CVE-1999-0725 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	25.6%	–	–
2022-04-03	–	–	25.6%	–	–
2023-03-12	–	–	–	0.5%	–
2023-09-17	–	–	–	0.5%	–
2024-02-11	–	–	–	0.5%	–
2024-06-02	–	–	–	0.5%	–
2024-06-23	–	–	–	0.5%	–
2024-12-22	–	–	–	0.71%	–
2025-02-16	–	–	–	0.71%	–
2025-01-19	–	–	–	0.71%	–
2025-02-16	–	–	–	0.71%	–
2025-03-18	–	–	–	–	37.12%
2025-03-30	–	–	–	–	38.53%
2025-03-30	–	–	–	–	38.53,%

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

Date	Percentile
2022-02-06	96%
2022-04-03	97%
2023-03-12	73%
2023-09-17	74%
2024-02-11	76%
2024-06-02	76%
2024-06-23	77%
2024-12-22	8%
2025-02-16	81%
2025-01-19	8%
2025-02-16	81%
2025-03-18	97%
2025-03-30	97%
2025-03-30	97%

source: https://www.securityfocus.com/bid/477/info This vulnerability could allow a web site viewer to obtain the source code for .asp and similar files if the server's default language (Input Locale) is set to Chinese, Japanese or Korean. How this works is as follows: IIS checks the extension of the requested file to see if it needs to do any processing before delivering the information. If the requested extension is not on it's list, it then makes any language-based calculations, and delivers the file. If a single byte is appended to the end of the URL when IIS to set to use one of the double-byte language packs (Chinese, Japanese, or Korean) the language module will strip it as invalid, then look for the file. Since the new URL now points to a valid filename, and IIS has already determined that this transaction requires no processing, the file is simply delivered as is, exposing the source code. Request a URL of a known-good file that requires server processing, then append a hex value between x81 and xfe to the URL. For example: <http://myhost/main.asp%81>. If your server is vulnerable you will receive back the source code of your .asp file.