High

DATE	CVE	VULNERABILITY TITLE	RISK
2008-02-12	CVE-2008-0074	Permissions, Privileges, and Access Controls vulnerability in Microsoft products Unspecified vulnerability in Microsoft Internet Information Services (IIS) 5.0 through 7.0 allows local users to gain privileges via unknown vectors related to file change notifications in the TPRoot, NNTPFile\Root, or WWWRoot folders. local low complexity microsoft CWE-264	7.2
2007-05-30	CVE-2007-2897	Unspecified vulnerability in Microsoft Internet Information Server 6.0 Microsoft Internet Information Services (IIS) 6.0 allows remote attackers to cause a denial of service (server instability or device hang), and possibly obtain sensitive information (device communication traffic); and might allow attackers with physical access to execute arbitrary code after connecting a data stream to a device COM port; via requests for a URI containing a '/' immediately before and after the name of a DOS device, as demonstrated by the /AUX/.aspx URI, which bypasses a blacklist for DOS device requests. network low complexity microsoft	7.5
2004-08-06	CVE-2004-0205	Remote Buffer Overflow vulnerability in Microsoft IIS 4 Redirect Buffer overflow in Microsoft Internet Information Server (IIS) 4.0 allows local users to execute arbitrary code via the redirect function. local low complexity avaya microsoft	7.2
2002-11-12	CVE-2002-0869	Unspecified vulnerability in Microsoft products Unknown vulnerability in the hosting process (dllhost.exe) for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allows remote attackers to gain privileges by executing an out of process application that acquires LocalSystem privileges, aka "Out of Process Privilege Elevation." network low complexity microsoft	7.5
2002-07-03	CVE-2002-0364	Heap Overflow vulnerability in Microsoft products Buffer overflow in the chunked encoding transfer mechanism in IIS 4.0 and 5.0 allows attackers to execute arbitrary code via the processing of HTR request sessions, aka "Heap Overrun in HTR Chunked Encoding Could Enable Web Server Compromise." network low complexity microsoft	7.5
2002-04-22	CVE-2002-0150	Unspecified vulnerability in Microsoft products Buffer overflow in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to spoof the safety check for HTTP headers and cause a denial of service or execute arbitrary code via HTTP header field values. network low complexity microsoft	7.5
2002-04-22	CVE-2002-0149	Unspecified vulnerability in Microsoft products Buffer overflow in ASP Server-Side Include Function in IIS 4.0, 5.0 and 5.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via long file names. network low complexity microsoft	7.5
2002-04-22	CVE-2002-0148	Unspecified vulnerability in Microsoft products Cross-site scripting vulnerability in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other users via an HTTP error page. network low complexity microsoft	7.5
2002-04-22	CVE-2002-0147	Unspecified vulnerability in Microsoft products Buffer overflow in the ASP data transfer mechanism in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to cause a denial of service or execute code, aka "Microsoft-discovered variant of Chunked Encoding buffer overrun." network low complexity microsoft	7.5
2002-04-22	CVE-2002-0079	Heap Overflow vulnerability in Microsoft products Buffer overflow in the chunked encoding transfer mechanism in Internet Information Server (IIS) 4.0 and 5.0 Active Server Pages allows attackers to cause a denial of service or execute arbitrary code. network low complexity microsoft	7.5