CVE-2013-3893: Fix it workaround available

Today, we released a Fix it workaround tool to address a new IE vulnerability that had been actively exploited in extremely limited, targeted attacks. This Fix it makes a minor modification to mshtml.dll when it is loaded in memory to address the vulnerability. This Fix it workaround tool is link...

CVE-2013-3202

CVE-2013-3202 affects Microsoft Internet Explorer 10. The vulnerability is a memory corruption issue that allows remote code execution when a user visits a crafted website. Connected advisories confirm IE memory-corruption vectors and reference MS13-069 as the cumulative security update for Inter...

CVE-2013-3207

CVE-2013-3207 affects Microsoft Internet Explorer 9 and 10. The vulnerability is a memory corruption issue that could allow remote code execution via a crafted web site. Microsoft released MS13-069 (Cumulative Security Update for Internet Explorer, MS13-069; patch ID 2870699) to fix it. Affected ...

September's Patch Tuesday updates to fix Critical flaws in Windows, IE and Office

This Tuesday, Microsoft will be releasing its September's Patch Tuesday updates includes 14 bulletins in total, fixing issues in Windows, Office, Outlook, Internet Explorer, SharePoint and FrontPage. In all, there are eight remote code execution flaws in Microsoft Office, Microsoft Server Softwar...

Office, SharePoint Patches Await September Patch Tuesday

Today’s monthly advance notification of Microsoft’s upcoming security bulletin release on Tuesday includes a number of critical Office patches that have experts worried. Of particular concern are remote code execution vulnerabilities in Outlook 2007 and 2010 that can be exploited by merely...

Microsoft Windows Uniscribe字体解析远程代码执行漏洞(CVE-2013-3181)(MS13-060)

BUGTRAQ ID: 61697 CVECAN ID: CVE-2013-3181 Uniscribe是微软公司开发的Windows操作系统为正确演示Unicode文字而开发的组件。系统的核心是一个名为USP10.DLL的DLL。 受影响Microsoft Windows版本处理OpenType字体时，Unicode Scripts Processor存在远程代码执行漏洞，成功利用此漏洞造成内存破坏，攻击者以当前用户权限执行任意代码。 0 Microsoft Windows XP Professional Microsoft Windows XP Home Edition...

Jumping Out of IE's Sandbox With One Click

Software vendors often give intentionally vague and boring names to the updates they use to fix security vulnerabilities. The lamer the name, the less attention it may attract from attackers looking to reverse-engineer the patch. There was one patch in Microsoft’s August Patch Tuesday release...

CVE-2013-3188

CVE-2013-3188 affects Microsoft Internet Explorer 8 and 9. The vulnerability allows remote code execution via a crafted web site due to memory corruption, enabling an attacker to run arbitrary code. The entry is coordinated with CVE-2013-3189 and is associated with MS13-059 (patch/mitigation). Af...

CVE-2013-3189

CVE-2013-3189 affects Microsoft Internet Explorer 8 and 9. The vulnerability allows remote attackers to execute arbitrary code or cause a denial of service via a crafted web site, described as memory corruption in IE, distinct from CVE-2013-3188. Connected sources corroborate impact as remote cod...

CVE-2013-3194

CVE-2013-3194 affects Microsoft Internet Explorer 9, describing a remote code execution/memory corruption vulnerability when a user views a crafted web page. The root cause is memory corruption in IE’s rendering components (MSHTML/related HTML DLLs) used by IE9, enabling arbitrary code execution ...

CVE-2013-3190

CVE-2013-3190 affects Microsoft Internet Explorer 8–10. The public description and connected records show remote code execution and memory corruption via a crafted Web page, impacting IE on Windows platforms of that era (notably IE8–10 on Windows XP/Vista/Server 2003/2008 variants). The vulnerabi...

Microsoft to Pay First Bug Bounty for IE 11

Just a few weeks after announcing its first bug bounty programs, Microsoft is already set to pay out a reward to a researcher from Google who discovered a vulnerability in Internet Explorer 11. Microsoft officials say that they have several other qualifying entries for the IE 11 reward program...

Attackers Targeting MS13-055 IE Vulnerability

Attackers are using an Internet Explorer vulnerability, which Microsoft patched yesterday, in targeted attacks that also employ a malicious Flash file installed through a drive-by download launched by compromised Web pages. The exploit that’s being used is capable of bypassing both ASLR and DEP...

CVE-2013-3164

CVE-2013-3164 : Vulnerability in Internet Explorer 8 where a use-after-free in CAnchorElement during memory handling can be abused by a crafted webpage to achieve remote code execution or memory corruption. Documented as MS13-055 (Cumulative Security Update for Internet Explorer, 2846071). Affect...

Microsoft Internet Explorer CVE-2013-3163 Memory Corruption Vulnerability

Description Microsoft Internet Explorer is prone to a memory-corruption vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed attacks will cause denial-of-service conditions. Microsoft Internet Explorer 8, 9, and 10 are...

Microsoft Internet Explorer Memory Corruption (MS13-055: CVE-2013-3147)

A Remote code execution vulnerability has been reported in Microsoft Internet Explorer...

Discuz! X3 最新存储xss

简要描述： Discuz! X3 最新存储xss 详细说明： Discuz! X3 个人空间 -- 装扮空间处 开始 自定义 文字颜色处 构造语句exp//ressi//on:alertdocument.cookie IE 下触发 ，目前测试浏览器 IE 6、7 漏洞证明：...

CVE-2013-3124

CVE-2013-3124 describes a memory corruption vulnerability in Microsoft Internet Explorer 9 that can allow remote code execution or a denial of service via a crafted webpage. The affected component is Internet Explorer 9; root cause is memory corruption, with the public description noting it as a ...

CVE-2013-3122

Microsoft Internet Explorer 9 is affected by CVE-2013-3122. The vulnerability allows remote attackers to execute arbitrary code or cause a denial of service through a crafted web site, described as a memory corruption issue (distinct from CVE-2013-3117 and CVE-2013-3124). The initial description ...

CVE-2013-3118

CVE-2013-3120 is a memory corruption vulnerability in Microsoft Internet Explorer 10 (MSHTML) related to the CEditAdorner::Detach use-after-free path. Exploitation is achievable through a crafted web page and can lead to remote code execution or a denial of service. An exploit exists (Exploit-DB ...