Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: January 1999

15 records · 0 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-1999-0448
    27Monitor

    IIS 4.0 and Apache log HTTP request methods, regardless of how long they are, allowing a remote attacker to hide the URL they really request

    MediumCVSS 5.0Proof of conceptEPSS 24%

    microsoft · internet information serverJan 1, 1999

  • CVE-1999-0497
    2Monitor

    Anonymous FTP is enabled.

    CVSS 0.0WeaponizedEPSS 7%

    Jan 1, 1999

  • CVE-1999-0512
    44Plan

    A mail server is explicitly configured to allow SMTP mail relay, which allows abuse by spammers.

    CriticalCVSS 10.0WeaponizedEPSS 12%

    Jan 1, 1999

  • CVE-1999-0554
    43Plan

    NFS exports system-critical data to the world, e.g.

    CriticalCVSS 10.0WeaponizedEPSS 11%

    Jan 1, 1999

  • CVE-1999-0651
    34Monitor

    The rsh/rlogin service is running.

    HighCVSS 7.5WeaponizedEPSS 11%

    Jan 1, 1999

  • CVE-1999-0661
    56Plan

    A system is running a version of software that was replaced with a Trojan Horse at one of its distribution points, such as (1) TCP Wrappers

    CriticalCVSS 10.0Proof of conceptEPSS 54%

    Jan 1, 1999

  • CVE-1999-1376
    47Plan

    Buffer overflow in fpcount.exe in IIS 4.0 with FrontPage Server Extensions allows remote attackers to execute arbitrary commands.

    CriticalCVSS 10.0No exploitEPSS 23%

    microsoft · internet information serverJan 14, 1999

  • CVE-1999-1538
    16Monitor

    When IIS 2 or 3 is upgraded to IIS 4, ism.dll is inadvertently left in /scripts/iisadmin, which does not restrict access to the local machin

    LowCVSS 2.1Proof of conceptEPSS 25%

    microsoft · internet information serverJan 14, 1999

  • CVE-1999-0678
    29Monitor

    A default configuration of Apache on Debian GNU/Linux sets the ServerRoot to /usr/doc, which allows remote users to read documentation files

    MediumCVSS 5.0Proof of conceptEPSS 31%

    apache · http serverJan 17, 1999

  • CVE-1999-1544
    24Monitor

    Buffer overflow in FTP server in Microsoft IIS 3.0 and 4.0 allows local and sometimes remote attackers to cause a denial of service via a lo

    MediumCVSS 5.0No exploitEPSS 13%

    microsoft · internet information serverJan 24, 1999

  • CVE-1999-0357
    25Monitor

    Windows 98 and other operating systems allows remote attackers to cause a denial of service via crafted "oshare" packets, possibly involving

    MediumCVSS 5.0No exploitEPSS 16%

    microsoft · windows 98Jan 25, 1999

  • CVE-1999-0449
    46Plan

    The ExAir sample site in IIS 4 allows remote attackers to cause a denial of service (CPU consumption) via a direct request to the (1) advsea

    HighCVSS 7.8No exploitEPSS 49%

    microsoft · internet information serverJan 26, 1999

  • CVE-1999-0450
    36Monitor

    In IIS, an attacker could determine a real path using a request for a non-existent URL that would be interpreted by Perl (perl.exe).

    HighCVSS 7.5Proof of conceptEPSS 19%

    microsoft · internet information serverJan 26, 1999

  • CVE-1999-0348
    23Monitor

    IIS ASP caching problem releases sensitive information when two virtual servers share the same physical directory.

    MediumCVSS 5.0No exploitEPSS 10%

    microsoft · internet information serverJan 27, 1999

  • CVE-1999-0349
    35Monitor

    A buffer overflow in the FTP list (ls) command in IIS allows remote attackers to conduct a denial of service and, in some cases, execute arb

    HighCVSS 7.5No exploitEPSS 17%

    microsoft · internet information serverJan 27, 1999