Red Hat Directory Server多个跨站脚本漏洞

BUGTRAQ ID: 30870 CVE ID: CVE-2008-2929 CNCVE ID：CNCVE-20082929 Red Hat Directory Server是一款LDAPv3兼容的目录服务程序。 Directory Server Administration Express和Directory Server Gateway DSGWWEB接口不正确处理用户提供的输入，远程攻击者可以利用漏洞进行跨站脚本攻击，获得敏感信息。 问题是由于WEB接口不正确解析用户提供的"%"转义字符，可利用这个问题触发跨站脚本攻击，可获得管理员等用户敏感信息。 RedHat Fedora...

Server: multiple XSS issues

Multiple cross-site scripting XSS vulnerabilities in the adminutil library in the Directory Server Administration Express and Directory Server Gateway DSGW web interface in Red Hat Directory Server 7.1 before SP7 and 8 EL4 and EL5, and Fedora Directory Server, allow remote attackers to inject...

Moderate: Red Hat Security Advisory: adminutil security update

An updated adminutil package that fixes a security issue is now available for Red Hat Directory Server 8.0. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Red Hat Directory Server is an LDAPv3-compliant server. The adminutil packages is...

Security Update for Outlook Express (951066)

This host is missing a critical security update according to Microsoft Bulletin MS08-048. SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Security Update for Outlook Express (951066)

This host is missing a critical security update according to Microsoft Bulletin MS08-048. OpenVAS Vulnerability Test $Id: secpodms08-048900031.nasl 5863 2017-04-05 07:38:11Z antu123 $ Description: Security Update for Outlook Express 951066 Authors: Chandan S Copyright: Copyright C 2008 SecPod,...

Microsoft IE MHTML协议处理器跨域信息泄露漏洞（MS08-048）

BUGTRAQ ID: 30585 CVECAN ID: CVE-2008-1448 Internet Explorer是微软操作系统中默认捆绑的WEB浏览器。 IE的MHTML协议处理器没有正确地解释MHTML URI重新定向。如果以UNC的形式指定了URI的话，则没有正确的应用安全策略： \MACHINENAMEORIP\PATHTORESOURCE 在这种情况下当远程站点试图访问本地资源时，Internet Explorer会无法强制区提升限制；在浏览远程站点的时候Internet Explorer会无法应用正确地安全区权限，允许将属于较小权限区的站点处理为更高权限的区。...

Information disclosure

The MHTML protocol handler in a component of Microsoft Outlook Express 5.5 SP2 and 6 through SP1, and Windows Mail, does not assign the correct Internet Explorer Security Zone to UNC share pathnames, which allows remote attackers to bypass intended access restrictions and read arbitrary files via...

CVE-2008-1448

The MHTML protocol handler in a component of Microsoft Outlook Express 5.5 SP2 and 6 through SP1, and Windows Mail, does not assign the correct Internet Explorer Security Zone to UNC share pathnames, which allows remote attackers to bypass intended access restrictions and read arbitrary files via...

CVE-2008-1448

The MHTML protocol handler in a component of Microsoft Outlook Express 5.5 SP2 and 6 through SP1, and Windows Mail, does not assign the correct Internet Explorer Security Zone to UNC share pathnames, which allows remote attackers to bypass intended access restrictions and read arbitrary files via...

CVE-2008-1448

Technical details for CVE-2008-1448 are not provided in the connected documents. Public details are limited to related CVEs; monitor for updates.

CVE-2008-1448: Undefined Security Weakness

The MHTML protocol handler in a component of Microsoft Outlook Express 5.5 SP2 and 6 through SP1, and Windows Mail, does not assign the correct Internet Explorer Security Zone to UNC share pathnames, which allows remote attackers to bypass intended access restrictions and read arbitrary files via...

MS08-048: Security Update for Outlook Express and Windows Mail (951066)

The remote host is running a version of Microsoft Outlook Express which contains a flaw that might be used to cause an information disclosure. To exploit this flaw, an attacker would need to send a malformed email to a victim on the remote host and have him open it. C Tenable Network Security, In...

Microsoft Outlook Express And Windows Mail MHTML Handler Information Disclosure Vulnerability

Description Microsoft Outlook Express And Windows Mail are prone to an information-disclosure vulnerability because of an error in the Windows MHTML protocol handler. Note that an attacker can exploit this issue via Internet Explorer because the browser internally uses the vulnerable component of...

Microsoft Windows MHTML URL Parsing Information Disclosure (MS08-048; CVE-2008-1448)

MHTML MIME Encapsulation of Aggregate HTML is an Internet standard that defines the MIME structure that is used to wrap HTML content. An information disclosure vulnerability has been reported in Outlook Express and Windows Mail due to a flaw in the MHTML protocol. The vulnerability is caused when...

Microsoft Security Bulletin MS08-048 - Important Security Update for Outlook Express and Windows Mail (951066)

Microsoft Security Bulletin MS08-048 - Important Security Update for Outlook Express and Windows Mail 951066 Published: August 12, 2008 Version: 1.0 General Information Executive Summary This security update resolves a privately reported vulnerability in Outlook Express and Windows Mail. The...

Directory traversal vulnerability in WebLogic Server and WebLogic Express plug-ins

Overview WebLogic Server and WebLogic Express are application servers provided by Oracle formerly BEA Systems, Inc.. Plug-ins included in WebLogic Server and WebLogic Express contain a directory traversal vulnerability. WebLogic Server and WebLogic Express are application servers based on Java...

JVN#81667751 Directory traversal vulnerability in WebLogic Server and WebLogic Express plug-ins

WebLogic Server and WebLogic Express are application servers based on Java Platform Enterprise Edition 5 JavaEE5 and provided by Oracle formerly BEA Systems, Inc.. Plug-ins for Apache, Sun, and Microsoft IIS web servers which are included in WebLogic Server and WebLogic Express contain a director...

Outlook Express 6 恶意附件保护绕过漏洞

BUGTRAQ ID: 3271 微软OutLook Express 6中带了一个新的安全特性，额可以阻止用户打开或者保存可能有 害的附件。 然而，这个特性存在一个漏洞。攻击者可以通过在邮件中嵌入一个frame来绕过上述保护。 当攻击者在frame中嵌入一个".exe"或者“.bat"文件时，如果用户试图打开这个文件，恶 意程序可能被执行。用户也可以将其保存在硬盘上。 Microsoft Outlook Express 6.0 - Microsoft Windows ME - Microsoft Windows 98se - Microsoft Windows 98 - Microsof...

Microsoft Office Snapshot Viewer ActiveX Exploit（lcx）

No description provided by source. script type="text/javascript" function killErrors return true; window.onerror = killErrors; var x; var obj; var mycars = new Array; mycars0 = "c:/Program Files/Outlook Express/wab.exe"; mycars1 = "d:/Program Files/Outlook Express/wab.exe"; mycars2 = "e:/Program...

CVE-2008-0106: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in Microsoft SQL Server 2005 SP1 and SP2, and 2005 Express Edition SP1 and SP2, allows remote authenticated users to execute arbitrary code via a crafted insert statement...