CVSS: 4.3EPSS: 97%CPEs: 16EXPL: 3CVE-2011-0096 – Microsoft Internet Explorer - MHTML Protocol Handler Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2011-0096
The MHTML protocol handler in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle a MIME format in a request for content blocks in a document, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site that is visited in Internet Explorer, aka "MHTML Mime-Formatted Request Vulnerability." La implementación de MHTML en Microsoft Windows XP SP2 y SP3, Windows Server 2003 SP2, Windows Vista SP1 y SP2, Windows Server 2008 Gold, SP2, y R2, y Windows 7 no maneja adecuadamente el formato MIME en una petición de bloqueo de contenido en un documento, lo que permite a atacantes remotos conducir un ataque de a través de una vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) sitio web manipulado que es visitado por Internet Explorer. • https://www.exploit-db.com/exploits/16071 http://blogs.technet.com/b/msrc/archive/2011/01/28/microsoft-releases-security-advisory-2501696.aspx http://blogs.technet.com/b/srd/archive/2011/01/28/more-information-about-the-mhtml-script-injection-vulnerability.aspx http://osvdb.org/70693 http://secunia.com/advisories/43093 http://www.80vul.com/webzine_0x05/0x05%20IE%E4%B8%8BMHTML%E5%8D%8F%E8%AE%AE%E5%B8%A6%E6%9D%A5%E7%9A%84%E8%B7%A8%E5%9F%9F%E5%8D%B1%E5%AE%B3.htm • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.6EPSS: 96%CPEs: 3EXPL: 3CVE-2010-4701 – Microsoft Windows Fax Services Cover Page Editor - '.cov' Memory Corruption
https://notcve.org/view.php?id=CVE-2010-4701
Heap-based buffer overflow in the CDrawPoly::Serialize function in fxscover.exe in Microsoft Windows Fax Services Cover Page Editor 5.2 r2 in Windows XP Professional SP3, Server 2003 R2 Enterprise Edition SP2, and Windows 7 Professional allows remote attackers to execute arbitrary code via a long record in a Fax Cover Page (.cov) file. NOTE: some of these details are obtained from third party information. Desbordamiento de búfer basado en memoria dinámica en la función CDrawPoly::Serialize de fxscover.exe de Microsoft Windows Fax Services Cover Page Editor v5.2 r2 de Windows XP Professional SP3, Server 2003 R2 Enterprise Edition SP2, y Windows 7 Professional permite a atacantes remotos ejecutar código de su elección a través de un registro largo en un fichero Fax Cover Page (.cov). NOTA: Algunos de estos detalles se han obtenido de fuentes de terceros. • https://www.exploit-db.com/exploits/15839 http://retrogod.altervista.org/9sg_cov_bof.html http://secunia.com/advisories/42747 http://www.exploit-db.com/exploits/15839 http://www.securitytracker.com/id?1024925 http://www.us-cert.gov/cas/techalerts/TA11-102A.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12689 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.2EPSS: 0%CPEs: 18EXPL: 1CVE-2010-2743 – Microsoft Win32k - Keyboard Layout (MS10-073)
https://notcve.org/view.php?id=CVE-2010-2743
The kernel-mode drivers in Microsoft Windows XP SP3 do not properly perform indexing of a function-pointer table during the loading of keyboard layouts from disk, which allows local users to gain privileges via a crafted application, as demonstrated in the wild in July 2010 by the Stuxnet worm, aka "Win32k Keyboard Layout Vulnerability." NOTE: this might be a duplicate of CVE-2010-3888 or CVE-2010-3889. Los controladores de modo kernel de Microsoft Windows XP Service Pack 3 no realizan correctamente la indexación de una tabla de funciones de puntero durante la carga de la distribución del teclado desde el disco, lo que permite a usuarios locales conseguir privilegios a través de una aplicación manipulada, como se demuestró en julio de 2010 con el gusano Stuxnet, también conocido como "Vulnerabilidad de distribución del teclado Win32k." NOTA: este podría ser un duplicado de CVE-2010-3888 o CVE-2010-3889. Demonstration code for the Win32k Keyboard Layout vulnerability as described in MS10-073. • https://www.exploit-db.com/exploits/15985 http://www.us-cert.gov/cas/techalerts/TA10-285A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-073 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7514 •
