Microsoft Windows Win32 API fails to properly validate function parameters

Overview The Microsoft Windows Win32 API fails to properly validate function parameters, which could allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description The Microsoft Windows Win32 API is a set of application programming interfaces for the...

MS07-034: Cumulative Security Update for Outlook Express and Windows Mail (929123)

The remote host is running a version of Microsoft Outlook Express with several security flaws that could allow an attacker to execute arbitrary code on the remote host. To exploit this flaw, an attacker would need to send a malformed email to a victim on the remote host and have him open it. C...

Microsoft Security Bulletin MS07-034 - Critical Cumulative Security Update for Outlook Express and Windows Mail (929123)

Microsoft Security Bulletin MS07-034 - Critical Cumulative Security Update for Outlook Express and Windows Mail 929123 Published: June 12, 2007 Version: 1.1 General Information Executive Summary This critical security update resolves two privately reported and two publicly disclosed...

Microsoft Outlook Express Content Disposition Parsing Information Disclosure Vulnerability

Description Outlook Express is prone to a cross-domain information-disclosure vulnerability. This vulnerability may let a malicious website access properties of a site in an arbitrary external domain in the context of the victim's browser. Attackers could exploit this issue to access sensitive...

Cumulative Security Update for Microsoft Outlook Express and Windows Mail (929123)

Binary data 4090.prm...

Microsoft Outlook Express MHTML URL Parsing Information Disclosure Vulnerability

Description Outlook Express is prone to a cross-domain information-disclosure vulnerability. This vulnerability may let a malicious website access properties of a site in an arbitrary external domain in the context of the victim user's browser. Attackers could exploit this issue to gain access to...

CVE-2005-4841

The Outlook Progress Ctl control allows remote attackers to cause a denial of service Internet Explorer crash by creating a COM object of the class associated with the control's CLSID, which is not intended for use within Internet Explorer...

CVE-2005-4841

Technical details about CVE-2005-4841 are not publicly available in the provided documents. Monitor for updates from Red Hat, NVD, CVE listings, and related advisories.

Microsoft Html Popup / Outlook Express Address Book ActiveX DoS

Crash on element displaying...

IE 6 / MS Office Outlook Express Address Book Activex DoS

IE 6 / MS Office Outlook Express Address Book Activex DoS Affected Software : MS Internet Explorer 6.x Overview: ----------------- when a browser use MS outlook Express Address book ActiveX , crash the browser immediately. An attacker can exploit this issue to trigger denial-of-service conditions...

CVE-2005-4840

The CVE-2005-4840 issue affects the Outlook Express Address Book control when used with Internet Explorer 6. The vulnerability arises from exploiting the OutlookExpress.AddressBook COM object in IE, leading to a NULL dereference and a browser crash (denial of service). Connected advisories corrob...

CVE-2005-4840

The Outlook Express Address Book control, when using Internet Explorer 6, allows remote attackers to cause a denial of service NULL dereference and browser crash by creating the OutlookExpress.AddressBook COM object, which is not intended for use within Internet Explorer...

CVE-2007-0220

Cross-site scripting XSS vulnerability in Outlook Web Access OWA in Microsoft Exchange Server 2000 SP3, and 2003 SP1 and SP2 allows remote attackers to execute arbitrary scripts, spoof content, or obtain sensitive information via certain UTF-encoded, script-based e-mail attachments, involving an...

CVE-2007-0220

CVE-2007-0220 is a cross-site scripting vulnerability in Outlook Web Access (OWA) of Microsoft Exchange Server 2000 SP3 and Exchange Server 2003 SP1/SP2. The issue arises from an incorrectly handled UTF character set label, allowing remote attackers to run scripts, spoof content, or access inform...

Microsoft Outlook Web Access Remote Script Injection Vulnerability

Description Microsoft Outlook Web Access is prone to a script-injection vulnerability because the application fails to properly handle specially crafted email attachments. To exploit this issue, attackers must send specially crafted files through email messages to users of the affected applicatio...

Preemptive Protection against WMF/EMF Vulnerabilities (MS07-017)

A remote code execution vulnerability has been discovered in the rendering of Enhanced Metafile EMF image format, and a denial of service vulnerability exists in the rendering of Windows Metafile WMF image format. WMF and EMF are image formats used in many Windows programs including Internet...

ani_loadimage_chunksize-email.rb.txt

$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/projects/Framework/ require 'msf/core' module Msf class...

Microsoft Windows动画光标ANI格式处理远程代码执行漏洞

Microsoft Internet Explorer是一款流行的WEB浏览器，Microsoft Windows是一款流行的操作系统。 Microsoft Windows在处理畸形的动画图标文件.ani时存在缓冲区溢出问题，远程攻击者可利用此漏洞以 当前用户进程权限执行任意指令。 Microsoft Windows在处理畸形动画光标文件.ani时没有正确地验证ANI头字段中所指定的大小，可导致基 于栈溢出漏洞。攻击者可以构建恶意WEB页或者包含ANI文件的EMAIL消息来触发，就会触发这个溢出，导致...

Microsoft Windows animated cursor stack buffer overflow

Overview Microsoft Windows contains a stack buffer overflow in the handling of animated cursor files. This vulnerability may allow a remote attacker to execute arbitrary code or cause a denial-of-service condition. Description Animated cursor files .ani contain animated graphics for icons and...

Unfixed XSS vulnerability at www.outlookindia.com

Security researcher By Encore, has submitted on 03/09/2007 a cross-site-scripting XSS vulnerability affecting www.outlookindia.com, which at the time of submission ranked 42822 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 08/09/2007. It is...