CVSS: 4.3EPSS: 15%CPEs: 12EXPL: 0CVE-2012-2520
https://notcve.org/view.php?id=CVE-2012-2520
Cross-site scripting (XSS) vulnerability in Microsoft InfoPath 2007 SP2 and SP3 and 2010 SP1, Communicator 2007 R2, Lync 2010 and 2010 Attendee, SharePoint Server 2007 SP2 and SP3 and 2010 SP1, Groove Server 2010 SP1, Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010 SP1, and Office Web Apps 2010 SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted string, aka "HTML Sanitization Vulnerability." Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Microsoft InfoPath 2007 SP2 y SP3 y 2010 SP1, Communicator 2007 R2, Lync 2010 y 2010 Attendee, SharePoint Server 2007 SP2 y SP3 and 2010 SP1, Groove Server 2010 SP1, Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010 SP1, y Office Web Apps 2010 SP1, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de una cadena modificada, también conocido como "HTML Sanitization Vulnerability." • http://www.securityfocus.com/bid/55797 http://www.securitytracker.com/id?1027625 http://www.securitytracker.com/id?1027626 http://www.securitytracker.com/id?1027627 http://www.securitytracker.com/id?1027628 http://www.securitytracker.com/id? • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.3EPSS: 90%CPEs: 10EXPL: 0CVE-2012-2528
https://notcve.org/view.php?id=CVE-2012-2528
Use-after-free vulnerability in Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; Word Automation Services on Microsoft SharePoint Server 2010; and Office Web Apps 2010 SP1 allows remote attackers to execute arbitrary code via a crafted RTF document, aka "RTF File listid Use-After-Free Vulnerability." Vulnerabilidad de uso después de liberación en Microsoft Word 2003 SP3, 2007 SP2 y SP3, y 2010 SP1; Word Viewer; Office Compatibility Pack SP2 y SP3; Word Automation Services en Microsoft SharePoint Server 2010; y Office Web Apps 2010 SP1, permite a atacantes remotos ejecutar código de su elección a través de un documento RTF modificado, también conocido como "RTF File listid Use-After-Free Vulnerability." • http://www.securityfocus.com/bid/55781 http://www.us-cert.gov/cas/techalerts/TA12-283A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-064 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15680 • CWE-399: Resource Management Errors •
CVSS: 9.3EPSS: 92%CPEs: 34EXPL: 0CVE-2012-1856 – Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2012-1856
The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office 2003 SP3, Office 2003 Web Components SP3, Office 2007 SP2 and SP3, Office 2010 SP1, SQL Server 2000 SP4, SQL Server 2005 SP4, SQL Server 2008 SP2, SP3, R2, R2 SP1, and R2 SP2, Commerce Server 2002 SP4, Commerce Server 2007 SP2, Commerce Server 2009 Gold and R2, Host Integration Server 2004 SP1, Visual FoxPro 8.0 SP1, Visual FoxPro 9.0 SP2, and Visual Basic 6.0 Runtime allows remote attackers to execute arbitrary code via a crafted (1) document or (2) web page that triggers system-state corruption, aka "MSCOMCTL.OCX RCE Vulnerability." El control TabStrip ActiveX en Common Controls en MSCOMCTL.OCX en Microsoft Office 2003 SP3, Office 2003 Web Components SP3, Office 2007 SP2 y SP3, Office 2010 SP1, SQL Server 2000 SP4, SQL Server 2005 SP4, SQL Server 2008 SP2, SP3, R2, R2 SP1, y R2 SP2, Commerce Server 2002 SP4, Commerce Server 2007 SP2, Commerce Server 2009 Gold and R2, Host Integration Server 2004 SP1, Visual FoxPro 8.0 SP1, Visual FoxPro 9.0 SP2, y Visual Basic 6.0 Runtime permite a atacantes remotos ejecutar código de su elección a través de (1) un documento o (2) página web que provoca una corrupción del estado del sistema, también conocido como 'MSCOMCTL.OCX RCE Vulnerability.' The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office allows remote attackers to execute arbitrary code via a crafted (1) document or (2) web page that triggers system-state corruption. • http://www.securityfocus.com/bid/54948 http://www.us-cert.gov/cas/techalerts/TA12-227A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-060 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15447 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.3EPSS: 76%CPEs: 3EXPL: 0CVE-2012-2524
https://notcve.org/view.php?id=CVE-2012-2524
Microsoft Office 2007 SP2 and SP3 and 2010 SP1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Computer Graphics Metafile (CGM) file, aka "CGM File Format Memory Corruption Vulnerability." Microsoft Office 2007 SP2 y SP3 y 2010 SP1 permite a atacantes remotos ejecutar código de su elección o provocar una denegación de servicio (corrupción de memoria) a través de un fichero manipulado Computer Graphics Metafile (CGM), también conocido como "CGM File Format Memory Corruption Vulnerability." • http://www.us-cert.gov/cas/techalerts/TA12-227A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-057 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15702 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2012-1860
https://notcve.org/view.php?id=CVE-2012-1860
Microsoft Office SharePoint Server 2007 SP2 and SP3, SharePoint Server 2010 Gold and SP1, and Office Web Apps 2010 Gold and SP1 do not properly check permissions for search scopes, which allows remote authenticated users to obtain sensitive information or cause a denial of service (data modification) by changing a parameter in a search-scope URL, aka "SharePoint Search Scope Vulnerability." Microsoft Office SharePoint Server 2007 SP2 y SP3, SharePoint Server 2010 Gold y SP1, y Office Web Apps 2010 Gold y SP1 no comprueba correctamente los permisos para los ámbitos de búsqueda, permitiendo a usuarios remotos autenticados obtener información sensible o causar una denegación de servicio (modificación de datos) al cambiar un parámetro en una URL de búsqueda, también conocido como "SharePoint Search Scope Vulnerability." • https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-050 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15265 • CWE-264: Permissions, Privileges, and Access Controls •