CVSS: 9.3EPSS: 87%CPEs: 7EXPL: 0CVE-2008-3007
https://notcve.org/view.php?id=CVE-2008-3007
Argument injection vulnerability in a URI handler in Microsoft Office XP SP3, 2003 SP2 and SP3, 2007 Office System Gold and SP1, and Office OneNote 2007 Gold and SP1 allow remote attackers to execute arbitrary code via a crafted onenote:// URL, aka "Uniform Resource Locator Validation Error Vulnerability." Microsoft Office XP SP3, 2003 SP2 y SP3, 2007 Office System Gold y SP1, y Office OneNote 2007 Gold y SP1; permiten a atacantes remotos ejecutar código de su elección mediante una URL onenote:// manipulada. También se conoce como "Vulnerabilidad de Error de Validación en el Localizador Uniforme de Recurso (Uniform Resource Locator - URL)". • http://marc.info/?l=bugtraq&m=122235754013992&w=2 http://www.insomniasec.com/advisories/ISVA-080910.1.htm http://www.securityfocus.com/archive/1/496178/100/0/threaded http://www.securityfocus.com/bid/31067 http://www.securitytracker.com/id?1020833 http://www.us-cert.gov/cas/techalerts/TA08-253A.html http://www.vupen.com/english/advisories/2008/2523 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-055 https://oval.cisecurity.org/repository/search&# • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 4%CPEs: 23EXPL: 0CVE-2008-3068
https://notcve.org/view.php?id=CVE-2008-3068
Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by using an arbitrary URL from a certificate embedded in a (1) S/MIME e-mail message or (2) signed document, which allows remote attackers to obtain reading times and IP addresses of recipients, and port-scan results, via a crafted certificate with an Authority Information Access (AIA) extension. Microsoft Crypto API 5.131.2600.2180 hasta la 6.0, como las usadas en Outlook, Windows Live Mail, y Office 2007, realiza una lista de revocación de certificado (CRL) utilizando una URL arbitraria de un certificado incluido en (1) mensaje de correo electrónico S/MIME o (2) documento firmado, lo que permite a atacantes remotos conseguir tiempos de lectura y direcciones IP de recipientes, y resultados de escaneo de puerto, a través de un certificado manipulado con una extensión de de una Authority Information Access (AIA). • http://securityreason.com/securityalert/3978 http://www.securityfocus.com/archive/1/493947/100/0/threaded http://www.securityfocus.com/archive/1/494101/100/0/threaded http://www.securityfocus.com/bid/28548 http://www.securitytracker.com/id?1019736 http://www.securitytracker.com/id?1019737 http://www.securitytracker.com/id?1019738 https://www.cynops.de/advisories/AKLINK-SA-2008-002.txt https://www.cynops.de/advisories/AKLINK-SA-2008-003.txt https://www.cynops.de/advisories/AK •