*:*:*:*:*",
              "matchCriteriaId": "A70C4EA8-5E75-436C-857C-35912C35BAE6",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "cphost.dll in Microsoft Site Server 3.0 allows remote attackers to cause a denial of service (disk consumption) via an HTTP POST of a file with a long TargetURL parameter, which causes Site Server to abort and leaves the uploaded file in c:\\temp."
    }
  ],
  "id": "CVE-2002-2081",
  "lastModified": "2024-11-20T23:42:49.833",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2002-12-31T05:00:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://archives.neohapsis.com/archives/vulnwatch/2002-q1/0033.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.iss.net/security_center/static/8053.php"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/4002"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://archives.neohapsis.com/archives/vulnwatch/2002-q1/0033.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.iss.net/security_center/static/8053.php"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/4002"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
1999-08-11 04:00
Modified
2024-11-20 23:29
Severity ?
Summary
Race condition in the SSL ISAPI filter in IIS and other servers may leak information in plaintext.
References
cve@mitre.orghttp://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ244613
cve@mitre.orghttps://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-053
af854a3a-2127-422b-91ae-364da2661108http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ244613
af854a3a-2127-422b-91ae-364da2661108https://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-053
Impacted products
Vendor Product Version
microsoft commercial_internet_system 2.0
microsoft commercial_internet_system 2.5
microsoft internet_information_server 4.0
microsoft site_server 3.0
microsoft site_server_commerce 3.0


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:commercial_internet_system:2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "81514AB5-388D-4D13-B63A-C237A502B86A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:commercial_internet_system:2.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "879AFDCC-B9D8-41EF-85DD-70CC1BD5227C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:internet_information_server:4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "5D47E9C4-5439-4A82-BBD8-D6B482B47E51",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:site_server:3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "4A503018-356B-46D9-965F-60750B5B7484",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:site_server_commerce:3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DD78B678-82A4-4485-BC4A-809A5FB105E9",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Race condition in the SSL ISAPI filter in IIS and other servers may leak information in plaintext."
    }
  ],
  "id": "CVE-1999-0861",
  "lastModified": "2024-11-20T23:29:42.853",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "HIGH",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 2.6,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 4.9,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "1999-08-11T04:00:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ244613"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-053"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ244613"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-053"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-362"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2000-03-30 05:00
Modified
2024-11-20 23:32
Severity ?
Summary
IIS 4.0 and 5.0 does not properly perform ISAPI extension processing if a virtual directory is mapped to a UNC share, which allows remote attackers to read the source code of ASP and other files, aka the "Virtualized UNC Share" vulnerability.
References
cve@mitre.orghttp://www.microsoft.com/technet/support/kb.asp?ID=249599
cve@mitre.orghttp://www.securityfocus.com/bid/1081
cve@mitre.orghttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-019
af854a3a-2127-422b-91ae-364da2661108http://www.microsoft.com/technet/support/kb.asp?ID=249599
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/1081
af854a3a-2127-422b-91ae-364da2661108https://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-019
Impacted products
Vendor Product Version
microsoft commercial_internet_system 2.0
microsoft commercial_internet_system 2.5
microsoft internet_information_server 4.0
microsoft internet_information_services 5.0
microsoft proxy_server 2.0
microsoft site_server 3.0
microsoft site_server_commerce 3.0


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:commercial_internet_system:2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "81514AB5-388D-4D13-B63A-C237A502B86A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:commercial_internet_system:2.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "879AFDCC-B9D8-41EF-85DD-70CC1BD5227C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:internet_information_server:4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "5D47E9C4-5439-4A82-BBD8-D6B482B47E51",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:internet_information_services:5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "413C07EA-139F-4B7D-A58B-835BD2591FA0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:proxy_server:2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "2F7BF233-8DE6-4DC4-B9ED-5D4A180DD8B9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:site_server:3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "4A503018-356B-46D9-965F-60750B5B7484",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:site_server_commerce:3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DD78B678-82A4-4485-BC4A-809A5FB105E9",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IIS 4.0 and 5.0 does not properly perform ISAPI extension processing if a virtual directory is mapped to a UNC share, which allows remote attackers to read the source code of ASP and other files, aka the \"Virtualized UNC Share\" vulnerability."
