CVE-2001-0501

Microsoft Word 2002 and earlier allows attackers to automatically execute macros without warning the user by embedding the macros in a manner that escapes detection by the security scanner...

CVE-2001-0240

Microsoft Word before Word 2002 allows attackers to automatically execute macros without warning the user via a Rich Text Format RTF document that links to a template with the embedded macro...

Fwd: Microsoft Word macro vulnerability advisory MS01-034

Hi, Within minutes of Microsoft posting the bulletin on their site, my mailbox was swamped with emails from people asking the same two questions. I am therefore forwarding the below email minus the sample document! to the BugTraq mailing list to reach a wide audience and answer the two questions ...

Security Bulletin MS01-034

---------------------------------------------------------------------- Title: Malformed Word Document Could Enable Macro to Run Automatically Date: 21 June 2001 Software: Word Impact: Run macro without warning Bulletin: MS01-034 Microsoft encourages customers to review the Security Bulletin at:...

Очередной способ обойти защиту от макросов в MS Word (Macro protection bypass)

Можно "повредить" документ таким образом, что сканер не распознает макрос, но при открытии макрос все равно будет выполнен...

Дырка в Microsoft Word (template macro execution)

При выполнении макроса содержащегося в прикрепленном темплейте не выдается предупреждающее сообщение...

Security Bulletin MS01-028

---------------------------------------------------------------------- Title: RTF document linked to template can run macros without warning Date: 21 May 2001 Software: Microsoft Word for Windows and Word for the Mac Impact: Run Macros without warning Bulletin: MS01-028 Microsoft encourages...

CVE-2001-0319

The CVE-2001-0319 entry concerns IBM Net.Commerce 3.x, where the macro orderdspc.d2w in the report capability is vulnerable to SQL injection via the order_rn option. The underlying issue is a SQL injection flaw in the remote interface that lets an attacker supply crafted input to alter or execute...

CVE-2000-0861

Mailman 1.1 allows list administrators to execute arbitrary commands via shell metacharacters in the %listname macro expansion...

Office 2000 UA Control incorrectly marked safe for scripting

Overview The Microsoft Office 2000 UA ActiveX control is incorrectly marked as "safe for scripting". This vulnerability may allow an intruder to disable macro warnings in Office products and, subsequently, execute arbitrary code. This vulnerability may be exploited by viewing an HTML document via...

CVE-2000-0504

libICE in XFree86 allows remote attackers to cause a denial of service by specifying a large value which is not properly checked by the SKIPSTRING macro...

access.vba.txt

Microsoft Access Trojan VBA code: The overlooked "macro virus" -- Brief Summary: Microsoft Access Databases are not afforded "Macro execution protection" in the manner of Word/Excel/Powerpoint documents. Attackers can insert trojan VBA code into MS Access documents to execute arbitrary commands o...

CVE-2000-0277

Microsoft Excel 97 and 2000 does not warn the user when executing Excel Macro Language XLM macros in external text files, which could allow an attacker to execute a macro virus, aka the "XLM Text Macro" vulnerability...

CVE-2000-0277

Microsoft Excel 97/2000 are affected by the XLM Text Macro vulnerability, where Excel fails to warn when macros in external text files are executed, potentially allowing arbitrary commands via a macro virus. The issue occurs when references to external XLM macro files are present; Excel may not d...

Уязвимость в Microsoft Office

Элемент ActiveX Microsoft Office UA позволяет полностью управлять работой программ семейства Office через Internet без ведома пользователя. Кроме того, позволяет выполнять макросы без предупреждения пользователя...

win98-bluescreen.txt

=-= Next Generation of Windows 98 Blues Screen 2 =-= By RUBINHOC from BraZiL Original exploit found by www.securax.org Only for: ruindows 98 maybe 95 too. Techniques: NEW - Infernal Pulse 03/17/2000 =-= WIN98 webservers =-= customized by RUBINHOC rubinhoc:roottelnet victim.com 80 Trying x.x.x.x...

CVE-2000-0277

Microsoft Excel 97 and 2000 does not warn the user when executing Excel Macro Language XLM macros in external text files, which could allow an attacker to execute a macro virus, aka the "XLM Text Macro" vulnerability...

warftp.txt

Thanks for the props Jarle. The current release beta of War-ftpd v1.70b seems to have some serious problems with the parsing of macros. The current version doesn't even seem to document the macros available, but in the response files sysmsg?.txt you are supposed to be able to put macros in the fo...

CVE-1999-0794

Microsoft Excel does not warn a user when a macro is present in a Symbolic Link SYLK format file...

CVE-1999-0794

Issue summary : Microsoft Excel does not warn users when a macro is present inside a Symbolic Link (SYLK) format file. What is affected : Excel’s handling of SYLK files containing macros (no warning prompt to the user). Root cause / nature of vulnerability : Absence of user warning in the SYLK ma...