CVE-2013-7332

The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service memory and CPU consumption via a crafted XML document containing a large number of nested entity...

CVE-2013-7331

The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share pathnames, intranet hostnames, and intranet IP addresses by examining error codes, as demonstrated by a res:// URL, and exploited in the wild ...

Design/Logic Flaw

The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service memory and CPU consumption via a crafted XML document containing a large number of nested entity...

CVE-2013-7331

The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share pathnames, intranet hostnames, and intranet IP addresses by examining error codes, as demonstrated by a res:// URL, and exploited in the wild ...

CVE-2013-7331

The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share pathnames, intranet hostnames, and intranet IP addresses by examining error codes, as demonstrated by a res:// URL, and exploited in the wild ...

CVE-2013-7331

CVE-2013-7331 is an information-disclosure vulnerability in the Microsoft XMLDOM ActiveX control used by Internet Explorer on Windows (XMLDOM object). The flaw allows an attacker to determine the existence of local pathnames, UNC shares, intranet hostnames, and intranet IP addresses by inspecting...

CVE-2013-7332

Technical details about CVE-2013-7332 are not provided in the connected documents. The sources mention related XML entity expansion issues (e.g., CVE-2009-2473) but no vendor/product/version specifics for this CVE.

CVE-2013-7332

The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service memory and CPU consumption via a crafted XML document containing a large number of nested entity...

Microsoft XMLDOM ActiveX控件多个信息泄露漏洞

BUGTRAQ ID: 65601 Microsoft XMLDOM ActiveX控件是运行在IE内的ActiveX控件。 Microsoft.XMLDOM ActiveX控件内的某些方法在实现上存在信息泄露漏洞，攻击者通过检查Microsoft.XMLDOM控件的错误代码，可以确定本地驱动器名、目录名、文件、内部网络地址等信息。该漏洞影响IE 6-11版本。 0 Microsoft Internet Explorer 6-11 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

[Full-disclosure] MS07-042 XMLDOM substringData() PoC

This bit of JavaScript kills IE 6 on Windows 2000 and Windows XP SP2 var xmlDoc = new ActiveXObject"Microsoft.XMLDOM"; xmlDoc.loadXML"dummy/dummy"; var txt = xmlDoc.createTextNode"huh"; var out = txt.substringData1,0x7fffffff; Installing the patch from MS07-042 fixes it. Cheers, Alla Bezroutchko...

[VulnWatch] administrivia: cross-site tracing

There's been a lot of back and forth about the recent WhiteHat Security XST bug. Sensationalism aside, the fact still remains: 1. Access to cookies, particularly the 'httponly' add-on by IE, is limited by browser security restrictions. And I don't recall any browser being able to legitimately...