CVSS: 9.3EPSS: 64%CPEs: 36EXPL: 0CVE-2013-3129
https://notcve.org/view.php?id=CVE-2013-3129
Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, and 4.5; Silverlight 5 before 5.1.20513.0; win32k.sys in the kernel-mode drivers, and GDI+, DirectWrite, and Journal, in Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT; GDI+ in Office 2003 SP3, 2007 SP3, and 2010 SP1; GDI+ in Visual Studio .NET 2003 SP1; and GDI+ in Lync 2010, 2010 Attendee, 2013, and Basic 2013 allow remote attackers to execute arbitrary code via a crafted TrueType Font (TTF) file, aka "TrueType Font Parsing Vulnerability." Microsoft .NET Framework v3.0 SP2, v3.5, v3.5.1, v4, y v4.5; Silverlight v5 anteriores a v5.1.20513.0; win32k.sys en the kernel-mode drivers, y GDI+, DirectWrite, y Journal, en Windows XP SP2 y SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 y R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, y Windows RT; GDI+ en Office 2003 SP3, 2007 SP3, y 2010 SP1; GDI+ en Visual Studio .NET 2003 SP1; y GDI+ in Lync 2010, 2010 Attendee, 2013, y Basic 2013 permiten a atacantes remotos a ejecutar código a través de ficheros de fuentes TrueType manipulados, tambíen conocido como "TrueType Font Parsing Vulnerability." • http://www.us-cert.gov/ncas/alerts/TA13-190A https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-052 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-053 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-054 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17323 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17341 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.3EPSS: 93%CPEs: 34EXPL: 0CVE-2013-0007
https://notcve.org/view.php?id=CVE-2013-0007
Microsoft XML Core Services (aka MSXML) 4.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka "MSXML XSLT Vulnerability." Microsoft XML Core Services (también conocido como MSXML) v4.0, v5.0 y v6.0 no analiza correctamente el contenido XML, lo que permite a atacantes remotos ejecutar código arbitrario a través de una página web diseñada, también conocido como "Vulnerabilidad de MSXML XSLT." • http://www.us-cert.gov/cas/techalerts/TA13-008A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-002 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15458 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.3EPSS: 94%CPEs: 34EXPL: 0CVE-2013-0006
https://notcve.org/view.php?id=CVE-2013-0006
Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka "MSXML Integer Truncation Vulnerability." Microsoft XML Core Services (también conocido como MSXML) v3.0, v5.0 y v6.0 no analiza correctamente el contenido XML, lo que permite a atacantes remotos ejecutar código arbitrario a través de una página web diseñada, también conocido como "MSXML Integer Truncation Vulnerability." • http://www.us-cert.gov/cas/techalerts/TA13-008A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-002 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16429 https://us-cert.cisa.gov/ics/advisories/icsa-20-315-01 • CWE-189: Numeric Errors •
CVSS: 9.3EPSS: 97%CPEs: 29EXPL: 2CVE-2012-1889 – Microsoft XML Core Services Memory Corruption Vulnerability
https://notcve.org/view.php?id=CVE-2012-1889
Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. Microsoft XML Core Services 3.0, 4.0, 5.0, y 6.0 accede a localizaciones de memoria mal formadas, lo que permite a atacantes remotos ejecutar código arbitrario o provocar una denegación de servicio (corrupción de memoria) a través de un sitio web modificado. Microsoft XML Core Services contains a memory corruption vulnerability which could allow for remote code execution. • https://www.exploit-db.com/exploits/19186 https://github.com/whu-enjoy/CVE-2012-1889 http://technet.microsoft.com/security/advisory/2719615 http://www.us-cert.gov/cas/techalerts/TA12-174A.html http://www.us-cert.gov/cas/techalerts/TA12-192A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-043 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15195 • CWE-787: Out-of-bounds Write •
CVSS: 9.3EPSS: 47%CPEs: 17EXPL: 1CVE-2010-2738 – Microsoft Unicode Scripts Processor - Remote Code Execution (MS10-063)
https://notcve.org/view.php?id=CVE-2010-2738
The Uniscribe (aka new Unicode Script Processor) implementation in USP10.DLL in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2, and Server 2008 Gold and SP2, and Microsoft Office XP SP3, 2003 SP3, and 2007 SP2, does not properly validate tables associated with malformed OpenType fonts, which allows remote attackers to execute arbitrary code via a crafted (1) web site or (2) Office document, aka "Uniscribe Font Parsing Engine Memory Corruption Vulnerability." La implementación Uniscribe (conocido como nuevo Unicode Script Processor) en USP10.DLL de Microsoft Windows XP SP2 y SP3, Server 2003 SP2, Vista SP1 y SP2, y Server 2008 Gold y SP2, y Microsoft Office XP SP3, 2003 SP3, y 2007 SP2, no valida adecuadamente tablas asociadas con fuentes OpenType malformadas, lo cual permite a atacantes remotos ejecutar código a su elección a través de (1) un sitio web o (2) un documento Office manipulados, también conocido como "Uniscribe Font Parsing Engine Memory Corruption Vulnerability." • https://www.exploit-db.com/exploits/15158 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-063 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7214 • CWE-20: Improper Input Validation •