37 results (0.009 seconds)

CVSS: 9.3EPSS: 94%CPEs: 35EXPL: 4

CVE-2010-0816 – Microsoft Windows Outlook Express and Windows Mail - Integer Overflow

https://notcve.org/view.php?id=CVE-2010-0816

Integer overflow in inetcomm.dll in Microsoft Outlook Express 5.5 SP2, 6, and 6 SP1; Windows Live Mail on Windows XP SP2 and SP3, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7; and Windows Mail on Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows remote e-mail servers and man-in-the-middle attackers to execute arbitrary code via a crafted (1) POP3 or (2) IMAP response, as demonstrated by a certain +OK response on TCP port 110, aka "Outlook Express and Windows Mail Integer Overflow Vulnerability." Un desbordamiento de entero en inetcomm.dll en Microsoft Outlook Express v5.5 Service Pack 2, v6 y v6 SP1, Windows Live Mail en Windows XP SP2 y SP3, Windows Vista SP1 y SP2, Windows Server 2008 Gold, Service Pack 2, y R2 y Windows 7, y Windows Mail en Windows Vista SP1 y SP2, Windows Server 2008 Gold, Service Pack 2, y R2 y Windows 7 permite ejecutar, a los servidores de correo electrónico remoto y los atacantes "man-in-the-middle", código de su elección a través de una respuesta (1) POP3 o ( 2) IMAP debidamente modificada, como lo demuestra una respuesta + OK en el puerto TCP 110. Esta vulnerabilidad también es conocida como "Vulnerabilidad de desbordamiento de Entero de Outlook Express y Windows Mail." Microsoft Windows Outlook Express and Windows Mail suffer from an integer overflow vulnerability. • https://www.exploit-db.com/exploits/12564 http://archives.neohapsis.com/archives/bugtraq/2010-05/0068.html http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=13&Itemid=13 http://www.securityfocus.com/bid/40052 http://www.us-cert.gov/cas/techalerts/TA10-131A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-030 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6734 • CWE-189: Numeric Errors •

CVSS: 7.1EPSS: 92%CPEs: 4EXPL: 0

CVE-2008-1448

https://notcve.org/view.php?id=CVE-2008-1448

The MHTML protocol handler in a component of Microsoft Outlook Express 5.5 SP2 and 6 through SP1, and Windows Mail, does not assign the correct Internet Explorer Security Zone to UNC share pathnames, which allows remote attackers to bypass intended access restrictions and read arbitrary files via an mhtml: URI in conjunction with a redirection, aka "URL Parsing Cross-Domain Information Disclosure Vulnerability." El manejador de protocolo MHTML en un componente de Outlook Express versiones 5.5 SP2 y 6 hasta SP1 y Windows Mail de Microsoft no asigna la zona de seguridad de Internet Explorer correcta a los nombres de ruta (path) de recurso compartido UNC, lo que permite a los atacantes remotos omitir las restricciones de acceso previstas y leer archivos arbitrarios por medio de un URI mhtml: en conjunto con un redireccionamiento, también se conoce como "URL Parsing Cross-Domain Information Disclosure Vulnerability". • http://marc.info/?l=bugtraq&m=121915960406986&w=2 http://secunia.com/advisories/31415 http://www.coresecurity.com/content/internet-explorer-zone-elevation http://www.securityfocus.com/archive/1/495458/100/0/threaded http://www.securityfocus.com/bid/30585 http://www.securitytracker.com/id?1020679 http://www.securitytracker.com/id?1020680 http://www.us-cert.gov/cas/techalerts/TA08-225A.html http://www.vupen.com/english/advisories/2008/2352 https://docs.microsoft.com/en-us&#x • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 9.3EPSS: 95%CPEs: 3EXPL: 0

