CVSS: 6.5EPSS: 81%CPEs: 17EXPL: 1CVE-2017-0022 – Microsoft XML Core Services Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2017-0022
17 Mar 2017 — Microsoft XML Core Services (MSXML) in Windows 10 Gold, 1511, and 1607; Windows 7 SP1; Windows 8.1; Windows RT 8.1; Windows Server 2008 SP2 and R2 SP1; Windows Server 2012 Gold and R2; Windows Server 2016; and Windows Vista SP2 improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site, aka "Microsoft XML Information Disclosure Vulnerability." Microsoft XML Core Services (MSXML) en Windows 10 Gold, 1511 y 1607; Windows 7 SP1; Windows 8.1; Windows RT 8.1; Window... • http://www.securityfocus.com/bid/96069 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 26%CPEs: 1EXPL: 0CVE-2016-0147
https://notcve.org/view.php?id=CVE-2016-0147
12 Apr 2016 — Microsoft XML Core Services 3.0 allows remote attackers to execute arbitrary code via a crafted web site, aka "MSXML 3.0 Remote Code Execution Vulnerability." Microsoft XML Core Services 3.0 permite a atacantes remotos ejecutar código arbitrario a través de una página web manipulada, también conocida como "MSXML 3.0 Remote Code Execution Vulnerability". • http://www.securitytracker.com/id/1035523 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2015-2434
https://notcve.org/view.php?id=CVE-2015-2434
15 Aug 2015 — Microsoft XML Core Services 3.0 and 5.0 supports SSL 2.0, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and conducting a decryption attack, aka "MSXML Information Disclosure Vulnerability," a different vulnerability than CVE-2015-2471. Vulnerabilidad en Microsoft XML Core Services 3.0 y 5.0, admite SSL 2.0, lo que hace que sea más fácil para atacantes remotos romper los mecanismos de protección de cifrado husmeando la red y llevando a cabo u... • http://www.securitytracker.com/id/1033241 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-310: Cryptographic Issues •
CVSS: 7.5EPSS: 1%CPEs: 3EXPL: 0CVE-2015-2471
https://notcve.org/view.php?id=CVE-2015-2471
15 Aug 2015 — Microsoft XML Core Services 3.0, 5.0, and 6.0 supports SSL 2.0, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and conducting a decryption attack, aka "MSXML Information Disclosure Vulnerability," a different vulnerability than CVE-2015-2434. Vulnerabilidad en Microsoft XML Core Services 3.0, 5.0 y 6.0 admite SSL 2.0, lo que facilita a atacantes remotos romper los mecanismos de protección de cifrado husmeando la red y llevando a cabo un ataqu... • http://www.securitytracker.com/id/1033241 • CWE-310: Cryptographic Issues •
CVSS: 7.5EPSS: 59%CPEs: 3EXPL: 0CVE-2015-2440 – Microsoft MSXML generate-id Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2015-2440
11 Aug 2015 — Microsoft XML Core Services 3.0, 5.0, and 6.0 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "MSXML Information Disclosure Vulnerability." Vulnerabilidad en Microsoft XML Core Services 3.0, 5.0 y 6.0, permite a atacantes remotos evadir el mecanismo de protección ASLR a través de una página web manipulada, también conocida como 'MSXML Information Disclosure Vulnerability.' This vulnerability allows remote attackers to gain information about the layout of memory on... • http://www.securityfocus.com/bid/76232 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 66%CPEs: 1EXPL: 0CVE-2015-1646
https://notcve.org/view.php?id=CVE-2015-1646
14 Apr 2015 — Microsoft XML Core Services (aka MSXML) 3.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted DTD, aka "MSXML3 Same Origin Policy SFB Vulnerability." Microsoft XML Core Services (también conocido como MSXML) 3.0 permite a atacantes remotos evadir Same Origin Policy y obtener información sensible a través de un DTD manipulado, también conocido como 'vulnerabilidad de SFB de Same Origin Policy de MSXML3.' • http://www.securitytracker.com/id/1032114 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2014-1816
https://notcve.org/view.php?id=CVE-2014-1816
11 Jun 2014 — Microsoft XML Core Services (aka MSXML) 3.0 and 6.0 does not properly restrict the information transmitted by Internet Explorer during a download action, which allows remote attackers to discover (1) full pathnames on the client system and (2) local usernames embedded in these pathnames via a crafted web site, aka "MSXML Entity URI Vulnerability." Microsoft XML Core Services (también conocido como MSXML) 3.0 y 6.0 no restringe debidamente la información transmitida por Internet Explorer durante una acción d... • http://blogs.technet.com/b/srd/archive/2014/06/10/assessing-risk-for-the-june-2014-security-updates.aspx • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.3EPSS: 95%CPEs: 34EXPL: 0CVE-2013-0006
https://notcve.org/view.php?id=CVE-2013-0006
09 Jan 2013 — Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka "MSXML Integer Truncation Vulnerability." Microsoft XML Core Services (también conocido como MSXML) v3.0, v5.0 y v6.0 no analiza correctamente el contenido XML, lo que permite a atacantes remotos ejecutar código arbitrario a través de una página web diseñada, también conocido como "MSXML Integer Truncation Vulnerability." • http://www.us-cert.gov/cas/techalerts/TA13-008A.html • CWE-189: Numeric Errors •
CVSS: 9.3EPSS: 94%CPEs: 34EXPL: 0CVE-2013-0007
https://notcve.org/view.php?id=CVE-2013-0007
09 Jan 2013 — Microsoft XML Core Services (aka MSXML) 4.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka "MSXML XSLT Vulnerability." Microsoft XML Core Services (también conocido como MSXML) v4.0, v5.0 y v6.0 no analiza correctamente el contenido XML, lo que permite a atacantes remotos ejecutar código arbitrario a través de una página web diseñada, también conocido como "Vulnerabilidad de MSXML XSLT." • http://www.us-cert.gov/cas/techalerts/TA13-008A.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.3EPSS: 95%CPEs: 29EXPL: 3CVE-2012-1889 – Microsoft XML Core Services Memory Corruption Vulnerability
https://notcve.org/view.php?id=CVE-2012-1889
13 Jun 2012 — Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. Microsoft XML Core Services 3.0, 4.0, 5.0, y 6.0 accede a localizaciones de memoria mal formadas, lo que permite a atacantes remotos ejecutar código arbitrario o provocar una denegación de servicio (corrupción de memoria) a través de un sitio web modificado. Microsoft XML Core Services cont... • https://www.exploit-db.com/exploits/19186 • CWE-787: Out-of-bounds Write •