CVE-2006-1364

Microsoft w3wp (aka w3wp.exe) does not properly handle when the AspCompat directive is not used when referencing COM components in ASP.NET, which allows remote attackers to cause a denial of service (resource consumption or crash) by repeatedly requesting each of several documents that refer to COM components, or are restricted documents located under the ASP.NET application path.

• CWE-400

• http://hackingspirits.com/vuln-rnd/w3wp-remote-dos.zipBroken Link, Third Party Advisory
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-March/044291.htmlThird Party Advisory
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-March/044292.htmlThird Party Advisory
• http://securitytracker.com/id?1015825Third Party Advisory, VDB Entry
• http://www.securiteam.com/windowsntfocus/5KP0O0KI0Y.htmlExploit, Third Party Advisory
• http://www.securityfocus.com/archive/1/428622/100/0/threaded
• http://www.securityfocus.com/bid/17188Exploit, Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25392Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/1601Exploit, Third Party Advisory, VDB Entry
• http://hackingspirits.com/vuln-rnd/w3wp-remote-dos.zipBroken Link, Third Party Advisory
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-March/044291.htmlThird Party Advisory
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-March/044292.htmlThird Party Advisory
• http://securitytracker.com/id?1015825Third Party Advisory, VDB Entry
• http://www.securiteam.com/windowsntfocus/5KP0O0KI0Y.htmlExploit, Third Party Advisory
• http://www.securityfocus.com/archive/1/428622/100/0/threaded
• http://www.securityfocus.com/bid/17188Exploit, Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25392Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/1601Exploit, Third Party Advisory, VDB Entry

Published

Mar 23, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-1358Unspecified vulnerability in BEA WebLogic Portal 8.1 up to S…
• CVE-2006-1359Microsoft Internet Explorer 6 and 7 Beta 2 allows remote att…
• CVE-2006-1360Multiple SQL injection vulnerabilities in MusicBox 2.3 Beta …
• CVE-2006-1361Cross-site scripting (XSS) vulnerability in OSWiki before 0.…
• CVE-2006-1362Multiple SQL injection vulnerabilities in Mini-Nuke CMS Syst…
• CVE-2006-1363images.php in Justin White (aka YTZ) Free Web Publishing Sys…
• CVE-2006-1365The Motorola PEBL U6, the Motorola V600, and possibly the Mo…
• CVE-2006-1366Buffer overflow in the Motorola PEBL U6 08.83.76R, and possi…
• CVE-2006-1367The Motorola PEBL U6 08.83.76R, the Motorola V600, and possi…
• CVE-2006-1368Buffer overflow in the USB Gadget RNDIS implementation in th…
• CVE-2006-1369Cross-site scripting (XSS) vulnerability in Invision Power B…
• CVE-2006-1370Buffer overflow in RealNetworks RealPlayer 10.5 6.0.12.1040 …