    }
  ],
  "id": "CVE-2000-0246",
  "lastModified": "2024-11-20T23:32:03.593",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2000-03-30T05:00:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://www.microsoft.com/technet/support/kb.asp?ID=249599"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/1081"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-019"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.microsoft.com/technet/support/kb.asp?ID=249599"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/1081"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-019"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2002-12-31 05:00
Modified
2024-11-20 23:42
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the default ASP pages on Microsoft Site Server 3.0 on Windows NT 4.0 allows remote attackers to inject arbitrary web script or HTML via the (1) ctr parameter in Default.asp and (2) the query string to formslogin.asp.
References
cve@mitre.orghttp://marc.info/?l=vulnwatch&m=101235440104716&w=2
cve@mitre.orghttp://www.iss.net/security_center/static/8050.php
cve@mitre.orghttp://www.securityfocus.com/bid/3999Exploit, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=vulnwatch&m=101235440104716&w=2
af854a3a-2127-422b-91ae-364da2661108http://www.iss.net/security_center/static/8050.php
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/3999Exploit, Vendor Advisory
Impacted products
Vendor Product Version
microsoft site_server 3.0
microsoft site_server_commerce 3.0
microsoft windows_nt 4.0


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:site_server:3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "4A503018-356B-46D9-965F-60750B5B7484",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:site_server_commerce:3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DD78B678-82A4-4485-BC4A-809A5FB105E9",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows_nt:4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "E53CDA8E-50A8-4509-B070-CCA5604FFB21",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in the default ASP pages on Microsoft Site Server 3.0 on Windows NT 4.0 allows remote attackers to inject arbitrary web script or HTML via the (1) ctr parameter in Default.asp and (2) the query string to formslogin.asp."
    }
  ],
  "id": "CVE-2002-2073",
  "lastModified": "2024-11-20T23:42:48.663",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2002-12-31T05:00:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://marc.info/?l=vulnwatch\u0026m=101235440104716\u0026w=2"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.iss.net/security_center/static/8050.php"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "http://www.securityfocus.com/bid/3999"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://marc.info/?l=vulnwatch\u0026m=101235440104716\u0026w=2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.iss.net/security_center/static/8050.php"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "http://www.securityfocus.com/bid/3999"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
1999-09-10 04:00
Modified
2024-11-20 23:29
Severity ?
Summary
Microsoft Site Server and Commercial Internet System (MCIS) do not set an expiration for a cookie, which could then be cached by a proxy and inadvertently used by a different user.
References
cve@mitre.orghttp://www.securityfocus.com/bid/625
cve@mitre.orghttps://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-035
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/625
af854a3a-2127-422b-91ae-364da2661108https://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-035
Impacted products
Vendor Product Version
microsoft commercial_internet_system 2.0
microsoft commercial_internet_system 2.5
microsoft site_server 3.0
microsoft site_server_commerce 3.0


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:commercial_internet_system:2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "81514AB5-388D-4D13-B63A-C237A502B86A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:commercial_internet_system:2.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "879AFDCC-B9D8-41EF-85DD-70CC1BD5227C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:site_server:3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "4A503018-356B-46D9-965F-60750B5B7484",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:site_server_commerce:3.0:alpha:*:*:*:*:*:*",
              "matchCriteriaId": "35EBE0A3-F521-4B04-95B7-3C57D3090A20",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Microsoft Site Server and Commercial Internet System (MCIS) do not set an expiration for a cookie, which could then be cached by a proxy and inadvertently used by a different user."
    }
  ],
  "id": "CVE-1999-0910",
  "lastModified": "2024-11-20T23:29:49.693",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "1999-09-10T04:00:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/625"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-035"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/625"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-035"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2002-12-31 05:00
Modified
2024-11-20 23:42
Severity ?
