CGI security vulnerability Data Quick Check v1.0 (turn four)

cgi| Security | Security Vulnerabilities 76
Type: Attack type
Name: aexp.htr
Risk Rating: Medium
Description: There are aexp.htr files in the/iisadmpwd directory, similar to AEXP2.HTR,AEXP3.HTR and AEXP4B.HTR, which allow attackers to crack and modify the NT user's password in a way that is exhaustive.
Recommendation: It is recommended that access to the/IISADMPWD directory be prohibited
Workaround: Delete the Aexp.htr file

____________________________________________________________________________________

77
Type: Attack type
Name: AEXP2.HTR
Risk Rating: Medium
Description: There are aexp2.htr files in the/iisadmpwd directory, similar to AEXP2.HTR,AEXP3.HTR and AEXP4B.HTR, which allow attackers to crack and modify the NT user's password in a way that is exhaustive.
Recommendation: It is recommended that access to the/IISADMPWD directory be prohibited
Workaround: Delete the aexp2.htr file

_______________________________________________________________________________________

78
Type: Attack type
Name: AEXP3.HTR
Risk Rating: Medium
Description: There are aexp3.htr files in the/iisadmpwd directory, similar to AEXP2.HTR,AEXP3.HTR and AEXP4B.HTR, which allow attackers to crack and modify the NT user's password in a way that is exhaustive.
Recommendation: It is recommended that access to the/IISADMPWD directory be prohibited
Workaround: Delete the Aexp3.htr file

_________________________________________________________________________________________

79
Type: Attack type
Name: AEXP4B.HTR
Risk Rating: Medium
Description: There are aexp4b.htr files in the/iisadmpwd directory, similar to AEXP2.HTR,AEXP3.HTR and AEXP4B.HTR, which allow attackers to crack and modify the NT user's password in a way that is exhaustive.
Recommendation: It is recommended that access to the/IISADMPWD directory be prohibited
Workaround: Delete the aexp4b.htr file

____________________________________________________________________________________

80
Type: Attack type
Name: ACHG.HTR
Risk Rating: Medium
Description: There are aechg.htr files in the/iisadmpwd directory, similar to AEXP2.HTR,AEXP3.HTR and AEXP4B.HTR, which allow attackers to crack and modify the NT user's password in a way that is exhaustive.
Recommendation: It is recommended that access to the/IISADMPWD directory be prohibited
Workaround: Delete the achg.htr file

____________________________________________________________________________________


81
Type: Attack type
Name: exprcale.cfm
Risk Rating: Medium
Description: In ColdFusion Web directory:/cfdocs/expeval/exprcalc.cfm file, this file has a vulnerability that allows users to read any file on the server hard drive including user password database Sam files
Recommendation: Delete related files
Workaround: Delete the exprcalc.cfm file

_______________________________________________________________________________________

82
Type: Attack type
Name: getfile.cfm
Risk Rating: Medium
Description: In ColdFusion Web directory:/getfile.cfm file, this file has a vulnerability that allows users to read any file on the server hard drive including user password database Sam files
Recommendation: Delete related files
Workaround: Delete the getfile.cfm file

_______________________________________________________________________________


119
Type: Information type
Name: X.HTW
Risk Rating: Medium
Description: IIS4.0 has an application mapping HTW--->webhits.dll, which is used for the click function of Index Server. Although you are not running index Server, the mapping is still valid. This application mapping has vulnerabilities that allow intruders to read files, database files, and ASP source code on local hard drives.
Suggestions:
It is recommended that you remove unwanted application mappings in the IIS console


________________________________________________________________________________

120
Type: Information type
Name: QFULLHIT.HTW
Risk Rating: Medium
Description: IIS4.0 has an application mapping HTW--->webhits.dll, which is used for the click function of Index Server. Although you are not running index Server, the mapping is still valid. This application mapping has vulnerabilities that allow intruders to read files, database files, and ASP source code on local hard drives.
Recommendation: It is recommended that you remove unwanted application mappings in the IIS console


____________________________________________________________________________________

121
Type: Information type
Name: IIRTURNH.HTW
Risk Rating: Medium
Description: IIS4.0 has an application mapping HTW--->webhits.dll, which is used for the click function of Index Server. Although you are not running index Server, the mapping is still valid. This application mapping has vulnerabilities that allow intruders to read files, database files, and ASP source code on local hard drives.
Recommendation: It is recommended that you remove unwanted application mappings in the IIS console


Believe that a serious friend will see, in the serial number 82, missing dozens of information. That's no way, it's not my problem, when I got this information ... I wonder if the dozens of vulnerabilities are more damaging or why. Please the people of insight to fill the full:)