CVE-2007-3897

https://notcve.org/view.php?id=CVE-2007-3897

Heap-based buffer overflow in Microsoft Outlook Express 6 and earlier, and Windows Mail for Vista, allows remote Network News Transfer Protocol (NNTP) servers to execute arbitrary code via long NNTP responses that trigger memory corruption. Un desbordamiento de búfer en la región heap de la memoria en Microsoft Outlook Express versión 6 y anteriores, y Windows Mail para Vista, permite que los servidores remotos de Network News Transfer Protocol (NNTP) ejecuten código arbitrario por medio de las respuestas NNTP largas que desencadenan una corrupción de la memoria. • http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=607 http://secunia.com/advisories/27112 http://securitytracker.com/id?1018785 http://securitytracker.com/id?1018786 http://www.securityfocus.com/archive/1/481983/100/100/threaded http://www.securityfocus.com/archive/1/482366/100/0/threaded http://www.securityfocus.com/bid/25908 http://www.us-cert.gov/cas/techalerts/TA07-282A.html http://www.vupen.com/english/advisories/2007/3436 https://docs.microsoft.com/e • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •

CVSS: 4.3EPSS: 8%CPEs: 12EXPL: 0

CVE-2007-2227

https://notcve.org/view.php?id=CVE-2007-2227

The MHTML protocol handler in Microsoft Outlook Express 6 and Windows Mail in Windows Vista does not properly handle Content-Disposition "notifications," which allows remote attackers to obtain sensitive information from other Internet Explorer domains, aka "Content Disposition Parsing Cross Domain Information Disclosure Vulnerability." El manejador de protocolo MHTML en Microsoft Outlook Express 6 y Windows Mail en Windows Vista no maneja adecuadamente "notificaciones" de disposición de contenido (Content-Disposition), lo cual permite a atacantes remotos obtener información sensible de otros dominios de Internet Explorer, también conocida como "Vulnerabilidad de Revelación de Información de Dominios Cruzados en Análisis de Disposición de Contenido" (Content Disposition Parsing Cross Domain Information Disclosure Vulnerability). • http://archive.openmya.devnull.jp/2007.06/msg00060.html http://openmya.hacker.jp/hasegawa/security/ms07-034.txt http://osvdb.org/35346 http://secunia.com/advisories/25639 http://www.securityfocus.com/archive/1/471947/100/0/threaded http://www.securityfocus.com/archive/1/472002/100/0/threaded http://www.securityfocus.com/bid/24410 http://www.securitytracker.com/id?1018233 http://www.securitytracker.com/id?1018234 http://www.us-cert.gov/cas/techalerts/TA07-163A.html http •

CVSS: 4.3EPSS: 11%CPEs: 12EXPL: 0

CVE-2007-2225

https://notcve.org/view.php?id=CVE-2007-2225

A component in Microsoft Outlook Express 6 and Windows Mail in Windows Vista does not properly handle certain HTTP headers when processing MHTML protocol URLs, which allows remote attackers to obtain sensitive information from other Internet Explorer domains, aka "URL Parsing Cross Domain Information Disclosure Vulnerability." Un componente en Microsoft Outlook Express 6 y windows Mail en Windows Vista no maneja adecuadamente determinadas cabeceras HTTP cuado procesa URLs del protocolo MHTML, lo cual permite a atacantes remotos obtener información sensible de ostros dominios de Internet Explorer, también conocida como "Vulnerabilidad de revelación de información de dominios cruzados en el análisis URL" (URL Parsing Cross Domain Information Disclosure Vulnerability). • http://archive.openmya.devnull.jp/2007.06/msg00060.html http://openmya.hacker.jp/hasegawa/security/ms07-034.txt http://osvdb.org/35345 http://secunia.com/advisories/25639 http://www.kb.cert.org/vuls/id/682825 http://www.securityfocus.com/archive/1/471947/100/0/threaded http://www.securityfocus.com/archive/1/472002/100/0/threaded http://www.securityfocus.com/bid/24392 http://www.securitytracker.com/id?1018231 http://www.securitytracker.com/id?1018232 http://www •