Summary
Microsoft Site Server 3.0 prior to SP4 installs a default user, LDAP_Anonymous, with a default password of LdapPassword_1, which allows remote attackers the "Log on locally" privilege.
References
cve@mitre.orghttp://archives.neohapsis.com/archives/vulnwatch/2002-q1/0033.htmlVendor Advisory
cve@mitre.orghttp://online.securityfocus.com/advisories/3843Vendor Advisory
cve@mitre.orghttp://support.microsoft.com/default.aspx?scid=kb%3Ben-us%3BQ248840
cve@mitre.orghttp://www.securityfocus.com/bid/3998Patch
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/8048
af854a3a-2127-422b-91ae-364da2661108http://archives.neohapsis.com/archives/vulnwatch/2002-q1/0033.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://online.securityfocus.com/advisories/3843Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://support.microsoft.com/default.aspx?scid=kb%3Ben-us%3BQ248840
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/3998Patch
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/8048
Impacted products
Vendor Product Version
microsoft site_server 3.0
microsoft site_server 3.0
microsoft site_server 3.0
microsoft site_server 3.0
microsoft site_server 3.0
microsoft site_server 3.0
microsoft site_server 3.0
microsoft site_server 3.0
microsoft site_server_commerce 3.0
microsoft site_server_commerce 3.0
microsoft site_server_commerce 3.0
microsoft site_server_commerce 3.0
microsoft site_server_commerce 3.0


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:site_server:3.0:*:i386:*:*:*:*:*",
              "matchCriteriaId": "91135137-B22A-4781-B00F-16694DCD79E1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:site_server:3.0:apha:*:*:*:*:*:*",
              "matchCriteriaId": "FB1FE371-F651-4C19-AF3B-010377CA1317",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:site_server:3.0:sp1:i386:*:*:*:*:*",
              "matchCriteriaId": "C564694A-4F12-4F60-927A-3A44285F9CE1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:site_server:3.0:sp1_alpha:*:*:*:*:*:*",
              "matchCriteriaId": "AC0E3DFF-4350-4D9B-8A71-F40F53309C79",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:site_server:3.0:sp2:i386:*:*:*:*:*",
              "matchCriteriaId": "C2E57145-267A-4821-96AC-547C8DD760AC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:site_server:3.0:sp2_alpha:*:*:*:*:*:*",
              "matchCriteriaId": "AE95FF1F-DC1E-4F88-8787-E3BE137672DC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:site_server:3.0:sp3:i386:*:*:*:*:*",
              "matchCriteriaId": "68595843-FF27-4BBC-9F41-84C18C4F38A1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:site_server:3.0:sp3_alpha:*:*:*:*:*:*",
              "matchCriteriaId": "9A2D72A5-8C8F-4461-B8F8-3ECC8CE50F23",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:site_server_commerce:3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DD78B678-82A4-4485-BC4A-809A5FB105E9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:site_server_commerce:3.0:alpha:*:*:*:*:*:*",
              "matchCriteriaId": "35EBE0A3-F521-4B04-95B7-3C57D3090A20",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:site_server_commerce:3.0:sp1_alpha:*:*:*:*:*:*",
              "matchCriteriaId": "FF88B4B1-509D-42BE-9694-B42CBA3F0F99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:site_server_commerce:3.0:sp2_alpha:*:*:*:*:*:*",
              "matchCriteriaId": "5E666F3A-DB90-451F-B65F-618F51308E42",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:site_server_commerce:3.0:sp3_alpha:*:*:*:*:*:*",
              "matchCriteriaId": "20BC46F5-9CDD-44B5-8979-57F811C52C0E",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Microsoft Site Server 3.0 prior to SP4 installs a default user, LDAP_Anonymous, with a default password of LdapPassword_1, which allows remote attackers the \"Log on locally\" privilege."
