MS12-079: Description of the security update for Microsoft SharePoint Server 2010 Service Pack 1 WAS: December 11, 2012

Describes the security update that was released on December 11, 2012 for Microsoft SharePoint Server 2010 Service Pack 1 Word Automation Services WAS.INTRODUCTIONMicrosoft has released security bulletin MS12-079. To view the complete security bulletin, go to one of the following Microsoft...

Microsoft Word RTF文件释放后重用远程代码执行漏洞（MS12-064）

BUGTRAQ ID: 55781 CVECAN ID: CVE-2012-2528 Microsoft Word属于办公软件是微软公司的一个文字处理器应用程序。 Microsoft Office处理特制RTF文件时存在远程代码执行漏洞，成功利用此漏洞的攻击者可完全控制受影响系统。 0 Microsoft Word 2010 Microsoft Word 2007 Microsoft Word 2003 Microsoft Office SharePoint Server 2010 Microsoft Office Web Apps 2010 SP1 Microsoft Office W...

Microsoft多个产品HTML过滤组件跨站脚本执行漏洞（MS12-066）

CVECAN ID: CVE-2012-2520 Microsoft是一家基于美国的跨国电脑科技公司。以研发、制造、授权和提供广泛的电脑软件服务业务为主。 Microsoft多个产品在HTML过滤组件内没有正确过滤某些输入即返给用户使用。成功利用此漏洞的攻击者可执行跨站脚本攻击并以当前用户权限运行脚本。 0 Microsoft SharePoint Server 2007 Microsoft Office Web Apps Microsoft Groove Server 2010 Microsoft Lync 2010 Microsoft Office Communicator 2007...

CVE-2012-2528

Use-after-free vulnerability in Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; Word Automation Services on Microsoft SharePoint Server 2010; and Office Web Apps 2010 SP1 allows remote attackers to execute arbitrary code via a crafted R...

Cross site scripting

Cross-site scripting XSS vulnerability in Microsoft InfoPath 2007 SP2 and SP3 and 2010 SP1, Communicator 2007 R2, Lync 2010 and 2010 Attendee, SharePoint Server 2007 SP2 and SP3 and 2010 SP1, Groove Server 2010 SP1, Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010 SP1, and Office W...

CVE-2012-2528

Use-after-free vulnerability in Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; Word Automation Services on Microsoft SharePoint Server 2010; and Office Web Apps 2010 SP1 allows remote attackers to execute arbitrary code via a crafted R...

Microsoft Word RTF File Use-After-Free Remote Code Execution Vulnerability

Description Microsoft Word is prone to a remote code-execution vulnerability. An attacker can exploit this issue to execute arbitrary code in the context of the currently logged-in user, which can lead to a complete compromise of an affected computer. Technologies Affected Microsoft Office...

Microsoft Office SharePoint Server 2007 - Remote Code Execution (MS10-104) (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'Microsoft Office SharePoint Server 20...

MS10-104 Microsoft Office SharePoint Server 2007 Remote Code Execution

This module exploits a vulnerability found in SharePoint Server 2007 SP2. The software contains a directory traversal, that allows a remote attacker to write arbitrary files to the filesystem, sending a specially crafted SOAP ConvertFile request to the Office Document Conversions Launcher Service...

Microsoft Office SharePoint Server 2007 Remote Code Execution

Exploit for windows platform in category remote exploits This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core'...

Microsoft Office SharePoint Server 2007 Remote Code Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'Microsoft Office SharePoint Server 20...

Microsoft SharePoint CVE-2012-1862 URI重定向漏洞

Bugtraq ID:54315 CVE ID:CVE-2012-1862 Microsoft SharePoint Server是一款服务器功能集成套件，提供全面的内容管理和企业搜索、加速共享业务流程并便利跨界限信息共享。 Microsoft SharePoint Server存在一个开放重定向漏洞，允许攻击者通过特制URL，重定向用户到任意WEB站点，进行网络钓鱼等攻击。 0 Microsoft InfoPath 2010 Microsoft InfoPath 2007 SP2 Microsoft InfoPath 2007 厂商解决方案 用户可参考如下供应商提供的安全公告获得补丁信...

Microsoft SharePoint 跨站脚本漏洞(CVE-2012-1863)

Bugtraq ID:54316 CVE ID:CVE-2012-1863 Microsoft SharePoint Server是一款服务器功能集成套件，提供全面的内容管理和企业搜索、加速共享业务流程并便利跨界限信息共享。 Microsoft SharePoint Server存在一个跨站脚本漏洞，允许攻击者通过URL中特制的JavaScript元素，注入任意WEB脚本或HTML，攻击者可以利用漏洞获得敏感信息或劫持用户会话。 0 Microsoft SharePoint Foundation 2010 SP1 Microsoft SharePoint Foundation 2010...

CVE-2012-1859

Cross-site scripting XSS vulnerability in scriptresx.ashx in Microsoft SharePoint Server 2010 Gold and SP1, SharePoint Foundation 2010 Gold and SP1, and Office Web Apps 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript elements in a URL, aka...

CVE-2012-1861

Cross-site scripting XSS vulnerability in Microsoft SharePoint Server 2010 Gold and SP1, SharePoint Foundation 2010 Gold and SP1, and Office Web Apps 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript elements in a URL, aka "SharePoint Script i...

Cross site scripting

Cross-site scripting XSS vulnerability in scriptresx.ashx in Microsoft SharePoint Server 2010 Gold and SP1, SharePoint Foundation 2010 Gold and SP1, and Office Web Apps 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript elements in a URL, aka...

CVE-2012-1862

CVE-2012-1862 is an open-redirect vulnerability affecting Microsoft Office SharePoint Server 2007 SP2 and SP3. The issue arises from improper handling/sanitization of user-supplied input in SharePoint’s URL processing, allowing an attacker to redirect victims to arbitrary external sites and poten...

CVE-2012-1863

CVE-2012-1863 is an XSS in Microsoft SharePoint: SharePoint Server 2007 SP2/SP3, WSS 3.0 SP2, and SharePoint Foundation 2010 Gold/SP1 allow remote attackers to inject arbitrary scripts via crafted JavaScript in a URL due to insufficient sanitization of the List parameter. The vulnerability is add...

CVE-2012-1859

Cross-site scripting XSS vulnerability in scriptresx.ashx in Microsoft SharePoint Server 2010 Gold and SP1, SharePoint Foundation 2010 Gold and SP1, and Office Web Apps 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript elements in a URL, aka...

CVE-2012-1861

CVE-2012-1861 is an XSS vulnerability in Microsoft SharePoint 2010 (Gold/SP1), SharePoint Foundation 2010 (Gold/SP1), and Office Web Apps 2010 (Gold/SP1) where attacker-controlled JavaScript in a URL can execute in the user’s browser. Public sources (OpenVAS/Nessus/Tenable entry MS12-050) referen...