3821 matches found
Microsoft IE 5.01/5.5 DHTMLED远程文件读取漏洞
Microsoft IE 5.5/5.01中DHTMLED（动态HTML编辑控制）部分的实现存在安全问题。可能允许 一个恶意站点非法读取远程客户主机上的已知文件的内容。这种攻击也可以通过发送HTML格式的 邮件给那些使用Outlook的用户来实现。 动态HTML编辑控制是一种让IE具有WYSIWYG HTML编辑器功能的机制。然而DOM安全模型没有正确 处理通过DHTMLED来使用IFRAME的情况，导致IFRAME的内容可以被重定向到某个web server IFRAME可以被设置为从已知的本地文件读取。下面是一个例子代码： dh.DOM.all.I1.focus;...
Microsoft Office Snapshot Viewer ActiveX Exploit（lcx）
No description provided by source. script type="text/javascript" function killErrors return true; window.onerror = killErrors; var x; var obj; var mycars = new Array; mycars0 = "c:/Program Files/Outlook Express/wab.exe"; mycars1 = "d:/Program Files/Outlook Express/wab.exe"; mycars2 = "e:/Program...
Microsoft Outlook Web Access crossite scripting
Crossite scripting on different pages...
Microsoft Security Bulletin MS08-039 – Important Vulnerabilities in Outlook Web Access for Exchange Server Could Allow Elevation of Privilege (953747)
Microsoft Security Bulletin MS08-039 – Important Vulnerabilities in Outlook Web Access for Exchange Server Could Allow Elevation of Privilege 953747 Published: July 8, 2008 Version: 1.0 General Information Executive Summary This security update resolves two privately reported vulnerabilities in...
Cross site scripting
Cross-site scripting XSS vulnerability in Outlook Web Access OWA for Exchange Server 2003 SP2 allows remote attackers to inject arbitrary web script or HTML via unspecified e-mail fields, a different vulnerability than CVE-2008-2248...
CVE-2008-2247
Cross-site scripting XSS vulnerability in Outlook Web Access OWA for Exchange Server 2003 SP2 allows remote attackers to inject arbitrary web script or HTML via unspecified e-mail fields, a different vulnerability than CVE-2008-2248...
Cross site scripting
Cross-site scripting XSS vulnerability in Outlook Web Access OWA for Exchange Server 2003 SP2 allows remote attackers to inject arbitrary web script or HTML via unspecified HTML, a different vulnerability than CVE-2008-2247...
CVE-2008-2248
Cross-site scripting XSS vulnerability in Outlook Web Access OWA for Exchange Server 2003 SP2 allows remote attackers to inject arbitrary web script or HTML via unspecified HTML, a different vulnerability than CVE-2008-2247...
CVE-2008-2248
Cross-site scripting XSS vulnerability in Outlook Web Access OWA for Exchange Server 2003 SP2 allows remote attackers to inject arbitrary web script or HTML via unspecified HTML, a different vulnerability than CVE-2008-2247...
CVE-2008-2247
Cross-site scripting XSS vulnerability in Outlook Web Access OWA for Exchange Server 2003 SP2 allows remote attackers to inject arbitrary web script or HTML via unspecified e-mail fields, a different vulnerability than CVE-2008-2248...
CVE-2008-2248
CVE-2008-2248 is a cross-site scripting vulnerability in Outlook Web Access (OWA) for Microsoft Exchange Server 2003 SP2. The flaw stems from insufficient validation of HTML when rendering emails, enabling an attacker to inject script or HTML via unspecified HTML in messages and potentially perfo...
CVE-2008-2247
CVE-2008-2247 is a cross-site scripting vulnerability in Outlook Web Access (OWA) for Microsoft Exchange Server 2003 SP2. The flaw arises from insufficient validation of e-mail fields when opening mail within an OWA client, allowing an attacker to inject arbitrary script and potentially elevate p...
Microsoft Outlook Web Access for Exchange Server Email Field Cross-Site Scripting Vulnerability
Description Microsoft Outlook Web Access OWA for Exchange Server is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in...
MS08-039: Vulnerabilities in Outlook Web Access for Exchange Server Could Allow Elevation of Privilege (953747)
The remote host is running a version of Outlook Web Access OWA for Exchange Server that is vulnerable to multiple cross-site scripting issues in the HTML parser and Data validation code. These vulnerabilities may allow an attacker to elevate his privileges by convincing a user to open a malformed...
Design/Logic Flaw
Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List CRL checks by using an arbitrary URL from a certificate embedded in a 1 S/MIME e-mail message or 2 signed document, which allows remote attackers to obtai...
CVE-2008-3068
Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List CRL checks by using an arbitrary URL from a certificate embedded in a 1 S/MIME e-mail message or 2 signed document, which allows remote attackers to obtai...
CVE-2008-3068
Microsoft Crypto API 5.131.2600.2180 through 6.0 (used in Outlook, Windows Live Mail, and Office 2007) performs CRL checks by using an arbitrary URL from a certificate embedded in an S/MIME email or a signed document via the Authority Information Access (AIA) extension. This allows remote attacke...
CVE-2008-3068
Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List CRL checks by using an arbitrary URL from a certificate embedded in a 1 S/MIME e-mail message or 2 signed document, which allows remote attackers to obtai...
Unauthorized reading confirmation from Outlook
I've just got an interesting idea about how a malicious e-mail sender could try to get a unseen by the recipient reading confirmation, including the IP address of the recipient. I was working on S/MIME messages and I thought about the signature validation process, where some of the steps could...