    }
  ],
  "id": "CVE-2002-1769",
  "lastModified": "2024-11-20T23:42:05.007",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": true,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2002-12-31T05:00:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://archives.neohapsis.com/archives/vulnwatch/2002-q1/0033.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://online.securityfocus.com/advisories/3843"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://support.microsoft.com/default.aspx?scid=kb%3Ben-us%3BQ248840"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/3998"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/8048"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://archives.neohapsis.com/archives/vulnwatch/2002-q1/0033.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://online.securityfocus.com/advisories/3843"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://support.microsoft.com/default.aspx?scid=kb%3Ben-us%3BQ248840"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/3998"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/8048"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

cve-1999-0861
Vulnerability from cvelistv5
Published
2000-01-04 05:00
Modified
2024-08-01 16:55
Severity ?
Summary
Race condition in the SSL ISAPI filter in IIS and other servers may leak information in plaintext.
References
http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ244613vendor-advisory, x_refsource_MSKB
https://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-053vendor-advisory, x_refsource_MS
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T16:55:27.902Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Q244613",
            "tags": [
              "vendor-advisory",
              "x_refsource_MSKB",
              "x_transferred"
            ],
            "url": "http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ244613"
          },
          {
            "name": "MS99-053",
            "tags": [
              "vendor-advisory",
              "x_refsource_MS",
              "x_transferred"
            ],
            "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-053"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "1999-12-02T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Race condition in the SSL ISAPI filter in IIS and other servers may leak information in plaintext."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2005-11-02T10:00:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "Q244613",
          "tags": [
            "vendor-advisory",
            "x_refsource_MSKB"
          ],
          "url": "http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ244613"
        },
        {
          "name": "MS99-053",
          "tags": [
            "vendor-advisory",
            "x_refsource_MS"
          ],
          "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-053"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-1999-0861",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Race condition in the SSL ISAPI filter in IIS and other servers may leak information in plaintext."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "Q244613",
              "refsource": "MSKB",
              "url": "http://support.microsoft.com/default.aspx?scid=kb;[LN];Q244613"
            },
            {
              "name": "MS99-053",
              "refsource": "MS",
              "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-053"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-1999-0861",
    "datePublished": "2000-01-04T05:00:00",
    "dateReserved": "1999-12-07T00:00:00",
    "dateUpdated": "2024-08-01T16:55:27.902Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2002-2073
Vulnerability from cvelistv5
Published
2005-07-14 04:00
Modified
2024-08-08 03:51
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the default ASP pages on Microsoft Site Server 3.0 on Windows NT 4.0 allows remote attackers to inject arbitrary web script or HTML via the (1) ctr parameter in Default.asp and (2) the query string to formslogin.asp.
References
http://marc.info/?l=vulnwatch&m=101235440104716&w=2mailing-list, x_refsource_VULNWATCH
http://www.iss.net/security_center/static/8050.phpvdb-entry, x_refsource_XF
http://www.securityfocus.com/bid/3999vdb-entry, x_refsource_BID
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-08T03:51:17.553Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20020130 RFP2201: MS Site Server Evilness",
            "tags": [
              "mailing-list",
              "x_refsource_VULNWATCH",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=vulnwatch\u0026m=101235440104716\u0026w=2"
          },
          {
            "name": "siteserver-asp-css(8050)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "http://www.iss.net/security_center/static/8050.php"
          },
          {
            "name": "3999",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/3999"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2002-01-29T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in the default ASP pages on Microsoft Site Server 3.0 on Windows NT 4.0 allows remote attackers to inject arbitrary web script or HTML via the (1) ctr parameter in Default.asp and (2) the query string to formslogin.asp."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-10-17T13:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20020130 RFP2201: MS Site Server Evilness",
          "tags": [
            "mailing-list",
            "x_refsource_VULNWATCH"
          ],
          "url": "http://marc.info/?l=vulnwatch\u0026m=101235440104716\u0026w=2"
        },
        {
          "name": "siteserver-asp-css(8050)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "http://www.iss.net/security_center/static/8050.php"
        },
        {
          "name": "3999",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/3999"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2002-2073",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in the default ASP pages on Microsoft Site Server 3.0 on Windows NT 4.0 allows remote attackers to inject arbitrary web script or HTML via the (1) ctr parameter in Default.asp and (2) the query string to formslogin.asp."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20020130 RFP2201: MS Site Server Evilness",
              "refsource": "VULNWATCH",
              "url": "http://marc.info/?l=vulnwatch\u0026m=101235440104716\u0026w=2"
            },
            {
              "name": "siteserver-asp-css(8050)",
              "refsource": "XF",
              "url": "http://www.iss.net/security_center/static/8050.php"
            },
            {
              "name": "3999",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/3999"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2002-2073",
    "datePublished": "2005-07-14T04:00:00",
    "dateReserved": "2005-07-14T00:00:00",
    "dateUpdated": "2024-08-08T03:51:17.553Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2000-0024
Vulnerability from cvelistv5
Published
2000-04-25 04:00
Modified
2024-08-08 04:58
Severity ?
