CVE-1999-1397

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Index Server 2.0 on IIS 4.0 stores physical path information in the ContentIndex\Catalogs subkey of the AllowedPaths registry key, whose permissions allows local and remote users to obtain the physical paths of directories that are being indexed.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

No affected versions have been published.

Timeline

Published
Mar 23, 1999
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 1999

CVE-1999-14002.1The Economist screen saver 1999 with the "Password Protected" option enabled allows users with physical access to the machine to bypass the CVE-1999-140510.0snap command in AIX before 4.3.2 creates the /tmp/ibmsupt directory with world-readable permissions and does not remove or clear the directoCVE-1999-14125.0A possible interaction between Apple MacOS X release 1.0 and Apache HTTP server allows remote attackers to cause a denial of service (crash)CVE-1999-14147.2IBM Netfinity Remote Control allows local users to gain administrator privileges by starting programs from the process manager, which runs wCVE-1999-14185.0ICQ99 ICQ web server build 1701 with "Active Homepage" enabled generates allows remote attackers to determine the existence of files on the CVE-1999-14227.2The default configuration of Slackware 3.4, and possibly other versions, includes . (dot, the current directory) in the PATH environmental vCVE-1999-14302.1PIM software for Royal daVinci does not properly password-protext access to data stored in the .mdb (Microsoft Access) file, which allows loCVE-1999-14314.6ZAK in Appstation mode allows users to bypass the "Run only allowed apps" policy by starting Explorer from Office 97 applications (such as WCVE-1999-14405.1Win32 ICQ 98a 1.30, and possibly other versions, does not display the entire portion of long filenames, which could allow attackers to send CVE-1999-14445.0genkey utility in Alibaba 2.0 generates RSA key pairs with an exponent of 1, which results in transactions that are sent in cleartext.CVE-1999-14507.5Vulnerability in (1) rlogin daemon rshd and (2) scheme on SCO UNIX OpenServer 5.0.5 and earlier, and SCO UnixWare 7.0.1 and earlier, allows CVE-1999-14515.0The Winmsdp.exe sample file in IIS 4.0 and Site Server 3.0 allows remote attackers to read arbitrary files.