CVE-2008-0673

TinTin++ 1.97.9 and WinTin++ 1.97.9 open files on the basis of an inbound file-transfer request, before the user has an opportunity to decline the request, which allows remote attackers to truncate arbitrary files in the top level of a home directory...

WEBHANCER Detection

The remote host is using the WEBHANCER program. You should ensure that : - the user intended to install WEBHANCER it is sometimes silently installed - the use of WEBHANCER matches your corporate mandates and security policies. To remove this sort of software, you may wish to check out ad-aware or...

Windows NTLM relaying attacks

Some client program use NTLM authentication with user's permission without user request. It may leak to NTLM credentials and perform choosen challenge attack and comprometation of server's with client credentials by relaying NTLM request...

Microsoft Outlook 98/2000/2002 - Arbitrary Code Execution

source: https://www.securityfocus.com/bid/3026/info Microsoft Outlook introduces a vulnerability that may allow attackers to execute arbitrary commands on a target system. The vulnerability is due to a new ActiveX control called 'Microsoft Outlook View Control'. The flaw is that this control is...

Microsoft Outlook 98/2000/2002 - Unauthorized Email Access

source: https://www.securityfocus.com/bid/3025/info Microsoft Outlook introduces a vulnerability that may allow attackers to access and manipulate user email. The vulnerability is due to a new ActiveX control called 'Microsoft Outlook View Control'. The flaw is that this control is marked 'safe f...

Security Bulletin MS01-034

---------------------------------------------------------------------- Title: Malformed Word Document Could Enable Macro to Run Automatically Date: 21 June 2001 Software: Word Impact: Run macro without warning Bulletin: MS01-034 Microsoft encourages customers to review the Security Bulletin at:...

IE 5.01 will execute VBA code contained in Access databases when triggered from HTML code contained in an IFRAME

Overview Under certain conditions, Internet Explorer can open Microsoft Access database or project files containing malicious code and execute the code without giving a user prior warning. Access files that are referenced by OBJECT tags in HTML documents can allow attackers to execute arbitrary...

microsoft-install.txt

Juan asked me to forward this message from him to the list. He has discovered that an ActiveX control shipped with IE can be used to install software components signed by Microsoft without prompting the user. This of curse raises trust issues. Someone, not necessarily Microsoft, could use this...