Summary
IIS does not properly canonicalize URLs, potentially allowing remote attackers to bypass access restrictions in third-party software via escape characters, aka the "Escape Character Parsing" vulnerability.
References
http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ246401vendor-advisory, x_refsource_MSKB
http://www.acrossecurity.com/aspr/ASPR-1999-11-10-1-PUB.txtx_refsource_MISC
https://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-061vendor-advisory, x_refsource_MS
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-08T04:58:11.684Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Q246401",
            "tags": [
              "vendor-advisory",
              "x_refsource_MSKB",
              "x_transferred"
            ],
            "url": "http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ246401"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.acrossecurity.com/aspr/ASPR-1999-11-10-1-PUB.txt"
          },
          {
            "name": "MS99-061",
            "tags": [
              "vendor-advisory",
              "x_refsource_MS",
              "x_transferred"
            ],
            "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-061"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "1999-12-21T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "IIS does not properly canonicalize URLs, potentially allowing remote attackers to bypass access restrictions in third-party software via escape characters, aka the \"Escape Character Parsing\" vulnerability."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2005-11-02T10:00:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "Q246401",
          "tags": [
            "vendor-advisory",
            "x_refsource_MSKB"
          ],
          "url": "http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ246401"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.acrossecurity.com/aspr/ASPR-1999-11-10-1-PUB.txt"
        },
        {
          "name": "MS99-061",
          "tags": [
            "vendor-advisory",
            "x_refsource_MS"
          ],
          "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-061"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2000-0024",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "IIS does not properly canonicalize URLs, potentially allowing remote attackers to bypass access restrictions in third-party software via escape characters, aka the \"Escape Character Parsing\" vulnerability."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "Q246401",
              "refsource": "MSKB",
              "url": "http://support.microsoft.com/default.aspx?scid=kb;[LN];Q246401"
            },
            {
              "name": "http://www.acrossecurity.com/aspr/ASPR-1999-11-10-1-PUB.txt",
              "refsource": "MISC",
              "url": "http://www.acrossecurity.com/aspr/ASPR-1999-11-10-1-PUB.txt"
            },
            {
              "name": "MS99-061",
              "refsource": "MS",
              "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-061"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2000-0024",
    "datePublished": "2000-04-25T04:00:00",
    "dateReserved": "2000-01-11T00:00:00",
    "dateUpdated": "2024-08-08T04:58:11.684Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2002-2081
Vulnerability from cvelistv5
Published
2005-07-14 04:00
Modified
2024-09-17 04:20
Severity ?
Summary
cphost.dll in Microsoft Site Server 3.0 allows remote attackers to cause a denial of service (disk consumption) via an HTTP POST of a file with a long TargetURL parameter, which causes Site Server to abort and leaves the uploaded file in c:\temp.
