CVE-2003-0907: Improper Neutralization of Argument Delimiters in a Command

Help and Support Center in Microsoft Windows XP SP1 does not properly validate HCP URLs, which allows remote attackers to execute arbitrary code via quotation marks in an hcp:// URL, which are not quoted when constructing the argument list to HelpCtr.exe...

[Full-Disclosure] Microsoft Help and Support Center argument injection vulnerability

OVERVIEW ======== "Help and Support Center HSC is a feature in Windows that provides help on a variety of topics" from www.microsoft.com. It can be accessed via HCP: URLs. HSC is installed by default on Windows XP and Windows Server 2003 systems. An argument injection vulnerability in HSC allows ...

Microsoft Windows Help and Support Center (HCP) fails to validate HCP URLs

Overview A remotely exploitable vulnerability exists in the Help and Support Center HCP. An attacker could compromise the victim's system by tricking them into visiting a malicious web site, or viewing a malicious email message. Description A failure to filter special characters, such as quotes,...

Microsoft Windows Help And Support Center URI Validation Code Execution Vulnerability

Description Microsoft has reported a vulnerability in the Help and Support Center that is related to how HCP URIs are validated. This issue could reportedly be exploited via a malicious web page or HTML e-mail to execute arbitrary code on a client system. The issue may permit an attacker to injec...

Outlook Express MHTML protocol handler does not properly validate source of alternate content

Overview The Outlook Express MIME Encapsulation of Aggregate HTML Documents MHTML protocol handler does not adequately validate the source of alternate content. An attacker could exploit this vulnerability to access data and execute script in different security domains. By causing script to be ru...

Dell TrueMobile privilege escalation

it's possible to obtain local system privileges through help subsystem...

Microsoft Windows XP - Help and Support Center Interface Spoofing

Microsoft Windows XP - Help and Support Center Interface Spoofing source: https://www.securityfocus.com/bid/9685/info A weakness has been alleged in Microsoft Windows XP that could reportedly allow aspects of the Help and Support Center interface to be spoofed via a malicious link. By spoofing th...

Microsoft Windows XP - Help and Support Center Interface Spoofing

source: https://www.securityfocus.com/bid/9685/info A weakness has been alleged in Microsoft Windows XP that could reportedly allow aspects of the Help and Support Center interface to be spoofed via a malicious link. By spoofing this interface, an attacker could potentially present misleading or...

HTML help privilege escalation

HtmlHelp call doesn't drop system privileges...

CVE-2003-0996

Unknown "System Security Vulnerability" in Computer Associates CA Unicenter Remote Control URC 6.0 allows attackers to gain privileges via the help interface...

CVE-2003-0996: Undefined Security Weakness

Unknown "System Security Vulnerability" in Computer Associates CA Unicenter Remote Control URC 6.0 allows attackers to gain privileges via the help interface...

CVE-2003-0936: Undefined Security Weakness

Symantec PCAnywhere 10.x and 11, when started as a service, allows attackers to gain SYSTEM privileges via the help interface using AWHOST32.exe...

CVE-2003-0711

Stack-based buffer overflow in the PCHealth system in the Help and Support Center function in Windows XP and Windows Server 2003 allows remote attackers to execute arbitrary code via a long query in an HCP URL...

MS03-044: Buffer Overrun in Windows Help (825119)

A security vulnerability exists in the Windows Help Service that could allow arbitrary code execution on an affected system. An attacker who successfully exploited this vulnerability could run code with Local System privileges on this host. C Tenable Network Security, Inc. include"compat.inc"; if...

[Full-Disclosure] HTML Help API - Privilege Escalation

===================================================================== = HTML Help API - Privilege Escalation = = Tested against: = HTML Help Control Version 5.2.3735.1 = = [email protected] = http://www.security-assessment.com = = Originally posted: October 24th, 2003...

CVE-2003-0711: Undefined Security Weakness

Stack-based buffer overflow in the PCHealth system in the Help and Support Center function in Windows XP and Windows Server 2003 allows remote attackers to execute arbitrary code via a long query in an HCP URL...

Microsoft Help and Support Center contains buffer overflow in code used to handle HCP protocol

Overview There is a buffer overflow in the Microsoft Help and Support Center that could permit an attacker to execute arbitrary code with SYSTEM privileges. Description The Microsoft Help and Support Center is a facility within WIndows to provide product help and documentation. Among other things...

Microsoft Windows Help and Support Center buffer overflow

Buffer overflow on hcp:// protocol handling...

CVE-2002-0823

Buffer overflow in Winhlp32.exe allows remote attackers to execute arbitrary code via an HTML document that calls the HTML Help ActiveX control HHCtrl.ocx with a long pathname in the Item parameter...

CVE-2002-0074: Undefined Security Weakness

Cross-site scripting vulnerability in Help File search facility for Internet Information Server IIS 4.0, 5.0 and 5.1 allows remote attackers to embed scripts into another user's session...