KLA10674 Multiple vulnerabilities in Microsoft Windows

Multiple serious vulnerabilities have been found in Microsoft Windows. Malicious users can exploit these vulnerabilities to bypass security restrictions, gain privileges, execute arbitrary code or obtain sensitive information. Below is a complete list of vulnerabilities 1. Improper information...

Cross site scripting

Cross-site scripting XSS vulnerability in uddi/search/frames.aspx in the UDDI Services component in Microsoft Windows Server 2008 SP2 and BizTalk Server 2010, 2013 Gold, and 2013 R2 allows remote attackers to inject arbitrary web script or HTML via the search parameter, aka "UDDI Services Elevati...

Microsoft Windows VBScript Remote Code Execution Vulnerability (3072604)

This host is missing a critical security update according to Microsoft Bulletin MS15-066. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Null pointer dereference

The kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to gain privileges or cause a denial of service NUL...

Microsoft Windows Kernel Bitmap Handling CVE-2015-1722 Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability. A local attacker can exploit this issue to execute arbitrary code with elevated privileges and corrupt kernel memory. Technologies Affected Microsoft Windows 7 for 32-bit Systems SP1 Microsoft Windows 7 for...

Microsoft Windows Kernel Mode Driver CVE-2015-1676 Local Information Disclosure Vulnerability

Description Microsoft Windows is prone to a local information-disclosure vulnerability. Local attackers can exploit this issue to obtain sensitive information such as kernel memory contents. This may aid in launching further attacks. Technologies Affected Microsoft Windows 7 for 32-bit Systems SP...

KLA10580 Multiple vulnerabilities in Microsoft products

Multiple serious vulnerabilities have been found in Microsoft products. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, gain privileges or obtain sensitive information. Below is a complete list of vulnerabilities 1. An unknown...

Microsoft XML Core Services CVE-2015-1646 Same Origin Policy Security Bypass Vulnerability

Description Microsoft XML Core Services is prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass the same-origin policy and perform unauthorized actions. This could be used to steal sensitive information or launch other attacks. Technologies Affected Avaya CallPil...

Microsoft Windows OLE Object Handling Code Execution Vulnerabilities (3011443)

This host is missing a critical security update according to Microsoft Bulletin MS14-064. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Microsoft Windows Kernel-Mode Driver Privilege Escalation and RCE Vulnerabilities (3000061)

This host is missing a critical security update according to Microsoft Bulletin MS14-058. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Microsoft Windows 'Win32k.sys' TrueType Font Handling Remote Code Execution Vulnerability

Description Microsoft Windows kernel is prone to a remote code-execution vulnerability. An attacker can exploit this issue by tricking an unsuspecting victim into opening a specially malformed TrueType font. Successful exploits can allow attackers to execute arbitrary code with kernel-level...

Microsoft XML Core Services CVE-2014-1816 Information Disclosure Vulnerability

Description Microsoft XML Core Services MSXML is prone to an information-disclosure vulnerability. An attacker can exploit this issue to gain access to sensitive information that may lead to further attacks. Technologies Affected Avaya Aura Conferencing 6.0 Avaya Aura Conferencing 6.0 SP1 Standar...

Microsoft XML Core Services CVE-2014-0266 Information Disclosure Vulnerability

Description Microsoft XML Core Services MSXML is prone to an information-disclosure vulnerability. An attacker can leverage this issue to read files on the local file system or obtain sensitive information; this may aid in other attacks. Attackers can exploit this issue by enticing an unsuspectin...

EMC Data Protection Advisor DPA Illuminator - EJBInvokerServlet Remote Code Execution

EMC Data Protection Advisor DPA Illuminator - EJBInvokerServlet Remote Code Execution EMC Data Protection Advisor DPA Illuminator EJBInvokerServlet Remote Code Execution tested against: Microsoft Windows Server 2008 r2 sp1 EMC Data Protection Advisor 5.8 sp5 vulnerability: the "DPA Illuminator"...

Microsoft Windows Digital Signatures Denial of Service Vulnerability (2868626)

This host is missing an important security update according to Microsoft Bulletin MS13-095. OpenVAS Vulnerability Test $Id: secpodms13-095.nasl 5346 2017-02-19 08:43:11Z cfi $ Microsoft Windows Digital Signatures Denial of Service Vulnerability 2868626 Authors: Shashi Kiran N Copyright: Copyright...

Microsoft Windows Ancillary Function Driver CVE-2013-3887 Local Information Disclosure Vulnerability

Description Microsoft Windows is prone to a local information-disclosure vulnerability. An attacker can leverage this issue to disclose kernel memory and obtain sensitive information that may aid in further attacks. Technologies Affected Microsoft Windows 7 for x64-based Systems SP1 Microsoft...

CVE-2013-6230

The Winsock WSAIoctl API in Microsoft Windows Server 2008, as used in ISC BIND 9.6-ESV before 9.6-ESV-R10-P1, 9.8 before 9.8.6-P1, 9.9 before 9.9.4-P1, 9.9.3-S1, 9.9.4-S1, and other products, does not properly support the SIOGETINTERFACELIST command for netmask 255.255.255.255, which allows remot...

CVE-2013-6230

The Winsock WSAIoctl API in Microsoft Windows Server 2008, as used in ISC BIND 9.6-ESV before 9.6-ESV-R10-P1, 9.8 before 9.8.6-P1, 9.9 before 9.9.4-P1, 9.9.3-S1, 9.9.4-S1, and other products, does not properly support the SIOGETINTERFACELIST command for netmask 255.255.255.255, which allows remot...

Command injection

The Winsock WSAIoctl API in Microsoft Windows Server 2008, as used in ISC BIND 9.6-ESV before 9.6-ESV-R10-P1, 9.8 before 9.8.6-P1, 9.9 before 9.9.4-P1, 9.9.3-S1, 9.9.4-S1, and other products, does not properly support the SIOGETINTERFACELIST command for netmask 255.255.255.255, which allows remot...

CVE-2013-6230

The Winsock WSAIoctl API in Microsoft Windows Server 2008, as used in ISC BIND 9.6-ESV before 9.6-ESV-R10-P1, 9.8 before 9.8.6-P1, 9.9 before 9.9.4-P1, 9.9.3-S1, 9.9.4-S1, and other products, does not properly support the SIOGETINTERFACELIST command for netmask 255.255.255.255, which allows remot...