References
http://www.securityfocus.com/bid/4002vdb-entry, x_refsource_BID
http://archives.neohapsis.com/archives/vulnwatch/2002-q1/0033.htmlmailing-list, x_refsource_VULNWATCH
http://www.iss.net/security_center/static/8053.phpvdb-entry, x_refsource_XF
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-08T03:51:17.361Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "4002",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/4002"
          },
          {
            "name": "20020129 RFP2201: MS Site Server Evilness",
            "tags": [
              "mailing-list",
              "x_refsource_VULNWATCH",
              "x_transferred"
            ],
            "url": "http://archives.neohapsis.com/archives/vulnwatch/2002-q1/0033.html"
          },
          {
            "name": "siteserver-cphost-upload-dos(8053)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "http://www.iss.net/security_center/static/8053.php"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "cphost.dll in Microsoft Site Server 3.0 allows remote attackers to cause a denial of service (disk consumption) via an HTTP POST of a file with a long TargetURL parameter, which causes Site Server to abort and leaves the uploaded file in c:\\temp."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2005-07-14T04:00:00Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "4002",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/4002"
        },
        {
          "name": "20020129 RFP2201: MS Site Server Evilness",
          "tags": [
            "mailing-list",
            "x_refsource_VULNWATCH"
          ],
          "url": "http://archives.neohapsis.com/archives/vulnwatch/2002-q1/0033.html"
        },
        {
          "name": "siteserver-cphost-upload-dos(8053)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "http://www.iss.net/security_center/static/8053.php"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2002-2081",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "cphost.dll in Microsoft Site Server 3.0 allows remote attackers to cause a denial of service (disk consumption) via an HTTP POST of a file with a long TargetURL parameter, which causes Site Server to abort and leaves the uploaded file in c:\\temp."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "4002",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/4002"
            },
            {
              "name": "20020129 RFP2201: MS Site Server Evilness",
              "refsource": "VULNWATCH",
              "url": "http://archives.neohapsis.com/archives/vulnwatch/2002-q1/0033.html"
            },
            {
              "name": "siteserver-cphost-upload-dos(8053)",
              "refsource": "XF",
              "url": "http://www.iss.net/security_center/static/8053.php"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2002-2081",
    "datePublished": "2005-07-14T04:00:00Z",
    "dateReserved": "2005-07-14T00:00:00Z",
    "dateUpdated": "2024-09-17T04:20:43.830Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2000-0246
Vulnerability from cvelistv5
Published
2000-06-02 04:00
Modified
2024-08-08 05:14
Severity ?
Summary
IIS 4.0 and 5.0 does not properly perform ISAPI extension processing if a virtual directory is mapped to a UNC share, which allows remote attackers to read the source code of ASP and other files, aka the "Virtualized UNC Share" vulnerability.
References
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-019vendor-advisory, x_refsource_MS
http://www.microsoft.com/technet/support/kb.asp?ID=249599vendor-advisory, x_refsource_MSKB
http://www.securityfocus.com/bid/1081vdb-entry, x_refsource_BID
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-08T05:14:20.492Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "MS00-019",
            "tags": [
              "vendor-advisory",
              "x_refsource_MS",
              "x_transferred"
            ],
            "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-019"
          },
          {
            "name": "Q249599",
            "tags": [
              "vendor-advisory",
              "x_refsource_MSKB",
              "x_transferred"
            ],
            "url": "http://www.microsoft.com/technet/support/kb.asp?ID=249599"
          },
          {
            "name": "1081",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/1081"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2000-03-30T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "IIS 4.0 and 5.0 does not properly perform ISAPI extension processing if a virtual directory is mapped to a UNC share, which allows remote attackers to read the source code of ASP and other files, aka the \"Virtualized UNC Share\" vulnerability."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2005-11-02T10:00:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "MS00-019",
          "tags": [
            "vendor-advisory",
            "x_refsource_MS"
          ],
          "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-019"
        },
        {
          "name": "Q249599",
          "tags": [
            "vendor-advisory",
            "x_refsource_MSKB"
          ],
          "url": "http://www.microsoft.com/technet/support/kb.asp?ID=249599"
        },
        {
          "name": "1081",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/1081"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2000-0246",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "IIS 4.0 and 5.0 does not properly perform ISAPI extension processing if a virtual directory is mapped to a UNC share, which allows remote attackers to read the source code of ASP and other files, aka the \"Virtualized UNC Share\" vulnerability."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "MS00-019",
              "refsource": "MS",
              "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-019"
            },
            {
              "name": "Q249599",
              "refsource": "MSKB",
              "url": "http://www.microsoft.com/technet/support/kb.asp?ID=249599"
            },
            {
              "name": "1081",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/1081"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2000-0246",
    "datePublished": "2000-06-02T04:00:00",
    "dateReserved": "2000-04-12T00:00:00",
    "dateUpdated": "2024-08-08T05:14:20.492Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2002-1769
Vulnerability from cvelistv5
Published
2005-06-21 04:00
Modified
2024-08-08 03:34
Severity ?
