Microsoft to Fix Critical Word Flaw in October Patch Tuesday

Microsoft will release seven bulletins in the October Patch Tuesday next week, fixing 20 total vulnerabilities in Windows, Office, Lync and SQL Server. Only one of the bulletins is rated critical, while the six others are rated important. The one critical bulletin affects Microsoft Office 2003,...

Microsoft Office SharePoint Server 2007 - Remote Code Execution (MS10-104) (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'Microsoft Office SharePoint Server 20...

MS10-104 Microsoft Office SharePoint Server 2007 Remote Code Execution

This module exploits a vulnerability found in SharePoint Server 2007 SP2. The software contains a directory traversal, that allows a remote attacker to write arbitrary files to the filesystem, sending a specially crafted SOAP ConvertFile request to the Office Document Conversions Launcher Service...

Microsoft Security Advisory 2737111: Vulnerabilities in FAST Search Server 2010 for SharePoint Parsing Could Allow Remote Code Execution (deprecated)

This plugin originally checked for the workaround described in Microsoft Security Advisory 2737111, and has been deprecated due to the publication of MS12-067. Microsoft has released a patch that makes the workaround unnecessary. To check for the patch, use Nessus plugin ID xxxxx. %NASLMINLEVEL...

Microsoft Office SharePoint Server 2007 Remote Code Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'Microsoft Office SharePoint Server 20...

Microsoft Office SharePoint Server 2007 Remote Code Execution

Exploit for windows platform in category remote exploits This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core'...

Microsoft Internet Explorer 9 / SharePoint / Lync - toStaticHTML HTML Sanitizing Bypass (MS12-037/MS12-039/MS12-050)

toStaticHTML: The Second Encounter CVE-2012-1858 HTML Sanitizing Bypass - CVE-2012-1858 Original advisory - http://blog.watchfire.com/wfblog/2012/07/tostatichtml-the-second-encounter-cve-2012-1858-html-sanitizing-information-disclosure-introduction-t.html Introduction The toStaticHTML component,...

Microsoft Internet Explorer 9 SharePoint Lync - toStaticHTML HTML Sanitizing Bypass (MS12-037MS12-039MS12-050)

Microsoft Internet Explorer 9 SharePoint Lync - toStaticHTML HTML Sanitizing Bypass MS12-037MS12-039MS12-050 toStaticHTML: The Second Encounter CVE-2012-1858 HTML Sanitizing Bypass - CVE-2012-1858 Original advisory -...

Microsoft SharePoint 跨站脚本漏洞(CVE-2012-1863)

Bugtraq ID:54316 CVE ID:CVE-2012-1863 Microsoft SharePoint Server是一款服务器功能集成套件，提供全面的内容管理和企业搜索、加速共享业务流程并便利跨界限信息共享。 Microsoft SharePoint Server存在一个跨站脚本漏洞，允许攻击者通过URL中特制的JavaScript元素，注入任意WEB脚本或HTML，攻击者可以利用漏洞获得敏感信息或劫持用户会话。 0 Microsoft SharePoint Foundation 2010 SP1 Microsoft SharePoint Foundation 2010...

Microsoft Sharepoint multiple security vulnerabilities

Crossite scripting, URL redirection...

Microsoft SharePoint CVE-2012-1862 URI重定向漏洞

Bugtraq ID:54315 CVE ID:CVE-2012-1862 Microsoft SharePoint Server是一款服务器功能集成套件，提供全面的内容管理和企业搜索、加速共享业务流程并便利跨界限信息共享。 Microsoft SharePoint Server存在一个开放重定向漏洞，允许攻击者通过特制URL，重定向用户到任意WEB站点，进行网络钓鱼等攻击。 0 Microsoft InfoPath 2010 Microsoft InfoPath 2007 SP2 Microsoft InfoPath 2007 厂商解决方案 用户可参考如下供应商提供的安全公告获得补丁信...

toStaticHTML HTML Sanitizing Bypass

toStaticHTML: The Second Encounter CVE-2012-1858 HTML Sanitizing Bypass - CVE-2012-1858 Original advisory - http://blog.watchfire.com/wfblog/2012/07/tostatichtml-the-second-encounter-cve-2012-1858-html-sanitizing-information-disclosure-introduction-t.html Introduction The toStaticHTML component,...

Microsoft SharePoint 'scriptresx.ashx'跨站脚本漏洞

Bugtraq ID:54312 CVE ID:CVE-2012-1859 Microsoft SharePoint Server是一款服务器功能集成套件，提供全面的内容管理和企业搜索、加速共享业务流程并便利跨界限信息共享。 Microsoft SharePoint Server scriptresx.ashx脚本存在一个跨站脚本漏洞，允许攻击者通过在URL中构建特制JavaScript元素，注入任意WEB脚本或HTML，可获得敏感信息或劫持用户会话。 0 Microsoft SharePoint Server 2010 Standard Edition Microsoft...

MS12-050: Vulnerabilities in SharePoint Could Allow Elevation of Privilege (2695502)

The versions of InfoPath, Office SharePoint Server, SharePoint Server, Groove Server, Windows SharePoint Services, SharePoint Foundation, or Office Web Apps installed on the remote host are affected by multiple privilege escalation and information disclosure vulnerabilities : - An information...

Microsoft SharePoint Multiple Privilege Elevation Vulnerabilities (2695502)

This host is missing an important security update according to Microsoft Bulletin MS12-050. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

IE9 / SharePoint / Lync toStaticHTML HTML Sanitizing Bypass

Exploit for windows platform in category dos / poc toStaticHTML: The Second Encounter CVE-2012-1858 HTML Sanitizing Bypass - CVE-2012-1858 Original advisory -...

CVE-2012-1863

Cross-site scripting XSS vulnerability in Microsoft Office SharePoint Server 2007 SP2 and SP3 Windows SharePoint Services 3.0 SP2, and SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript elements in a URL, aka "SharePoint...

CVE-2012-1862

Open redirect vulnerability in Microsoft Office SharePoint Server 2007 SP2 and SP3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL, aka "SharePoint URL Redirection Vulnerability."...

CVE-2012-1861

Cross-site scripting XSS vulnerability in Microsoft SharePoint Server 2010 Gold and SP1, SharePoint Foundation 2010 Gold and SP1, and Office Web Apps 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript elements in a URL, aka "SharePoint Script i...

CVE-2012-1859

Cross-site scripting XSS vulnerability in scriptresx.ashx in Microsoft SharePoint Server 2010 Gold and SP1, SharePoint Foundation 2010 Gold and SP1, and Office Web Apps 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript elements in a URL, aka...