Microsoft SharePoint Server跨站脚本漏洞（MS07-059）

BUGTRAQ ID: 23832 CVECAN ID: CVE-2007-2581 SharePoint Server是一个服务器功能集成套件，提供全面的内容管理和企业搜索，加速共享业务流程并简化跨界限信息共享。 Microsoft Windows SharePoint Services 3.0和Microsoft Office SharePoint Server 2007中存在一个跨站脚本执行漏洞，恶意服务器可能利用此漏洞收集客户端系统的有用信息。...

Preemptive Protection against Microsoft SharePoint Server Cross-Site Scripting Vulnerability (MS07-059)

A cross-site scripting XSS vulnerability exists in Microsoft Windows SharePoint Services and in Microsoft Office SharePoint Server. Windows SharePoint Services provide a platform for collaboration applications and document management. Office SharePoint Server is an integrated suite of server...

MS07-059: Vulnerability in Windows SharePoint Could Result in Elevation of Privilege (942017)

The remote host is running a version of SharePoint Server 2007 or SharePoint Services 3.0 that is vulnerable to a privilege elevation attack in the SharePoint site. An attacker may use this to execute scripts in the context of the SharePoint site. C Tenable Network Security, Inc...

Preemptive Protection against Microsoft SharePoint Cross-Site Scripting (XSS) Vulnerability

A cross-site scripting XSS vulnerability exists in Microsoft Windows SharePoint. The Microsoft SharePoint products allow enterprises to organize their information in a single collaborative portal application. A remote attacker can exploit this vulnerability to run malicious scripts on an affected...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Microsoft Windows SharePoint Services 3.0 for Windows Server 2003 and Office SharePoint Server 2007 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO query string in "every main page," as demonstrated by default.asp...

CVE-2007-2581

Multiple cross-site scripting XSS vulnerabilities in Microsoft Windows SharePoint Services 3.0 for Windows Server 2003 and Office SharePoint Server 2007 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO query string in "every main page," as demonstrated by default.asp...

CVE-2007-2581

CVE-2007-2581 affects Microsoft Windows SharePoint Services 3.0 (Windows Server 2003) and Office SharePoint Server 2007. The vulnerability is a cross-site scripting (XSS) flaw caused by lack of input validation when processing URL requests (PATH_INFO) in SharePoint pages (notably default.aspx). S...

CVE-2007-2581

Multiple cross-site scripting XSS vulnerabilities in Microsoft Windows SharePoint Services 3.0 for Windows Server 2003 and Office SharePoint Server 2007 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO query string in "every main page," as demonstrated by default.asp...

sharepoint-xss.txt

Hi! I think this is a XSS in MS SharePoint, you can reproduce it in SharePoint test server using for example following url: http://www.example.com/sharepoint/default.aspx/%22;iftruealert%22qwertytis This is due a lack of string stripping when putting the path into javascript. It seems to work at...

Microsoft Sharepoint crossite scripting

No description provided...

XSS in Microsoft SharePoint

Hi! I think this is a XSS in MS SharePoint, you can reproduce it in SharePoint test server using for example following url: http://www.example.com/sharepoint/default.aspx/22;iftruealert22qwertytis This is due a lack of string stripping when putting the path into javascript. It seems to work at...

Microsoft SharePoint Server 3.0 - Cross-Site Scripting

Microsoft SharePoint Server 3.0 - Cross-Site Scripting source: https://www.securityfocus.com/bid/23832/info Microsoft SharePoint Server is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to...

Microsoft SharePoint Server 3.0 - Cross-Site Scripting

source: https://www.securityfocus.com/bid/23832/info Microsoft SharePoint Server is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an...

Microsoft FrontPage Server Extensions跨站脚本漏洞（MS06-017)

FrontPage Server Extensions为FrontPage服务扩展，与IIS一起使用可以方便的支持管理、创建以及浏览FrontPage扩展的网站。 FrontPage Server Extensions对HTML页面的处理存在输入验证漏洞，远程攻击者可能在客户机器上执行任意脚本代码。 FrontPage Server Extensions的fpadmdll.dll中的一些参数没有正确的过滤返回给用户的特定输入，导致跨站脚本问题，可能允许攻击者以当前会话权限以客户机的浏览器中执行恶意脚本代码，利用这个漏洞必须用户交互。...

MS06-017: FrontPage fpadmdll.dll Multiple Parameter XSS (917627)

The version of Microsoft FrontPage Server Extensions 2002 / SharePoint Team Services on the remote host is affected by a cross-site scripting XSS vulnerability due to improper sanitization of user-supplied input to the 'operation', 'command', and 'name' parameters to file...

Vulnerability in Microsoft FrontPage Server Extensions Could Allow Cross-Site Scripting

Argeniss Security Advisory Name: Vulnerability in Microsoft FrontPage Server Extensions Could Allow Cross-Site Scripting MS06-17 Affected Software: Microsoft FrontPage Server Extensions 2002 and Microsoft SharePoint Team Services Severity: Medium Remote exploitable: Yes User intervention required...

Cross site scripting

Cross-site scripting XSS vulnerability in vtibin/vtiadm/fpadmdll.dll in Microsoft FrontPage Server Extensions 2002 and SharePoint Team Services allows remote attackers to inject arbitrary web script or HTML, then leverage the attack to execute arbitrary programs or create new accounts, via the 1...

CVE-2006-0015

Cross-site scripting XSS vulnerability in vtibin/vtiadm/fpadmdll.dll in Microsoft FrontPage Server Extensions 2002 and SharePoint Team Services allows remote attackers to inject arbitrary web script or HTML, then leverage the attack to execute arbitrary programs or create new accounts, via the 1...

CVE-2006-0015

The CVE-2006-0015 entry describes a cross-site scripting (XSS) vulnerability in Microsoft FrontPage Server Extensions 2002 and SharePoint Team Services via the /_vti_bin/_vti_adm/fpadmdll.dll page. The root cause is improper sanitization of CGI parameters (operation, command, name), allowing remo...

Microsoft FrontPage Server Extensions Cross-Site Scripting Vulnerability

Description Microsoft FrontPage Server Extensions are prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before it is rendered to other users. An attacker may leverage this issue to have arbitrary script code...