Summary
Microsoft Site Server 3.0 prior to SP4 installs a default user, LDAP_Anonymous, with a default password of LdapPassword_1, which allows remote attackers the "Log on locally" privilege.
References
http://online.securityfocus.com/advisories/3843x_refsource_MISC
http://www.securityfocus.com/bid/3998vdb-entry, x_refsource_BID
http://support.microsoft.com/default.aspx?scid=kb%3Ben-us%3BQ248840vendor-advisory, x_refsource_MSKB
http://archives.neohapsis.com/archives/vulnwatch/2002-q1/0033.htmlmailing-list, x_refsource_VULNWATCH
https://exchange.xforce.ibmcloud.com/vulnerabilities/8048vdb-entry, x_refsource_XF
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-08T03:34:56.226Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://online.securityfocus.com/advisories/3843"
          },
          {
            "name": "3998",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/3998"
          },
          {
            "name": "Q248840",
            "tags": [
              "vendor-advisory",
              "x_refsource_MSKB",
              "x_transferred"
            ],
            "url": "http://support.microsoft.com/default.aspx?scid=kb%3Ben-us%3BQ248840"
          },
          {
            "name": "20020129 RFP2201: MS Site Server Evilness",
            "tags": [
              "mailing-list",
              "x_refsource_VULNWATCH",
              "x_transferred"
            ],
            "url": "http://archives.neohapsis.com/archives/vulnwatch/2002-q1/0033.html"
          },
          {
            "name": "siteserver-ldap-anonymous-account(8048)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/8048"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2002-01-29T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Microsoft Site Server 3.0 prior to SP4 installs a default user, LDAP_Anonymous, with a default password of LdapPassword_1, which allows remote attackers the \"Log on locally\" privilege."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-07-10T14:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://online.securityfocus.com/advisories/3843"
        },
        {
          "name": "3998",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/3998"
        },
        {
          "name": "Q248840",
          "tags": [
            "vendor-advisory",
            "x_refsource_MSKB"
          ],
          "url": "http://support.microsoft.com/default.aspx?scid=kb%3Ben-us%3BQ248840"
        },
        {
          "name": "20020129 RFP2201: MS Site Server Evilness",
          "tags": [
            "mailing-list",
            "x_refsource_VULNWATCH"
          ],
          "url": "http://archives.neohapsis.com/archives/vulnwatch/2002-q1/0033.html"
        },
        {
          "name": "siteserver-ldap-anonymous-account(8048)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/8048"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2002-1769",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Microsoft Site Server 3.0 prior to SP4 installs a default user, LDAP_Anonymous, with a default password of LdapPassword_1, which allows remote attackers the \"Log on locally\" privilege."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://online.securityfocus.com/advisories/3843",
              "refsource": "MISC",
              "url": "http://online.securityfocus.com/advisories/3843"
            },
            {
              "name": "3998",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/3998"
            },
            {
              "name": "Q248840",
              "refsource": "MSKB",
              "url": "http://support.microsoft.com/default.aspx?scid=kb;en-us;Q248840"
            },
            {
              "name": "20020129 RFP2201: MS Site Server Evilness",
              "refsource": "VULNWATCH",
              "url": "http://archives.neohapsis.com/archives/vulnwatch/2002-q1/0033.html"
            },
            {
              "name": "siteserver-ldap-anonymous-account(8048)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/8048"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2002-1769",
    "datePublished": "2005-06-21T04:00:00",
    "dateReserved": "2005-06-21T00:00:00",
    "dateUpdated": "2024-08-08T03:34:56.226Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-1999-0910
Vulnerability from cvelistv5
Published
2000-02-04 05:00
Modified
2024-08-01 16:55
Severity ?
