CVE-2000-0746

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Vulnerabilities in IIS 4.0 and 5.0 do not properly protect against cross-site scripting (CSS) attacks. They allow a malicious web site operator to embed scripts in a link to a trusted site, which are returned without quoting in an error message back to the client. The client then executes those scripts in the same context as the trusted site, aka the "IIS Cross-Site Scripting" vulnerabilities.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

No affected versions have been published.

Timeline

Published: Oct 20, 2000
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2000

CVE-2000-074710.0The logrotate script for OpenLDAP before 1.2.11 in Conectiva Linux sends an improper signal to the kernel log daemon (klogd) and kills it.CVE-2000-07484.6OpenLDAP 1.2.11 and earlier improperly installs the ud binary with group write permissions, which could allow any user in that group to repl CVE-2000-07497.2Buffer overflow in the Linux binary compatibility module in FreeBSD 3.x through 5.x allows local users to gain root privileges via long file CVE-2000-07507.5Buffer overflow in mopd (Maintenance Operations Protocol loader daemon) allows remote attackers to execute arbitrary commands via a long fil CVE-2000-07517.5mopd (Maintenance Operations Protocol loader daemon) does not properly cleanse user-injected format strings, which allows remote attackers t CVE-2000-07527.2Buffer overflows in brouted in FreeBSD and possibly other OSes allows local users to gain root privileges via long command line arguments.CVE-2000-07535.0The Microsoft Outlook mail client identifies the physical path of the sender's machine within a winmail.dat attachment to Rich Text Format (CVE-2000-07542.1Vulnerability in HP OpenView Network Node Manager (NMM) version 6.1 related to passwords.CVE-2000-07554.6Vulnerability in the newgrp command in HP-UX 11.00 allows local users to gain privileges.CVE-2000-07565.0Microsoft Outlook 2000 does not properly process long or malformed fields in vCard (.vcf) files, which allows attackers to cause a denial of CVE-2000-075710.0The sysgen service in Aptis Totalbill does not perform authentication, which allows remote attackers to gain root privileges by connecting t CVE-2000-07584.6The web interface for Lyris List Manager 3 and 4 allows list subscribers to obtain administrative access by modifying the value of the list_