CVSS: 8.8EPSS: 3%CPEs: 2EXPL: 0CVE-2023-38151 – Microsoft Host Integration Server 2020 Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2023-38151
Microsoft Host Integration Server 2020 Remote Code Execution Vulnerability Vulnerabilidad de ejecución remota de código de Microsoft Host Integration Server 2020. • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38151 • CWE-908: Use of Uninitialized Resource •
CVSS: 9.3EPSS: 92%CPEs: 34EXPL: 0CVE-2012-1856 – Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2012-1856
The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office 2003 SP3, Office 2003 Web Components SP3, Office 2007 SP2 and SP3, Office 2010 SP1, SQL Server 2000 SP4, SQL Server 2005 SP4, SQL Server 2008 SP2, SP3, R2, R2 SP1, and R2 SP2, Commerce Server 2002 SP4, Commerce Server 2007 SP2, Commerce Server 2009 Gold and R2, Host Integration Server 2004 SP1, Visual FoxPro 8.0 SP1, Visual FoxPro 9.0 SP2, and Visual Basic 6.0 Runtime allows remote attackers to execute arbitrary code via a crafted (1) document or (2) web page that triggers system-state corruption, aka "MSCOMCTL.OCX RCE Vulnerability." El control TabStrip ActiveX en Common Controls en MSCOMCTL.OCX en Microsoft Office 2003 SP3, Office 2003 Web Components SP3, Office 2007 SP2 y SP3, Office 2010 SP1, SQL Server 2000 SP4, SQL Server 2005 SP4, SQL Server 2008 SP2, SP3, R2, R2 SP1, y R2 SP2, Commerce Server 2002 SP4, Commerce Server 2007 SP2, Commerce Server 2009 Gold and R2, Host Integration Server 2004 SP1, Visual FoxPro 8.0 SP1, Visual FoxPro 9.0 SP2, y Visual Basic 6.0 Runtime permite a atacantes remotos ejecutar código de su elección a través de (1) un documento o (2) página web que provoca una corrupción del estado del sistema, también conocido como 'MSCOMCTL.OCX RCE Vulnerability.' The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office allows remote attackers to execute arbitrary code via a crafted (1) document or (2) web page that triggers system-state corruption. • http://www.securityfocus.com/bid/54948 http://www.us-cert.gov/cas/techalerts/TA12-227A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-060 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15447 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.0EPSS: 92%CPEs: 4EXPL: 1CVE-2011-2007 – Microsoft Host Integration Server 2004-2010 - Remote Denial of Service
https://notcve.org/view.php?id=CVE-2011-2007
Microsoft Host Integration Server (HIS) 2004 SP1, 2006 SP1, 2009, and 2010 allows remote attackers to cause a denial of service (SNA Server service outage) via crafted TCP or UDP traffic, aka "Endless Loop DoS in snabase.exe Vulnerability." Microsoft Host Integration Server (HIS) 2004 SP1, 2006 SP1, 2009 y 2010 permite a atacantes remotos provocar una denegación de servicio (SNA Server interrupción del servicio) a través de tráfico TCP o UDP específicamente modificado. También conocida como "Vulnerabilidad de denegación de servicio por bucle infinito en snabase.exe". • https://www.exploit-db.com/exploits/36211 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-082 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13040 • CWE-20: Improper Input Validation •
CVSS: 5.0EPSS: 17%CPEs: 4EXPL: 0CVE-2011-2008
https://notcve.org/view.php?id=CVE-2011-2008
Microsoft Host Integration Server (HIS) 2004 SP1, 2006 SP1, 2009, and 2010 allows remote attackers to cause a denial of service (SNA Server service outage) via crafted TCP or UDP traffic, aka "Access of Unallocated Memory DoS Vulnerability." Microsoft Host Integration Server (HIS) 2004 SP1, 2006 SP1, 2009 y 2010 permite a atacantes remotos provocar una denegación de servicio (Interrupción del servicio del SNA Server) a través de tráfico TCP o UDP específicamente modificado. También conocida como "Vulnerabilidad de denegación de servicio por acceso a memoria no asignada". • https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-082 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12915 • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 96%CPEs: 7EXPL: 1CVE-2008-3466 – Microsoft Host Integration Server 2006 Command Execution
https://notcve.org/view.php?id=CVE-2008-3466
Microsoft Host Integration Server (HIS) 2000, 2004, and 2006 does not limit RPC access to administrative functions, which allows remote attackers to bypass authentication and execute arbitrary programs via a crafted SNA RPC message using opcode 1 or 6 to call the CreateProcess function, aka "HIS Command Execution Vulnerability." Microsoft Host Integration Server (HIS) 2000, 2004 y 2006 no limita el acceso RPC a funciones administrativas, lo que permite a atacantes remotos evitar la autentificación y ejecutar código de su elección mediante un mensaje SNA RPC, también conocido como "HIS Command Execution Vulnerability (Vulnerabilidad de Ejecución de Comandos HIS)". • http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=745 http://marc.info/?l=bugtraq&m=122479227205998&w=2 http://secunia.com/advisories/32233 http://www.securityfocus.com/bid/31620 http://www.securitytracker.com/id?1021043 http://www.us-cert.gov/cas/techalerts/TA08-288A.html http://www.vupen.com/english/advisories/2008/2810 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-059 https://oval.cisecurity.org/repository/search/definition/oval • CWE-287: Improper Authentication •