Microsoft AntiXSS 3/4.0 Library Sanitization Module - Security Bypass
| Reporter | Title | Published | Views | Family All 14 |
|---|---|---|---|---|
 | CVE-2012-0007 | 10 Jan 201200:00 | – | circl |
 | Microsoft AntiXSS Library Bypass Information Disclosure (MS12-007; CVE-2012-0007) | 10 Jan 201200:00 | – | checkpoint_advisories |
| Microsoft AntiXSS Library Bypass Information Disclosure (MS12-007) - Ver2 (CVE-2012-0007) | 26 Mar 201500:00 | – | checkpoint_advisories |
 | CVE-2012-0007 | 10 Jan 201221:00 | – | cve |
 | CVE-2012-0007 | 10 Jan 201221:00 | – | cvelist |
 | MS12-007: Vulnerability in AntiXSS Library Could Allow Information Disclosure (2607664) (uncredentialed check) | 17 Jan 201200:00 | – | nessus |
| MS12-007: Vulnerability in AntiXSS Library Could Allow Information Disclosure (2607664) | 10 Jan 201200:00 | – | nessus |
 | MS12-007: Vulnerability in Anti-XSS Library could allow information disclosure: January 10, 2012 | 10 Jan 201200:00 | – | mskb |
 | CVE-2012-0007 | 10 Jan 201221:55 | – | nvd |
 | Microsoft AntiXSS Library Information Disclosure Vulnerability (2607664) | 11 Jan 201200:00 | – | openvas |
10
source: https://www.securityfocus.com/bid/51291/info
Microsoft Anti-Cross Site Scripting (AntiXSS) Library is prone to a security-bypass vulnerability that affects the sanitization module.
An attacker can exploit this vulnerability to bypass the filter and conduct cross-site scripting attacks. Successful exploits may allow attackers to execute arbitrary script code and steal cookie-based authentication credentials.
Microsoft Anti-Cross Site Scripting Library 3.x and 4.0 are vulnerable.
string data = Microsoft.Security.Application.Sanitizer.GetSafeHtml("a<style><!--div{font-family:Foo,Bar\\,'a\\a';font-family:';color:expression(alert(1));y'}--></style><div>b</div>");
string data = Microsoft.Security.Application.Sanitizer.GetSafeHtmlFragment("<div style="">aaa</div>")Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
27 Mar 2015 00:00Current
5.2Medium risk
Vulners AI Score5.2
CVSS 24.3
EPSS0.19283