CVSS: 9.3EPSS: 90%CPEs: 26EXPL: 1CVE-2007-2223 – Microsoft Internet Explorer substringData Heap Overflow Vulnerability
https://notcve.org/view.php?id=CVE-2007-2223
Microsoft XML Core Services (MSXML) 3.0 through 6.0 allows remote attackers to execute arbitrary code via the substringData method on a (1) TextNode or (2) XMLDOM object, which causes an integer overflow that leads to a buffer overflow. Microsoft XML Core Services (MSXML) versión 3.0 hasta 6.0 permite a los atacantes remotos ejecutar código arbitrario por medio del método substringData en un objeto (1) TextNode o (2) XMLDOM, lo que provoca un desbordamiento de enteros que conduce a un desbordamiento de búfer. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of various Microsoft software User interaction is required to exploit this vulnerability in that the target must visit a malicious page. The specific flaw exists in the substringData() method available on the TextNode JavaScript object. When specific parameters are passed to the method, an integer overflow occurs causing incorrect memory allocation. If this event occurs after a different ActiveX object has been instantiated, an exploitable condition is created when the ActiveX object is deallocated which can result in the execution of arbitrary code. • https://www.exploit-db.com/exploits/30493 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=576 http://secunia.com/advisories/26447 http://www.kb.cert.org/vuls/id/361968 http://www.securityfocus.com/archive/1/476527/100/0/threaded http://www.securityfocus.com/archive/1/476747/100/0/threaded http://www.securityfocus.com/bid/25301 http://www.securitytracker.com/id?1018559 http://www.vupen.com/english/advisories/2007/2866 http://www.zerodayinitiative.com/ • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-190: Integer Overflow or Wraparound •
CVSS: 4.3EPSS: 96%CPEs: 3EXPL: 1CVE-2007-2581 – Microsoft SharePoint Server 3.0 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2007-2581
Multiple cross-site scripting (XSS) vulnerabilities in Microsoft Windows SharePoint Services 3.0 for Windows Server 2003 and Office SharePoint Server 2007 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO (query string) in "every main page," as demonstrated by default.aspx. Varias vulnerabilidades de tipo cross-site scripting (XSS) en Microsoft Windows SharePoint Services versión 3.0 para Windows Server 2003 y Office SharePoint Server 2007 permiten a atacantes remotos inyectar script web o HTML arbitrario por medio del PATH_INFO (cadena de consulta) en "every main page," como fue demostrado por default.aspx. • https://www.exploit-db.com/exploits/29951 http://archives.neohapsis.com/archives/bugtraq/2007-05/0196.html http://osvdb.org/37630 http://secunia.com/advisories/27148 http://securityreason.com/securityalert/2682 http://securitytracker.com/id?1018789 http://www.securityfocus.com/archive/1/467738/100/0/threaded http://www.securityfocus.com/archive/1/467749/100/0/threaded http://www.securityfocus.com/archive/1/482366/100/0/threaded http://www.securityfocus.com/bid/23832 http: • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 14%CPEs: 2EXPL: 3CVE-2006-0015 – Microsoft FrontPage - Server Extensions Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2006-0015
Cross-site scripting (XSS) vulnerability in _vti_bin/_vti_adm/fpadmdll.dll in Microsoft FrontPage Server Extensions 2002 and SharePoint Team Services allows remote attackers to inject arbitrary web script or HTML, then leverage the attack to execute arbitrary programs or create new accounts, via the (1) operation, (2) command, and (3) name parameters. • https://www.exploit-db.com/exploits/27620 http://secunia.com/advisories/19623 http://securityreason.com/securityalert/704 http://securitytracker.com/id?1015895 http://securitytracker.com/id?1015896 http://www.argeniss.com/research/ARGENISS-ADV-040602.txt http://www.securityfocus.com/archive/1/430803/100/0/threaded http://www.securityfocus.com/bid/17452 http://www.vupen.com/english/advisories/2006/1322 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-017 •
CVSS: 4.3EPSS: 5%CPEs: 3EXPL: 0CVE-2005-0049
https://notcve.org/view.php?id=CVE-2005-0049
Windows SharePoint Services and SharePoint Team Services for Windows Server 2003 does not properly validate an HTTP redirection query, which allows remote attackers to inject arbitrary HTML and web script via a cross-site scripting (XSS) attack, or to spoof the web cache. • http://www.kb.cert.org/vuls/id/340409 http://www.us-cert.gov/cas/techalerts/TA05-039A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-006 https://exchange.xforce.ibmcloud.com/vulnerabilities/19091 •
CVSS: 6.0EPSS: 2%CPEs: 7EXPL: 0CVE-2003-0904
https://notcve.org/view.php?id=CVE-2003-0904
Microsoft Exchange 2003 and Outlook Web Access (OWA), when configured to use NTLM authentication, does not properly reuse HTTP connections, which can cause OWA users to view mailboxes of other users when Kerberos has been disabled as an authentication method for IIS 6.0, e.g. when SharePoint Services 2.0 is installed. Microsoft Exchange 2003 y Outlook Web Access (OWA), cuando usan SharePoint Services 2.0, hace que la autenticación Kerberos se desactive para IIS, lo que puede causar que usuarios de OWA vean los buzones de correo de otros usuarios. • http://secunia.com/advisories/10615 http://www.kb.cert.org/vuls/id/530660 http://www.microsoft.com/exchange/support/e2k3owa.asp http://www.ntbugtraq.com/default.asp?pid=36&sid=1&A2=ind0311&L=ntbugtraq&F=P&S=&P=9281 http://www.securityfocus.com/bid/9118 http://www.securityfocus.com/bid/9409 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-002 https://exchange.xforce.ibmcloud.com/vulnerabilities/13869 https://oval.cisecurity.org/repository/search&#x • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •