site server vulnerabilities and fixes

Recent CVEs affecting site server, with upgrade or downgrade steps. 16 tracked.

Also searched as: siteserver.

site server has 16 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2002-12-31. Highest priority: CVE-1999-1011 (score 70/100).

• CVE-2002-2288 MEDIUM 5.0 DOWNGRADE Mambo Site Server 4.0.11 allows remote attackers to obtain the physical path of the server via an HTTP request
• CVE-2002-2081 MEDIUM 5.0 DOWNGRADE DOWNGRADE cphost.dll in Microsoft Site Server 3.0 allows remote attackers to cause a denial of service (disk consumption
• CVE-2002-2073 MEDIUM 4.3 DOWNGRADE DOWNGRADE Cross-site scripting (XSS) vulnerability in the default ASP pages on Microsoft Site Server 3.0 on Windows NT 4
• CVE-2002-1769 HIGH 7.5 DOWNGRADE DOWNGRADE Microsoft Site Server 3.0 prior to SP4 installs a default user, LDAP_Anonymous, with a default password of Lda
• CVE-2000-0246 MEDIUM 5.0 DOWNGRADE DOWNGRADE IIS 4.0 and 5.0 does not properly perform ISAPI extension processing if a virtual directory is mapped to a UNC
• CVE-2000-0161 HIGH 7.5 DOWNGRADE Sample web sites on Microsoft Site Server 3.0 Commerce Edition do not validate an identification number, which
• CVE-2000-0025 MEDIUM 5.0 DOWNGRADE DOWNGRADE IIS 4.0 and Site Server 3.0 allow remote attackers to read source code for ASP files if the file is in a virtu
• CVE-2000-0024 MEDIUM 6.4 DOWNGRADE DOWNGRADE IIS does not properly canonicalize URLs, potentially allowing remote attackers to bypass access restrictions i
• CVE-1999-1520 MEDIUM 5.0 DOWNGRADE A configuration problem in the Ad Server Sample directory (AdSamples) in Microsoft Site Server 3.0 allows an a
• CVE-1999-1451 MEDIUM 5.0 DOWNGRADE DOWNGRADE The Winmsdp.exe sample file in IIS 4.0 and Site Server 3.0 allows remote attackers to read arbitrary files.
• CVE-1999-1246 HIGH 7.5 DOWNGRADE Direct Mailer feature in Microsoft Site Server 3.0 saves user domain names and passwords in plaintext in the T
• CVE-1999-1011 HIGH 10.0 DOWNGRADE DOWNGRADE The Remote Data Service (RDS) DataFactory component of Microsoft Data Access Components (MDAC) in IIS 3.x and
• CVE-1999-0910 MEDIUM 5.0 DOWNGRADE DOWNGRADE Microsoft Site Server and Commercial Internet System (MCIS) do not set an expiration for a cookie, which could
• CVE-1999-0867 MEDIUM 5.0 DOWNGRADE DOWNGRADE Denial of service in IIS 4.0 via a flood of HTTP requests with malformed headers.
• CVE-1999-0861 LOW 2.6 DOWNGRADE DOWNGRADE Race condition in the SSL ISAPI filter in IIS and other servers may leak information in plaintext.
• CVE-1999-0360 HIGH 7.2 DOWNGRADE MS Site Server 2.0 with IIS 4 can allow users to upload content, including ASP, to the target web site, thus a

FAQ

How do I fix site server vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is site server being exploited right now?

None of the tracked site server CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which site server CVE should I patch first?

CVE-1999-1011 currently ranks highest (70/100): The Remote Data Service (RDS) DataFactory component of Microsoft Data Access Components (MDAC) in IIS 3.x and .

RSS feed for site server · ← Back to latest CVEs