CVSS: 9.3EPSS: 95%CPEs: 18EXPL: 1CVE-2011-0027 – Microsoft Internet Explorer MSADO CacheSize Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2011-0027
Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2, and Windows Data Access Components (WDAC) 6.0, does not properly validate memory allocation for internal data structures, which allows remote attackers to execute arbitrary code, possibly via a large CacheSize property that triggers an integer wrap and a buffer overflow, aka "ADO Record Memory Vulnerability." NOTE: this might be a duplicate of CVE-2010-1117 or CVE-2010-1118. Microsoft Data Access Components (MDAC) versión 2.8 SP1 y SP2 y Windows Data Access Components (WDAC) versión 6.0 no valida apropiadamente la asignación de memoria para las estructuras de datos internas, lo que permite a los atacantes remotos ejecutar código arbitrario, posiblemente por medio de una propiedad CacheSize larga que desencadena un ajuste de enteros y un desbordamiento del búfer, también se conoce como "ADO Record Memory Vulnerability" Nota: este CVE podría ser un duplicado de CVE-2010-1117 o CVE-2010-1118. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. This vulnerability was submitted to the ZDI via at the annual Pwn2Own competition at CanSecWest. • https://www.exploit-db.com/exploits/15984 http://osvdb.org/70444 http://secunia.com/advisories/42804 http://support.avaya.com/css/P8/documents/100124846 http://vreugdenhilresearch.nl/ms11-002-pwn2own-heap-overflow http://www.securityfocus.com/bid/45698 http://www.securitytracker.com/id?1024947 http://www.us-cert.gov/cas/techalerts/TA11-011A.html http://www.vupen.com/english/advisories/2011/0075 http://www.zerodayinitiative.com/advisories/ZDI-11-002 https://docs.microsoft. • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 89%CPEs: 18EXPL: 0CVE-2011-0026 – Microsoft Data Access Components DSN Overflow Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2011-0026
Integer signedness error in the SQLConnectW function in an ODBC API (odbc32.dll) in Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2, and Windows Data Access Components (WDAC) 6.0, allows remote attackers to execute arbitrary code via a long string in the Data Source Name (DSN) and a crafted szDSN argument, which bypasses a signed comparison and leads to a buffer overflow, aka "DSN Overflow Vulnerability." Error en la propiedad signedness de enteros en la función SQLConnectW en una API de ODBC (odbc32.dll) en Microsoft Data Access Components (MDAC) versión 2.8 SP1 y SP2, y Windows Data Access Components (WDAC) versión 6.0, permite a los atacantes remotos ejecutar código arbitrario por medio de una cadena larga en el Nombre de Origen de Datos (DSN) y un argumento szDSN creado, que omite una comparación firmada y conduce a un desbordamiento del búfer, también se conoce como "DSN Overflow Vulnerability". This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Microsoft Data Access Components. The vulnerability is present in an API call and as such successful exploitation will depend on an application's implementation of this call. The specific flaw exists within the SQLConnectW call in the odbc32.dll component. When calculating the size of a user provided szDSN, the result of a call to lstrlenW is used in a signed comparison to SQL_MAX_DSN_LENGTH to verify the destination buffer size. • http://osvdb.org/70443 http://secunia.com/advisories/42804 http://support.avaya.com/css/P8/documents/100124846 http://www.securityfocus.com/bid/45695 http://www.securitytracker.com/id?1024947 http://www.us-cert.gov/cas/techalerts/TA11-011A.html http://www.vupen.com/english/advisories/2011/0075 http://www.zerodayinitiative.com/advisories/ZDI-11-001 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-002 https://oval.cisecurity.org/repository/search/def • CWE-189: Numeric Errors •