PT-2013-3086

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Portal Server versions 2003 SP3 through 2010 SP2 SharePoint Server versions 2007 SP3 through 2010 SP2 Office Web Apps version 2010 Description A remote code execution issue exists due to the improper setting of the...

CVE-2013-0081: Improper Input Validation

Microsoft SharePoint Portal Server 2003 SP3 and SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013 do not properly process unassigned workflows, which allows remote attackers to cause a denial of service W3WP process hang via a crafted URL, aka "SharePoint Denial of Service Vulnerability."...

CVE-2013-1330: Improper Input Validation

The default configuration of Microsoft SharePoint Portal Server 2003 SP3, SharePoint Server 2007 SP3 and 2010 SP1 and SP2, and Office Web Apps 2010 does not set the EnableViewStateMac attribute, which allows remote attackers to execute arbitrary code by leveraging an unassigned workflow, aka "MAC...

PT-2013-2085

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Portal Server 2003 SP3 Microsoft SharePoint Server 2007 SP3 Microsoft SharePoint Server 2010 SP1 Microsoft SharePoint Server 2010 SP2 Microsoft SharePoint Server 2013 Description A denial of service issue exists due to...

Microsoft SharePoint CVE-2013-1330 Remote Code Execution Vulnerability

Description Microsoft SharePoint is prone to a remote code-execution vulnerability. An attacker can exploit this issue to execute arbitrary code within the context of the guest account on the SharePoint server. Failed exploit attempts will result in a denial-of-service condition. Technologies...

Office, SharePoint Patches Await September Patch Tuesday

Today’s monthly advance notification of Microsoft’s upcoming security bulletin release on Tuesday includes a number of critical Office patches that have experts worried. Of particular concern are remote code execution vulnerabilities in Outlook 2007 and 2010 that can be exploited by merely...

Microsoft Log Sink Class ActiveX control incorrectly marked "safe for scripting"

Overview The Microsoft Log Sink Class ActiveX control is incorrectly marked safe for scripting. This may allow a remote attacker to create or append to arbitrary files on a vulnerable system. Description ActiveXActiveX is a technology that allows programmers to create reusable software components...

CVE-2004-0379

CVE-2004-0379 corresponds to multiple cross-site scripting (XSS) vulnerabilities in Microsoft SharePoint Portal Server 2001. The affected component is three scripts within SharePoint Portal Server 2001, where XSS could allow remote attackers to process arbitrary web content and steal cookies via ...

CVE-2004-0379: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Microsoft SharePoint Portal Server 2001 allow remote attackers to process arbitrary web content and steal cookies via certain server scripts...