cdo-lipetsk.ru Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1120760 Security Researcher geeknik Helped patch 8961 vulnerabilities Received 8 Coordinated Disclosure badges Received 21 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting cdo-lipetsk.ru website and...

cdo-lipetsk.ru XSS vulnerability

Vulnerable URL: http://cdo-lipetsk.ru/?s=putin Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1342584 VIP website status:| No Check cdo-lipetsk.ru SSL connection:| Grade: F...

JVN#55410403 Internet Explorer vulnerable in handling CDO protocol

When Internet Explorer IE accesses a website using CDO Collaboration Data Objects, IE processes the contents as CDO data, ignoring their actual content types, and IE does not properly handle the Content-Disposition header field. This could cause a download dialog box not to be displayed prior to...

Microsoft Office CDO协议跨站脚本漏洞（MS08-056）

BUGTRAQ ID: 31693 CVECAN ID: CVE-2008-4020 Microsoft Office是非常流行的办公软件套件。 Office的cdo: URI处理器没有正确地处理包含有Content-Disposition: attachment头的请求，如果用户受骗跟随了恶意的链接的话，CDO协议处理器没有显示文件下载对话框而是在浏览器中呈现文件请求，这可能导致跨站脚本攻击。 Microsoft Office XP SP3 临时解决方法： 禁用OneNote协议处理程序，请注销以下三个注册表项：...

CVE-2008-4020

Cross-site scripting XSS vulnerability in Microsoft Office XP SP3 allows remote attackers to inject arbitrary web script or HTML via a document that contains a "Content-Disposition: attachment" header and is accessed through a cdo: URL, which renders the content instead of raising a File Download...

MS08-056: Microsoft Office CDO Protocol (cdo:) Content-Disposition: Attachment Header XSS (957699)

The remote host is running a version of Microsoft Office that is subject to an information disclosure flaw. When a user clicks on a special CDO URL, an attacker could inject a client side script that could be used to disclose information. To succeed, the attacker would have to send a rogue CDO UR...

Microsoft Office CDO Protocol Cross Site Scripting Vulnerability

Description Microsoft Office is prone to a cross-site scripting vulnerability that arises because the software fails to handle specially crafted CDO protocol URIs in a proper manner. Successfully exploiting this issue may allow an attacker to execute arbitrary script code in the browser of an...

Microsoft Office Content-Disposition Header Code Execution (MS08-056; CVE-2008-4020)

Cross-site scripting XSS could enable an attacker to inject code into a user's session with a Web site. A cross-site scripting vulnerability has been reported in Microsoft Office. The vulnerability is due to a flaw in the cdo:// protocol that does not respect the "content-disposition: attachment"...

CVE-2005-1987

CVE-2005-1987 is a remote code execution vulnerability in Microsoft Collaboration Data Objects (CDO) used by CDOSYS/CDOEX on Windows and Exchange. An unchecked buffer triggered by processing a malformed SMTP/email header (e.g., oversized Content-Type) can allow an attacker to execute arbitrary co...

Microsoft Collaboration Data Objects Remote Buffer Overflow Vulnerability

Description Microsoft CDO is susceptible to a remote buffer overflow vulnerability. This issue is due to a failure of the library to properly bounds check user-supplied data prior to copying it to an insufficiently sized memory buffer. This issue presents itself when an attacker sends a...

Microsoft Collaboration Data Objects buffer overflow

Overview A buffer overflow in Microsoft Collaboration Data Objects may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Microsoft Collaboration Data Objects CDO is a scripting library used to develop applications that handle email. Note that C...