CVSS: 6.1EPSS: 42%CPEs: 3EXPL: 0CVE-2010-3936
https://notcve.org/view.php?id=CVE-2010-3936
10 Nov 2010 — Cross-site scripting (XSS) vulnerability in Signurl.asp in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, 2010 Update 1, and 2010 Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "XSS in Signurl.asp Vulnerability." Vulnerabilidad de secuencias de comandos en sitios cruzados en Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, 2010 Update 1, y 2010 Update 2 permite a atacantes remotos inyectar código web o HTML a través de vectores no... • http://www.us-cert.gov/cas/techalerts/TA10-313A.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 29%CPEs: 3EXPL: 0CVE-2010-2732
https://notcve.org/view.php?id=CVE-2010-2732
10 Nov 2010 — Open redirect vulnerability in the web interface in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, 2010 Update 1, and 2010 Update 2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, aka "UAG Redirection Spoofing Vulnerability." Vulnerabilidad de redirección abierta en el interfaz web de Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, 2010 Update 1, and 2010 Update 2, permite a atacantes remotos redirigir a usuarios... • http://www.us-cert.gov/cas/techalerts/TA10-313A.html • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 47%CPEs: 3EXPL: 0CVE-2010-2733
https://notcve.org/view.php?id=CVE-2010-2733
10 Nov 2010 — Cross-site scripting (XSS) vulnerability in the Web Monitor in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, 2010 Update 1, and 2010 Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "UAG XSS Allows EOP Vulnerability." Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en el Web Monitor de Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, 2010 Update 1, and 2010 Update 2 que permite a atacantes remotos inyectar secuenc... • http://www.us-cert.gov/cas/techalerts/TA10-313A.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 47%CPEs: 3EXPL: 0CVE-2010-2734
https://notcve.org/view.php?id=CVE-2010-2734
10 Nov 2010 — Cross-site scripting (XSS) vulnerability in the mobile portal in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, 2010 Update 1, and 2010 Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "XSS Issue on UAG Mobile Portal Website in Forefront Unified Access Gateway Vulnerability." Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en el el portal móvil de Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, 2010 Update 1, y 20... • http://www.us-cert.gov/cas/techalerts/TA10-313A.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 1%CPEs: 3EXPL: 4CVE-2010-3213 – Outlook Web Access 2007 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2010-3213
07 Sep 2010 — Cross-site request forgery (CSRF) vulnerability in Microsoft Outlook Web Access (owa/ev.owa) 2007 through SP2 allows remote attackers to hijack the authentication of e-mail users for requests that perform Outlook requests, as demonstrated by setting the auto-forward rule. Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en Microsoft Outlook Web Access (owa/ev.owa) 2007 hasta SP2 permite a atacantes remotos secuestrar la autenticación de usuarios de e-mail para peticiones que llevan a ca... • https://www.exploit-db.com/exploits/14285 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.3EPSS: 56%CPEs: 2EXPL: 0CVE-2010-1881
https://notcve.org/view.php?id=CVE-2010-1881
14 Jul 2010 — The FieldList ActiveX control in the Microsoft Access Wizard Controls in ACCWIZ.dll in Microsoft Office Access 2003 SP3 does not properly interact with the memory-access approach used by Internet Explorer and Office during instantiation, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via an HTML document that references this control along with crafted persistent storage data, aka "ACCWIZ.dll Uninitialized Variable Vulnerability." El control FieldList... • http://www.us-cert.gov/cas/techalerts/TA10-194A.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 10.0EPSS: 61%CPEs: 6EXPL: 0CVE-2010-0814 – Microsoft Office Access AccWizObjects ActiveX Control Uninitialized Imports Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2010-0814
13 Jul 2010 — The Microsoft Access Wizard Controls in ACCWIZ.dll in Microsoft Office Access 2003 SP3 and 2007 SP1 and SP2 do not properly interact with the memory-allocation approach used by Internet Explorer during instantiation, which allows remote attackers to execute arbitrary code via a web site that references multiple ActiveX controls, as demonstrated by the ImexGrid and FieldList controls, aka "Access ActiveX Control Vulnerability." El Microsoft Access Wizard Controls en ACCWIZ.dll en Microsoft Office Access 2003... • http://www.us-cert.gov/cas/techalerts/TA10-194A.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 10.0EPSS: 10%CPEs: 3EXPL: 0CVE-2010-0284 – Novell Access Manager Arbitrary File Upload Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2010-0284
18 Jun 2010 — Directory traversal vulnerability in the getEntry method in the PortalModuleInstallManager component in a servlet in nps.jar in the Administration Console (aka Access Management Console) in Novell Access Manager 3.1 before 3.1.2-281 on Windows allows remote attackers to create arbitrary files with any contents, and consequently execute arbitrary code, via a .. (dot dot) in a parameter, aka ZDI-CAN-678. Vulnerabilidad de salto de directorio en el método getEntry en el componente PortalModuleInstallManager en... • http://secunia.com/advisories/40198 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 25%CPEs: 4EXPL: 0CVE-2008-2248
https://notcve.org/view.php?id=CVE-2008-2248
08 Jul 2008 — Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) for Exchange Server 2003 SP2 allows remote attackers to inject arbitrary web script or HTML via unspecified HTML, a different vulnerability than CVE-2008-2247. La vulnerabilidad de tipo Cross-site scripting (XSS) en Outlook Web Access (OWA) para Exchange Server 2003 SP2, permite a atacantes remotos inyectar script web o HTML por medio de HTML no especificado, una vulnerabilidad diferente a la CVE-2008-2247. • http://secunia.com/advisories/30964 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 10%CPEs: 23EXPL: 0CVE-2008-3068
https://notcve.org/view.php?id=CVE-2008-3068
07 Jul 2008 — Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by using an arbitrary URL from a certificate embedded in a (1) S/MIME e-mail message or (2) signed document, which allows remote attackers to obtain reading times and IP addresses of recipients, and port-scan results, via a crafted certificate with an Authority Information Access (AIA) extension. Microsoft Crypto API 5.131.2600.2180 hasta la 6.0, como la... • http://securityreason.com/securityalert/3978 •