305 matches found
Microsoft XML multiple security vulnerabilities
Memory corruption, crossite scripting, information leak...
Microsoft Security Bulletin MS08-069 – Critical Vulnerabilities in Microsoft XML Core Services Could Allow Remote Code Execution (955218)
Microsoft Security Bulletin MS08-069 – Critical Vulnerabilities in Microsoft XML Core Services Could Allow Remote Code Execution 955218 Published: November 11, 2008 Version: 1.0 General Information Executive Summary This security update resolves several vulnerabilities in Microsoft XML Core...
CVE-2008-4033: Exposure of Sensitive Information to an Unauthorized Actor
Cross-domain vulnerability in Microsoft XML Core Services 3.0 through 6.0, as used in Microsoft Expression Web, Office, Internet Explorer, and other products, allows remote attackers to obtain sensitive information from another domain and corrupt the session state via HTTP request header fields, ...
CVE-2008-4029: Exposure of Sensitive Information to an Unauthorized Actor
Cross-domain vulnerability in Microsoft XML Core Services 3.0 and 4.0, as used in Internet Explorer, allows remote attackers to obtain sensitive information from another domain via a crafted XML document, related to improper error checks for external DTDs, aka "MSXML DTD Cross-Domain Scripting...
Microsoft XML Core Services DTD Cross Domain Information Disclosure Vulnerability
Description Microsoft XML Core Services MSXML is prone to a cross-domain information-disclosure vulnerability because the application fails to properly handle certain error checks. An attacker can exploit this issue to harvest potentially sensitive information from a web page in another domain...
Microsoft XML Core Services Transfer Encoding Cross Domain Information Disclosure Vulnerability
Description Microsoft XML Core Services MSXML is prone to a cross-domain information-disclosure vulnerability because the application fails to properly enforce the same-origin policy. An attacker can exploit this issue to harvest potentially sensitive information from a web page in another domain...
Microsoft XML Core Services Nested Tag (MS08-069; CVE-2007-0099)
MSXML is an application for processing Extensible Stylesheet Language Transformation in an XML file that allows programmers to create high-performance XML-based applications. A remote code execution vulnerability has been reported in Microsoft XML Core Services MSXML. The vulnerability is due to...
Integer overflow
Microsoft XML Core Services MSXML 3.0 through 6.0 allows remote attackers to execute arbitrary code via the substringData method on a 1 TextNode or 2 XMLDOM object, which causes an integer overflow that leads to a buffer overflow...
Microsoft XML Core Services SubstringData Integer Overflow Vulnerability
Description Microsoft XML Core Services is prone to an integer-overflow vulnerability because the application fails to ensure that integer values are not overrun. Attackers can exploit this issue by enticing unsuspecting users to view malicious web content. Specially crafted scripts could issue...
Microsoft Security Bulletin MS07-042 - Critical Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution (936227)
Microsoft Security Bulletin MS07-042 - Critical Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution 936227 Published: August 14, 2007 Version: 1.0 General Information Executive Summary This critical security update resolves a privately reported vulnerability. This...
CVE-2007-2223: Improper Restriction of Operations within the Bounds of a Memory Buffer
Microsoft XML Core Services MSXML 3.0 through 6.0 allows remote attackers to execute arbitrary code via the substringData method on a 1 TextNode or 2 XMLDOM object, which causes an integer overflow that leads to a buffer overflow...
Microsoft XML Core Services 6.0 - SubstringData Integer Overflow
Microsoft XML Core Services 6.0 - SubstringData Integer Overflow source: https://www.securityfocus.com/bid/25301/info Microsoft XML Core Services is prone to an integer-overflow vulnerability because the application fails to ensure that integer values are not overrun. Attackers can exploit this...
MS07-042: Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution (936227)
The remote host is running a version of Windows that contains a flaw in the Windows XML Core Services. An attacker may be able to execute arbitrary code on the remote host by constructing a malicious script and enticing a victim to visit a website or view a specially crafted email message. C...
MS07-042: Description of the security update for Microsoft XML Core Services 6.0: August 14, 2007
None None...
CVE-2007-0099: Concurrent Execution using Shared Resource with Improper Synchronization
Race condition in the msxml3 module in Microsoft XML Core Services 3.0, as used in Internet Explorer 6 and other applications, allows remote attackers to execute arbitrary code or cause a denial of service application crash via many nested tags in an XML document in an IFRAME, when synchronous...
Microsoft XMLHTTP ActiveX control setRequestHeader vulnerability
Added: 11/17/2006 CVE: CVE-2006-5745 BID: 20915 OSVDB: 30208 Background Microsoft XML Core Services includes the XMLHTTP ActiveX control, which allows web pages to send and receive XML data. Problem A memory corruption vulnerability in the XMLHTTP ActiveX control allows command execution when a...
Microsoft XMLHTTP ActiveX control setRequestHeader vulnerability
Added: 11/17/2006 CVE: CVE-2006-5745 BID: 20915 OSVDB: 30208 Background Microsoft XML Core Services includes the XMLHTTP ActiveX control, which allows web pages to send and receive XML data. Problem A memory corruption vulnerability in the XMLHTTP ActiveX control allows command execution when a...
Microsoft XMLHTTP ActiveX control setRequestHeader vulnerability
Added: 11/17/2006 CVE: CVE-2006-5745 BID: 20915 OSVDB: 30208 Background Microsoft XML Core Services includes the XMLHTTP ActiveX control, which allows web pages to send and receive XML data. Problem A memory corruption vulnerability in the XMLHTTP ActiveX control allows command execution when a...
Microsoft XMLHTTP ActiveX control setRequestHeader vulnerability
Added: 11/17/2006 CVE: CVE-2006-5745 BID: 20915 OSVDB: 30208 Background Microsoft XML Core Services includes the XMLHTTP ActiveX control, which allows web pages to send and receive XML data. Problem A memory corruption vulnerability in the XMLHTTP ActiveX control allows command execution when a...
