CVSS: 9.3EPSS: 92%CPEs: 34EXPL: 0CVE-2013-0006
https://notcve.org/view.php?id=CVE-2013-0006
Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka "MSXML Integer Truncation Vulnerability." Microsoft XML Core Services (también conocido como MSXML) v3.0, v5.0 y v6.0 no analiza correctamente el contenido XML, lo que permite a atacantes remotos ejecutar código arbitrario a través de una página web diseñada, también conocido como "MSXML Integer Truncation Vulnerability." • http://www.us-cert.gov/cas/techalerts/TA13-008A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-002 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16429 https://us-cert.cisa.gov/ics/advisories/icsa-20-315-01 • CWE-189: Numeric Errors •
CVSS: 9.3EPSS: 90%CPEs: 34EXPL: 0CVE-2013-0007
https://notcve.org/view.php?id=CVE-2013-0007
Microsoft XML Core Services (aka MSXML) 4.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka "MSXML XSLT Vulnerability." Microsoft XML Core Services (también conocido como MSXML) v4.0, v5.0 y v6.0 no analiza correctamente el contenido XML, lo que permite a atacantes remotos ejecutar código arbitrario a través de una página web diseñada, también conocido como "Vulnerabilidad de MSXML XSLT." • http://www.us-cert.gov/cas/techalerts/TA13-008A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-002 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15458 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 4.3EPSS: 15%CPEs: 12EXPL: 0CVE-2012-2520
https://notcve.org/view.php?id=CVE-2012-2520
Cross-site scripting (XSS) vulnerability in Microsoft InfoPath 2007 SP2 and SP3 and 2010 SP1, Communicator 2007 R2, Lync 2010 and 2010 Attendee, SharePoint Server 2007 SP2 and SP3 and 2010 SP1, Groove Server 2010 SP1, Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010 SP1, and Office Web Apps 2010 SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted string, aka "HTML Sanitization Vulnerability." Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Microsoft InfoPath 2007 SP2 y SP3 y 2010 SP1, Communicator 2007 R2, Lync 2010 y 2010 Attendee, SharePoint Server 2007 SP2 y SP3 and 2010 SP1, Groove Server 2010 SP1, Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010 SP1, y Office Web Apps 2010 SP1, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de una cadena modificada, también conocido como "HTML Sanitization Vulnerability." • http://www.securityfocus.com/bid/55797 http://www.securitytracker.com/id?1027625 http://www.securitytracker.com/id?1027626 http://www.securitytracker.com/id?1027627 http://www.securitytracker.com/id?1027628 http://www.securitytracker.com/id? • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.3EPSS: 97%CPEs: 29EXPL: 2CVE-2012-1889 – Microsoft XML Core Services Memory Corruption Vulnerability
https://notcve.org/view.php?id=CVE-2012-1889
Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. Microsoft XML Core Services 3.0, 4.0, 5.0, y 6.0 accede a localizaciones de memoria mal formadas, lo que permite a atacantes remotos ejecutar código arbitrario o provocar una denegación de servicio (corrupción de memoria) a través de un sitio web modificado. Microsoft XML Core Services contains a memory corruption vulnerability which could allow for remote code execution. • https://www.exploit-db.com/exploits/19186 https://github.com/whu-enjoy/CVE-2012-1889 http://technet.microsoft.com/security/advisory/2719615 http://www.us-cert.gov/cas/techalerts/TA12-174A.html http://www.us-cert.gov/cas/techalerts/TA12-192A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-043 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15195 • CWE-787: Out-of-bounds Write •
CVSS: 4.0EPSS: 7%CPEs: 20EXPL: 1CVE-2011-1892 – SharePoint 2007/2010 and DotNetNuke < 6 - File Disclosure (via XEE)
https://notcve.org/view.php?id=CVE-2011-1892
Microsoft Office Groove 2007 SP2, SharePoint Workspace 2010 Gold and SP1, Office Forms Server 2007 SP2, Office SharePoint Server 2007 SP2, Office SharePoint Server 2010 Gold and SP1, Office Groove Data Bridge Server 2007 SP2, Office Groove Management Server 2007 SP2, Groove Server 2010 Gold and SP1, Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010, and Office Web Apps 2010 Gold and SP1 do not properly handle Web Parts containing XML classes referencing external entities, which allows remote authenticated users to read arbitrary files via a crafted XML and XSL file, aka "SharePoint Remote File Disclosure Vulnerability." Microsoft Office Groove 2007 Service Pack 2, SharePoint Workspace 2010 Gold y SP1, Office Forms Server 2007 SP2, Office SharePoint Server 2007 SP2, Office SharePoint Server 2010 Gold y SP1, Office Groove Data Bridge Server 2007 SP2, Office Groove Management Server 2007 SP2, Groove Server 2010 Gold y SP1, Windows SharePoint Services 3.0 SP2, Windows SharePoint 2010 y Office Web Aplicaciones 2010 Gold y SP1 no gestionan correctamente las partes web que contienen clases XML que referencian a entidades externas, lo que permite a usuarios remotos autenticados leer ficheros de su elección a través de un archivo XML o XSL debidamente modificados. Es un problema también conocido como "Vulnerabilidad de revelado de fichero remoto de Sharepoint." SharePoint 2007 / 2010 and DotNetNuke versions prior to 6 suffer from a file disclosure vulnerability. • https://www.exploit-db.com/exploits/17873 http://securityreason.com/securityalert/8386 http://www.us-cert.gov/cas/techalerts/TA11-256A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-074 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12907 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •