8615 matches found
Microsoft SharePoint Malformed Request Remote Code Execution (MS10-104; CVE-2010-3964)
Document Conversions Launcher Service schedules and initiates the document conversions on a server. When Microsoft Office SharePoint Server 2007 passes the service a document conversion request, the Document Conversions Launcher Service calls the appropriate document converter. A remote code...
MS Patch Tuesday Heads-Up: 17 Bulletins, 40 Vulnerabilities
Microsoft is planning another massive Patch Tuesday this month: 17 bulletins with fixes for 40 security vulnerabilities. The December batch of patches will cover security holes in Microsoft Windows, Office, Internet Explorer, SharePoint and Exchange, according to an advance notice posted Thursday...
Microsoft Releases Advance Notification for December Security Bulletin
Microsoft has issued a Security Bulletin Advance Notification indicating that its December release will contain 17 bulletins. Two of these bulletins will have a severity rating of critical and will be for Microsoft Windows and Internet Explorer. Fourteen of the bulletins will have a severity rati...
MS10-072: Vulnerabilities in SafeHTML Could Allow Information Disclosure (2412048) (remote check)
The version of SharePoint Services, SharePoint Server installed on the remote host has multiple cross-site scripting vulnerabilities. A remote attacker could exploit them by tricking a user into making a malicious request, resulting in arbitrary script code execution. %NASLMINLEVEL 70300 C Tenabl...
Microsoft Groove Server Installed
Microsoft Groove Server is installed on the remote host. This application is used to centrally manage deployments of Microsoft Office Groove and Microsoft SharePoint Workspace. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid49977; scriptversion"1.12";...
CVE-2010-3243
Cross-site scripting XSS vulnerability in the toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in Microsoft Windows SharePoint Services 3.0 SP2 and Office SharePoint Server 2007 SP2, allows remote attackers to inject arbitrary web script or HTML via unspecified...
Cross site scripting
Cross-site scripting XSS vulnerability in the toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in Microsoft Windows SharePoint Services 3.0 SP2 and Office SharePoint Server 2007 SP2, allows remote attackers to inject arbitrary web script or HTML via unspecified...
CVE-2010-3243
Cross-site scripting XSS vulnerability in the toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in Microsoft Windows SharePoint Services 3.0 SP2 and Office SharePoint Server 2007 SP2, allows remote attackers to inject arbitrary web script or HTML via unspecified...
CVE-2010-3243
Cross-site scripting XSS vulnerability in the toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in Microsoft Windows SharePoint Services 3.0 SP2 and Office SharePoint Server 2007 SP2, allows remote attackers to inject arbitrary web script or HTML via unspecified...
Microsoft Security Bulletin MS10-072 - Important Vulnerabilities in SafeHTML Could Allow Information Disclosure (2412048)
Microsoft Security Bulletin MS10-072 - Important Vulnerabilities in SafeHTML Could Allow Information Disclosure 2412048 Published: October 12, 2010 Version: 1.0 General Information Executive Summary This security update resolves one publicly disclosed vulnerability and one privately reported...
PT-2010-4679 · Microsoft · Internet Explorer +3
Name of the Vulnerable Software and Affected Versions: Microsoft Internet Explorer version 8 Microsoft Windows SharePoint Services versions 3.0 SP2 Microsoft Office SharePoint Server versions 2007 SP2 Description: The issue allows remote attackers to inject arbitrary web script or HTML via...
Microsoft Sharepoint SafeHTML crossite scripting
Few crossite scripting possibilities...
MS10-072: Vulnerabilities in SafeHTML Could Allow Information Disclosure (2412048)
The versions of SharePoint Services, SharePoint Server, Groove, or Office Web Apps installed on the remote host have multiple cross-site scripting vulnerabilities. A remote attacker could exploit them by tricking a user into making a malicious request, resulting in arbitrary script code execution...
Microsoft Internet Explorer 'toStaticHTML' HTML Sanitizing Information Disclosure Vulnerability
Description Microsoft Internet Explorer is prone to an information-disclosure vulnerability that affects the 'toStaticHTML' API. Attackers can exploit this issue to obtain sensitive information that may aid in further attacks. Technologies Affected Avaya Aura Conferencing 6.0 Standard Avaya Aura...
Microsoft Releases Advance Notification for Out-of-Band Security Bulletin
Microsoft has issued a Security Bulletin Advance Notification indicating that it will be releasing an out-of-band security bulletin to address a vulnerability affecting Windows. The Microsoft SharePoint Team blog indicates that this bulletin will address the recently reported vulnerability in...
Microsoft Releases Security Advisory 2416728
Microsoft has released a security advisory to alert users of a vulnerability affecting ASP.NET. Exploitation of this vulnerability may allow an attacker to obtain sensitive information or tamper with data. US-CERT encourages administrators to review Microsoft security advisory 2416728 and apply a...
Cross site scripting
The toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in Microsoft Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010, Office SharePoint Server 2007 SP2, Groove Server 2010, and Office Web Apps, allows remote attackers to bypass the cross-site scriptin...
CVE-2010-3324
CVE-2010-3324 describes an IE8/SharePoint CSS @import-based XSS bypass. The connected MSKB MS10-035 documents a broader cumulative security update for Internet Explorer to address IE vulnerabilities (including remote code execution via crafted pages) and provides update guidance. However, the pro...
Microsoft SharePoint Service Help.aspx 'tid' Parameter DoS
The version of Microsoft SharePoint Services running on the remote host has a denial of service vulnerability. Sending invalid data to the 'tid' parameter of 'help.aspx' can cause the application to hang. A remote attacker could exploit this by sending malicious requests, causing SharePoint to ha...
Microsoft SharePoint Services Help.aspx 'cid0' Parameter XSS
The version of Microsoft SharePoint Services running on the remote host has a cross-site scripting vulnerability. Input sent to the 'cid0' parameter of '/layouts/help.aspx' is not properly sanitized. A remote attacker could exploit this by tricking a user into making a malicious request, resultin...