CVSS: 6.9EPSS: 57%CPEs: 29EXPL: 2CVE-2006-6696 – Microsoft Windows - 'MessageBox' Memory Corruption Local Denial of Service
https://notcve.org/view.php?id=CVE-2006-6696
Double free vulnerability in Microsoft Windows 2000, XP, 2003, and Vista allows local users to gain privileges by calling the MessageBox function with a MB_SERVICE_NOTIFICATION message with crafted data, which sends a HardError message to Client/Server Runtime Server Subsystem (CSRSS) process, which is not properly handled when invoking the UserHardError and GetHardErrorText functions in WINSRV.DLL. Vulnerabilidad de liberación de memoria doble en Microsoft Windows 2000, XP, 2003, y Vista, permite a usuarios locales obtener privilegios llamando a la función MessageBox con un mensaje MB_SERVICE_NOTIFICATION con datos manipulados, lo cual envía un mensaje HardError al proceso Subsistema de servidor en ejecución de Cliente/Servidor (CSSRSS), que no es gestionado apropiadamente cuando se invocan las funciones UserHardError y GetHardErrorText en WINSRV.DLL. • https://www.exploit-db.com/exploits/2967 https://www.exploit-db.com/exploits/3024 http://blogs.technet.com/msrc/archive/2006/12/22/new-report-of-a-windows-vulnerability.aspx http://groups.google.ca/group/microsoft.public.win32.programmer.kernel/browse_thread/thread/c5946bf40f227058/7bd7b5d66a4e5aff http://isc.sans.org/diary.php?n&storyid=1965 http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051394.html http://research.eeye.com/html/alerts/zeroday/20061215.html http://sec • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.3EPSS: 78%CPEs: 36EXPL: 1CVE-2006-0032 – Microsoft Indexing Service - Query Validation Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2006-0032
Cross-site scripting (XSS) vulnerability in the Indexing Service in Microsoft Windows 2000, XP, and Server 2003, when the Encoding option is set to Auto Select, allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded URL, which is injected into an error message whose charset is set to UTF-7. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en el Indexing Service dentro de Microsoft Windows 2000, XP, y Server 2003, cuando la opción Encoding está asiganado a Auto Select, permite a un atacante remoto inyectar secuencias de comandos web o HTML a través de una URL codificada UTF-7, el cual es inyectado dentro de un mensaje de error cuyo conjunto de caracteres está asignado a UTF-7. • https://www.exploit-db.com/exploits/28500 http://secunia.com/advisories/21861 http://securitytracker.com/id?1016826 http://www.geocities.jp/ptrs_sec/advisory09e.html http://www.kb.cert.org/vuls/id/108884 http://www.securityfocus.com/archive/1/446630/100/100/threaded http://www.securityfocus.com/archive/1/447509/100/0/threaded http://www.securityfocus.com/archive/1/447511/100/0/threaded http://www.securityfocus.com/bid/19927 http://www.us-cert.gov/cas/techalerts&#x • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 8%CPEs: 31EXPL: 2CVE-2006-3880 – Microsoft Windows XP/2000/2003 - Remote Denial of Service
https://notcve.org/view.php?id=CVE-2006-3880
Microsoft Windows NT 4.0, Windows 2000, Windows XP, and Windows Small Business Server 2003 allow remote attackers to cause a denial of service (IP stack hang) via a continuous stream of packets on TCP port 135 that have incorrect TCP header checksums and random numbers in certain TCP header fields, as demonstrated by the Achilles Windows Attack Tool. NOTE: the researcher reports that the Microsoft Security Response Center has stated "Our investigation which has included code review, review of the TCPDump, and attempts on reproing the issue on multiple fresh installs of various Windows Operating Systems have all resulted in non confirmation. ** IMPUGNADO ** Microsoft Windows NT 4.0, Windows 2000, Windows XP, y Windows Small Business Server 2003 permite a atacantes remotos provocar denegación de servicio (manipular la pila IP) a través de un flujo continuo de paquetes sobre el puerto TCP 135 que tiene una cabecera de validación (checksum) TCP erronea y números aleatorios en ciertos campos de cabeceras TCP, como se demostró con Achilles Windows Attack Tool. NOTA: el investigador indicaque Microsoft Security Response Center ha indicado que "Nuestra investigación que ha incluido la revisión de código, la revisión del TCPDump, e intentó reproducir el asunto en múltiples instalaciones frescas de varios sistemas operativos de Windows dieron como resultado la no confirmación". • https://www.exploit-db.com/exploits/28263 http://securityreason.com/securityalert/1282 http://www.securityfocus.com/archive/1/441007/100/0/threaded http://www.securityfocus.com/bid/19135 •
CVSS: 5.4EPSS: 6%CPEs: 55EXPL: 1CVE-2006-3351
https://notcve.org/view.php?id=CVE-2006-3351
Buffer overflow in Windows Explorer (explorer.exe) on Windows XP and 2003 allows user-assisted attackers to cause a denial of service (repeated crash) and possibly execute arbitrary code via a .url file with an InternetShortcut tag containing a long URL and a large number of "file:" specifiers. Desbordamiento de buffer en el Explorador de Windows (explorer.exe) de Windows XP y 2003. Permite a usuarios remotos con ayuda del usuario causar una denegación de servicio (indisponibilidad repetida de la aplicación) y, posiblemente, la ejecución de código de la elección del atacante remoto a través de un fichero de extensión .url con una etiqueta "InternetShortcut" que contiene una URL extensa y un gran número de especificadores "file:". • http://securityreason.com/securityalert/1186 http://www.securityfocus.com/archive/1/439153/100/0/threaded http://www.securityfocus.com/archive/1/439660/100/200/threaded http://www.securityfocus.com/bid/18838 https://exchange.xforce.ibmcloud.com/vulnerabilities/27567 •
CVSS: 7.5EPSS: 84%CPEs: 29EXPL: 0CVE-2006-2371
https://notcve.org/view.php?id=CVE-2006-2371
Buffer overflow in the Remote Access Connection Manager service (RASMAN) service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote unauthenticated or authenticated attackers to execute arbitrary code via certain crafted "RPC related requests," that lead to registry corruption and stack corruption, aka the "RASMAN Registry Corruption Vulnerability." • http://secunia.com/advisories/20630 http://securityreason.com/securityalert/1096 http://securitytracker.com/id?1016285 http://www.kb.cert.org/vuls/id/814644 http://www.osvdb.org/26436 http://www.securityfocus.com/archive/1/436977/100/0/threaded http://www.securityfocus.com/bid/18358 http://www.us-cert.gov/cas/techalerts/TA06-164A.html http://www.vupen.com/english/advisories/2006/2323 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-025 https& •