Summary
Microsoft Site Server and Commercial Internet System (MCIS) do not set an expiration for a cookie, which could then be cached by a proxy and inadvertently used by a different user.
References
https://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-035vendor-advisory, x_refsource_MS
http://www.securityfocus.com/bid/625vdb-entry, x_refsource_BID
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T16:55:29.077Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "MS99-035",
            "tags": [
              "vendor-advisory",
              "x_refsource_MS",
              "x_transferred"
            ],
            "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-035"
          },
          {
            "name": "625",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/625"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Microsoft Site Server and Commercial Internet System (MCIS) do not set an expiration for a cookie, which could then be cached by a proxy and inadvertently used by a different user."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-12T19:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "MS99-035",
          "tags": [
            "vendor-advisory",
            "x_refsource_MS"
          ],
          "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-035"
        },
        {
          "name": "625",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/625"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-1999-0910",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Microsoft Site Server and Commercial Internet System (MCIS) do not set an expiration for a cookie, which could then be cached by a proxy and inadvertently used by a different user."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "MS99-035",
              "refsource": "MS",
              "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-035"
            },
            {
              "name": "625",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/625"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-1999-0910",
    "datePublished": "2000-02-04T05:00:00",
    "dateReserved": "1999-12-08T00:00:00",
    "dateUpdated": "2024-08-01T16:55:29.077Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2000-0025
Vulnerability from cvelistv5
Published
2000-03-22 05:00
Modified
2024-08-08 04:58
Severity ?
Summary
IIS 4.0 and Site Server 3.0 allow remote attackers to read source code for ASP files if the file is in a virtual directory whose name includes extensions such as .com, .exe, .sh, .cgi, or .dll, aka the "Virtual Directory Naming" vulnerability.
References
http://www.osvdb.org/8098vdb-entry, x_refsource_OSVDB
https://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-058vendor-advisory, x_refsource_MS
http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ238606vendor-advisory, x_refsource_MSKB
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-08T04:58:11.523Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "8098",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/8098"
          },
          {
            "name": "MS99-058",
            "tags": [
              "vendor-advisory",
              "x_refsource_MS",
              "x_transferred"
            ],
            "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-058"
          },
          {
            "name": "Q238606",
            "tags": [
              "vendor-advisory",
              "x_refsource_MSKB",
              "x_transferred"
            ],
            "url": "http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ238606"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "1999-12-21T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "IIS 4.0 and Site Server 3.0 allow remote attackers to read source code for ASP files if the file is in a virtual directory whose name includes extensions such as .com, .exe, .sh, .cgi, or .dll, aka the \"Virtual Directory Naming\" vulnerability."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2004-09-02T09:00:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "8098",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/8098"
        },
        {
          "name": "MS99-058",
          "tags": [
            "vendor-advisory",
            "x_refsource_MS"
          ],
          "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-058"
        },
        {
          "name": "Q238606",
          "tags": [
            "vendor-advisory",
            "x_refsource_MSKB"
          ],
          "url": "http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ238606"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2000-0025",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "IIS 4.0 and Site Server 3.0 allow remote attackers to read source code for ASP files if the file is in a virtual directory whose name includes extensions such as .com, .exe, .sh, .cgi, or .dll, aka the \"Virtual Directory Naming\" vulnerability."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "8098",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/8098"
            },
            {
              "name": "MS99-058",
              "refsource": "MS",
              "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-058"
            },
            {
              "name": "Q238606",
              "refsource": "MSKB",
              "url": "http://support.microsoft.com/default.aspx?scid=kb;[LN];Q238606"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2000-0025",
    "datePublished": "2000-03-22T05:00:00",
    "dateReserved": "2000-01-11T00:00:00",
    "dateUpdated": "2024-08-08T04:58:11.523Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}