CVSS: 4.3EPSS: 91%CPEs: 17EXPL: 0CVE-2010-3243
https://notcve.org/view.php?id=CVE-2010-3243
Cross-site scripting (XSS) vulnerability in the toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in Microsoft Windows SharePoint Services 3.0 SP2 and Office SharePoint Server 2007 SP2, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "HTML Sanitization Vulnerability." Una vulnerabilidad de ejecución de comandos en sitios cruzados en la función toStaticHTML en Microsoft Internet Explorer v8, y la función SafeHTML en Microsoft Windows SharePoint Services v3.0 SP2 y Office SharePoint Server 2007 SP2, permite a atacantes remotos inyectar código web o HTML de su lección a través de vectores no especificados, conocido como "Vulnerabilidad de saneamiento HTML ." • http://support.avaya.com/css/P8/documents/100113324 http://www.us-cert.gov/cas/techalerts/TA10-285A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-071 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-072 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7637 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 94%CPEs: 6EXPL: 3CVE-2010-3324 – Microsoft Internet Explorer 8 - 'toStaticHTML()' HTML Sanitization Bypass
https://notcve.org/view.php?id=CVE-2010-3324
The toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in Microsoft Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010, Office SharePoint Server 2007 SP2, Groove Server 2010, and Office Web Apps, allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism and conduct XSS attacks via a crafted use of the Cascading Style Sheets (CSS) @import rule, aka "HTML Sanitization Vulnerability," a different vulnerability than CVE-2010-1257. La función toStaticHTML en Internet Explorer 8 de Microsoft y la función SafeHTML en Windows SharePoint Services versión 3.0 SP2, SharePoint Foundation 2010, Office SharePoint Server 2007 SP2, Groove Server 2010 y Office Web Apps de Microsoft, permite a los atacantes remotos omitir el mecanismo de protección de cross-site scripting (XSS) y conducir ataques de tipo XSS por medio de un uso especialmente diseñado de la regla @import de Hojas de Estilo en Cascada (CSS), también se conoce como "HTML Sanitization Vulnerability", una vulnerabilidad diferente de CVE-2010-1257. • https://www.exploit-db.com/exploits/34478 http://archives.neohapsis.com/archives/fulldisclosure/2010-08/0179.html http://support.avaya.com/css/P8/documents/100113324 http://www.us-cert.gov/cas/techalerts/TA10-285A.html http://www.wooyun.org/bug.php?action=view&id=189 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-071 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-072 https://oval.cisecurity.org/repository/search/definition/ • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 71%CPEs: 28EXPL: 0CVE-2010-1257
https://notcve.org/view.php?id=CVE-2010-1257
Cross-site scripting (XSS) vulnerability in the toStaticHTML API, as used in Microsoft Office InfoPath 2003 SP3, 2007 SP1, and 2007 SP2; Office SharePoint Server 2007 SP1 and SP2; SharePoint Services 3.0 SP1 and SP2; and Internet Explorer 8 allows remote attackers to inject arbitrary web script or HTML via vectors related to sanitization. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la API toStaticHTML, tal como es usada en Microsoft Office InfoPath 2003 SP3, 2007 SP1 y 2007 SP2; Office SharePoint Server 2007 SP1 y SP2; SharePoint Services 3.0 SP1 y SP2 y Internet Explorer 8 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través de vectores relacionados con procedimientos de limpieza. • http://support.avaya.com/css/P8/documents/100089747 http://www.securityfocus.com/bid/40409 http://www.us-cert.gov/cas/techalerts/TA10-159B.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-035 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-039 https://exchange.xforce.ibmcloud.com/vulnerabilities/58866 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6677 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.0EPSS: 96%CPEs: 4EXPL: 0CVE-2010-1264
https://notcve.org/view.php?id=CVE-2010-1264
Unspecified vulnerability in Microsoft Windows SharePoint Services 3.0 SP1 and SP2 allows remote attackers to cause a denial of service (hang) via crafted requests to the Help page that cause repeated restarts of the application pool, aka "Sharepoint Help Page Denial of Service Vulnerability." Vulnerabilidad no especificada en Microsoft Windows SharePoint Services 3.0 SP1 y SP2 permite a atacantes remotos provocar una denegación de servicio (cuelgue) mediante peticiones manipuladas a la página Help que causan reinicios repetidos de la aplicación, también conocida como "Sharepoint Help Page Denial of Service Vulnerability." • http://www.securityfocus.com/bid/40559 http://www.us-cert.gov/cas/techalerts/TA10-159B.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-039 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7241 •
CVSS: 4.3EPSS: 88%CPEs: 5EXPL: 2CVE-2010-0817 – Microsoft SharePoint Server 2007 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2010-0817
Cross-site scripting (XSS) vulnerability in _layouts/help.aspx in Microsoft SharePoint Server 2007 12.0.0.6421 and possibly earlier, and SharePoint Services 3.0 SP1 and SP2, versions, allows remote attackers to inject arbitrary web script or HTML via the cid0 parameter. Una vulnerabilidad de tipo cross-site scripting (XSS) en el archivo _layouts/help.aspx en SharePoint Server 2007 versión 12.0.0.6421 y posiblemente anterior, y SharePoint Services versión 3.0 SP1 y SP2 de Microsoft, permite a los atacantes remotos inyectar script web o HTML arbitrario por medio del parámetro cid0. • https://www.exploit-db.com/exploits/12450 http://www.htbridge.ch/advisory/xss_in_microsoft_sharepoint_server_2007.html http://www.securityfocus.com/archive/1/511021/100/0/threaded http://www.us-cert.gov/cas/techalerts/TA10-159B.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-039 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7468 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •