Search criteria

9 vulnerabilities found for groove by microsoft

FKIE_CVE-2011-1892

Vulnerability from fkie_nvd - Published: 2011-09-15 12:26 - Updated: 2025-04-11 00:51
Severity ?
Summary
Microsoft Office Groove 2007 SP2, SharePoint Workspace 2010 Gold and SP1, Office Forms Server 2007 SP2, Office SharePoint Server 2007 SP2, Office SharePoint Server 2010 Gold and SP1, Office Groove Data Bridge Server 2007 SP2, Office Groove Management Server 2007 SP2, Groove Server 2010 Gold and SP1, Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010, and Office Web Apps 2010 Gold and SP1 do not properly handle Web Parts containing XML classes referencing external entities, which allows remote authenticated users to read arbitrary files via a crafted XML and XSL file, aka "SharePoint Remote File Disclosure Vulnerability."
References
secure@microsoft.comhttp://securityreason.com/securityalert/8386
secure@microsoft.comhttp://www.us-cert.gov/cas/techalerts/TA11-256A.htmlUS Government Resource
secure@microsoft.comhttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-074
secure@microsoft.comhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12907
af854a3a-2127-422b-91ae-364da2661108http://securityreason.com/securityalert/8386
af854a3a-2127-422b-91ae-364da2661108http://www.us-cert.gov/cas/techalerts/TA11-256A.htmlUS Government Resource
af854a3a-2127-422b-91ae-364da2661108https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-074
af854a3a-2127-422b-91ae-364da2661108https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12907
Impacted products
Vendor Product Version
microsoft forms_server 2007
microsoft forms_server 2007
microsoft groove 2007
microsoft groove_data_bridge_server 2007
microsoft groove_management_server 2007
microsoft groove_server 2010
microsoft groove_server 2010
microsoft office_web_apps 2010
microsoft office_web_apps 2010
microsoft sharepoint_foundation 2010
microsoft sharepoint_server 2007
microsoft sharepoint_server 2007
microsoft sharepoint_server 2010
microsoft sharepoint_server 2010
microsoft sharepoint_services 3.0
microsoft sharepoint_services 3.0
microsoft sharepoint_workspace 2010
microsoft sharepoint_workspace 2010
microsoft sharepoint_workspace 2010
microsoft sharepoint_workspace 2010
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:forms_server:2007:sp2:x32:*:*:*:*:*",
              "matchCriteriaId": "0C8A6067-88D9-4662-8F79-B7737B6AD910",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:forms_server:2007:sp2:x64:*:*:*:*:*",
              "matchCriteriaId": "99B29AFF-EBDC-4C1B-BDBD-F9A4CA724F8D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:groove:2007:sp2:*:*:*:*:*:*",
              "matchCriteriaId": "5075B5F5-5018-4DEF-B77D-E75C09CB3DF3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:groove_data_bridge_server:2007:sp2:*:*:*:*:*:*",
              "matchCriteriaId": "BE6FAE49-E7E6-4996-9369-4F56E11DAD96",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:groove_management_server:2007:sp2:*:*:*:*:*:*",
              "matchCriteriaId": "489C0AC9-A6BE-4473-A3FD-35119E8C1FAA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:groove_server:2010:*:*:*:*:*:*:*",
              "matchCriteriaId": "47B43F05-40AE-4D98-8B5D-A06BF10FE337",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:groove_server:2010:sp1:*:*:*:*:*:*",
              "matchCriteriaId": "8B95E5BF-DD0E-4FD4-8462-3E3727B81B56",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office_web_apps:2010:*:*:*:*:*:*:*",
              "matchCriteriaId": "FEAB1E34-AAEE-4C01-8FA8-6099A74F0731",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office_web_apps:2010:sp1:*:*:*:*:*:*",
              "matchCriteriaId": "343EEB54-C1B1-4D7B-8780-5B5A5F2F840C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:sharepoint_foundation:2010:*:*:*:*:*:*:*",
              "matchCriteriaId": "35DF86AB-DCB4-496C-84EF-720E90BFA368",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:sharepoint_server:2007:sp2:x32:*:*:*:*:*",
              "matchCriteriaId": "586E6C37-346C-40BA-AC89-2CEB8C44E190",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:sharepoint_server:2007:sp2:x64:*:*:*:*:*",
              "matchCriteriaId": "48EB5C93-55BF-4608-A9DC-EDD8DE15EE44",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:sharepoint_server:2010:*:*:*:*:*:*:*",
              "matchCriteriaId": "DCBCB0A0-BC40-4E6B-BD06-A137BB964B7F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:sharepoint_server:2010:sp1:*:*:*:*:*:*",
              "matchCriteriaId": "6FA65D4A-00C8-47E2-AF9F-6B420017CD29",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:sharepoint_services:3.0:sp2:x32:*:*:*:*:*",
              "matchCriteriaId": "CF40F903-0026-4673-89A3-6F889D877E2F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:sharepoint_services:3.0:sp2:x64:*:*:*:*:*",
              "matchCriteriaId": "376C9A84-74B1-4717-B88E-153ADD7D686D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:sharepoint_workspace:2010:*:x32:*:*:*:*:*",
              "matchCriteriaId": "B111D9E7-03E7-4909-B620-6E656CC3DEB7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:sharepoint_workspace:2010:*:x64:*:*:*:*:*",
              "matchCriteriaId": "B92DB5CC-A9C9-4D6E-859E-A18EB38323AB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:sharepoint_workspace:2010:sp1:x32:*:*:*:*:*",
              "matchCriteriaId": "7AC3C326-F415-4D98-9EB4-13CE30D0C6BE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:sharepoint_workspace:2010:sp1:x64:*:*:*:*:*",
              "matchCriteriaId": "FF58F296-B8C8-4C57-A4B5-357BC4CC4CF6",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Microsoft Office Groove 2007 SP2, SharePoint Workspace 2010 Gold and SP1, Office Forms Server 2007 SP2, Office SharePoint Server 2007 SP2, Office SharePoint Server 2010 Gold and SP1, Office Groove Data Bridge Server 2007 SP2, Office Groove Management Server 2007 SP2, Groove Server 2010 Gold and SP1, Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010, and Office Web Apps 2010 Gold and SP1 do not properly handle Web Parts containing XML classes referencing external entities, which allows remote authenticated users to read arbitrary files via a crafted XML and XSL file, aka \"SharePoint Remote File Disclosure Vulnerability.\""
    },
    {
      "lang": "es",
      "value": "Microsoft Office Groove 2007 Service Pack 2, SharePoint Workspace 2010 Gold y SP1, Office Forms Server 2007 SP2, Office SharePoint Server 2007 SP2, Office SharePoint Server 2010 Gold y SP1, Office Groove Data Bridge Server 2007 SP2, Office Groove Management Server 2007 SP2, Groove Server 2010 Gold y SP1, Windows SharePoint Services 3.0 SP2, Windows SharePoint 2010 y Office Web Aplicaciones 2010 Gold y SP1 no gestionan correctamente las partes web que contienen clases XML que referencian a entidades externas, lo que permite a usuarios remotos autenticados leer ficheros de su elecci\u00f3n a trav\u00e9s de un archivo XML o XSL debidamente modificados. Es un problema tambi\u00e9n conocido como \"Vulnerabilidad de revelado de fichero remoto de Sharepoint.\""
    }
  ],
  "id": "CVE-2011-1892",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 4.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2011-09-15T12:26:48.647",
  "references": [
    {
      "source": "secure@microsoft.com",
      "url": "http://securityreason.com/securityalert/8386"
    },
    {
      "source": "secure@microsoft.com",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/cas/techalerts/TA11-256A.html"
    },
    {
      "source": "secure@microsoft.com",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-074"
    },
    {
      "source": "secure@microsoft.com",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12907"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securityreason.com/securityalert/8386"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/cas/techalerts/TA11-256A.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-074"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12907"
    }
  ],
  "sourceIdentifier": "secure@microsoft.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2010-3146

Vulnerability from fkie_nvd - Published: 2010-08-27 19:00 - Updated: 2025-04-11 00:51
Severity ?
Summary
Multiple untrusted search path vulnerabilities in Microsoft Groove 2007 SP2 allow local users to gain privileges via a Trojan horse (1) mso.dll or (2) GroovePerfmon.dll file in the current working directory, as demonstrated by a directory that contains a Groove vCard (.vcg) or Groove Tool Archive (.gta) file, aka "Microsoft Groove Insecure Library Loading Vulnerability."
References
cve@mitre.orghttp://www.exploit-db.com/exploits/14746/Exploit
cve@mitre.orghttp://www.us-cert.gov/cas/techalerts/TA11-067A.htmlUS Government Resource
cve@mitre.orghttp://www.vupen.com/english/advisories/2010/2188Vendor Advisory
cve@mitre.orghttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-016
cve@mitre.orghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12632
af854a3a-2127-422b-91ae-364da2661108http://www.exploit-db.com/exploits/14746/Exploit
af854a3a-2127-422b-91ae-364da2661108http://www.us-cert.gov/cas/techalerts/TA11-067A.htmlUS Government Resource
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2010/2188Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-016
af854a3a-2127-422b-91ae-364da2661108https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12632
Impacted products
Vendor Product Version
microsoft groove 2007
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:groove:2007:sp2:*:*:*:*:*:*",
              "matchCriteriaId": "5075B5F5-5018-4DEF-B77D-E75C09CB3DF3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple untrusted search path vulnerabilities in Microsoft Groove 2007 SP2 allow local users to gain privileges via a Trojan horse (1) mso.dll or (2) GroovePerfmon.dll file in the current working directory, as demonstrated by a directory that contains a Groove vCard (.vcg) or Groove Tool Archive (.gta) file, aka \"Microsoft Groove Insecure Library Loading Vulnerability.\""
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades de ruta (path) de b\u00fasqueda no confiables en Groove 2007 versi\u00f3n SP2, de Microsoft, permiten a los usuarios locales alcanzar privilegios por medio de los archivos de tipo caballo de Troya (1) mso.dll o (2) GroovePerfmon.dll en el directorio de trabajo actual, como es demostrado por un directorio que contiene una Groove vCard (.vcg) o archivo Groove Tool Archive (.gta), tambi\u00e9n se conoce como \"Microsoft Groove Insecure Library Loading Vulnerability.\""
    }
  ],
  "evaluatorComment": "Per: http://cwe.mitre.org/data/definitions/426.html \r\n\u0027CWE-426: Untrusted Search Path\u0027",
  "evaluatorImpact": "Per: https://technet.microsoft.com/en-us/security/bulletin/ms11-016 Access Vector: Network per \"This is a remote code execution vulnerability\"",
  "id": "CVE-2010-3146",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.3,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2010-08-27T19:00:02.287",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.exploit-db.com/exploits/14746/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/cas/techalerts/TA11-067A.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2010/2188"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-016"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12632"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.exploit-db.com/exploits/14746/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/cas/techalerts/TA11-067A.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2010/2188"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-016"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12632"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2008-3068

Vulnerability from fkie_nvd - Published: 2008-07-07 23:41 - Updated: 2025-04-09 00:30
Severity ?
Summary
Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by using an arbitrary URL from a certificate embedded in a (1) S/MIME e-mail message or (2) signed document, which allows remote attackers to obtain reading times and IP addresses of recipients, and port-scan results, via a crafted certificate with an Authority Information Access (AIA) extension.
References
cve@mitre.orghttp://securityreason.com/securityalert/3978
cve@mitre.orghttp://www.securityfocus.com/archive/1/493947/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/archive/1/494101/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/28548
cve@mitre.orghttp://www.securitytracker.com/id?1019736
cve@mitre.orghttp://www.securitytracker.com/id?1019737
cve@mitre.orghttp://www.securitytracker.com/id?1019738
cve@mitre.orghttps://www.cynops.de/advisories/AKLINK-SA-2008-002.txt
cve@mitre.orghttps://www.cynops.de/advisories/AKLINK-SA-2008-003.txt
cve@mitre.orghttps://www.cynops.de/advisories/AKLINK-SA-2008-004.txt
cve@mitre.orghttps://www.cynops.de/techzone/http_over_x509.html
cve@mitre.orghttps://www.klink.name/security/aklink-sa-2008-002-outlook-smime.txt
cve@mitre.orghttps://www.klink.name/security/aklink-sa-2008-003-live-mail-smime.txt
cve@mitre.orghttps://www.klink.name/security/aklink-sa-2008-004-office2007-signatures.txt
af854a3a-2127-422b-91ae-364da2661108http://securityreason.com/securityalert/3978
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/493947/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/494101/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/28548
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id?1019736
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id?1019737
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id?1019738
af854a3a-2127-422b-91ae-364da2661108https://www.cynops.de/advisories/AKLINK-SA-2008-002.txt
af854a3a-2127-422b-91ae-364da2661108https://www.cynops.de/advisories/AKLINK-SA-2008-003.txt
af854a3a-2127-422b-91ae-364da2661108https://www.cynops.de/advisories/AKLINK-SA-2008-004.txt
af854a3a-2127-422b-91ae-364da2661108https://www.cynops.de/techzone/http_over_x509.html
af854a3a-2127-422b-91ae-364da2661108https://www.klink.name/security/aklink-sa-2008-002-outlook-smime.txt
af854a3a-2127-422b-91ae-364da2661108https://www.klink.name/security/aklink-sa-2008-003-live-mail-smime.txt
af854a3a-2127-422b-91ae-364da2661108https://www.klink.name/security/aklink-sa-2008-004-office2007-signatures.txt
Impacted products
Vendor Product Version
microsoft access 2007
microsoft excel 2003
microsoft excel 2007
microsoft frontpage 2003
microsoft groove 2007
microsoft infopath 2003
microsoft infopath 2007
microsoft office 2007
microsoft office 2007
microsoft office_communicator 2007
microsoft onenote 2003
microsoft outlook 2003
microsoft outlook 2007
microsoft powerpoint 2003
microsoft powerpoint 2007
microsoft project_professional 2007
microsoft project_standard 2007
microsoft publisher 2003
microsoft publisher 2007
microsoft sharepoint_designer 2007
microsoft visio_professional 2007
microsoft visio_standard 2007
microsoft windows_live_mail 2008
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:access:2007:*:*:*:*:*:*:*",
              "matchCriteriaId": "1B4D3093-F17C-4BCF-8F4A-F15057C55F82",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:excel:2003:*:*:*:*:*:*:*",
              "matchCriteriaId": "5F79E0AB-7081-4F97-BFE4-9AF84F643B9A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:excel:2007:*:*:*:*:*:*:*",
              "matchCriteriaId": "5A70D659-F648-4870-852A-4E86D1F4B646",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:frontpage:2003:*:*:*:*:*:*:*",
              "matchCriteriaId": "3C79FEE1-70A3-4A48-BE7B-0D18F0A5FA7F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:groove:2007:*:*:*:*:*:*:*",
              "matchCriteriaId": "355F60DB-EC9A-4054-8023-BD16D5723C9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:infopath:2003:*:*:*:*:*:*:*",
              "matchCriteriaId": "345BC07E-1558-4C27-BF1A-C13547D175FC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:infopath:2007:*:*:*:*:*:*:*",
              "matchCriteriaId": "A007966C-7620-4625-AD2B-6A147577EB54",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2007:*:*:*:*:*:*:*",
              "matchCriteriaId": "828219FA-E694-46DA-93B0-BE2EC5BBF61E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2007:sp1:*:*:*:*:*:*",
              "matchCriteriaId": "69E6B9EB-D3F7-4C57-BF2F-61664E5C2C7D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office_communicator:2007:*:*:*:*:*:*:*",
              "matchCriteriaId": "61116145-828F-479D-9267-76BAB633B23E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:onenote:2003:*:*:*:*:*:*:*",
              "matchCriteriaId": "36BA88A3-A31F-4F90-8913-67D5BC00E72D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:outlook:2003:*:*:*:*:*:*:*",
              "matchCriteriaId": "C3189982-F780-4AC2-9663-E6D4DF9DD319",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:outlook:2007:*:*:*:*:*:*:*",
              "matchCriteriaId": "D789259A-034E-40BB-9DFF-76B3104B212F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:powerpoint:2003:*:*:*:*:*:*:*",
              "matchCriteriaId": "F5611EFD-2C7C-47BA-83E5-947EA00D8E6C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:powerpoint:2007:*:*:*:*:*:*:*",
              "matchCriteriaId": "A947639C-B1D3-4297-B4BB-AD799C979BE4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:project_professional:2007:*:*:*:*:*:*:*",
              "matchCriteriaId": "1C58C5D7-B6F0-4C95-A305-ED37629E2A5A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:project_standard:2007:*:*:*:*:*:*:*",
              "matchCriteriaId": "E8D468F3-894D-409E-A7CE-EAA5919362E9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:publisher:2003:*:*:*:*:*:*:*",
              "matchCriteriaId": "617E8BE3-8AD0-42FC-BDEE-6B1F120AE512",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:publisher:2007:*:*:*:*:*:*:*",
              "matchCriteriaId": "190A4DF4-EA93-4E18-BA96-7A7AC48831F0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:sharepoint_designer:2007:*:*:*:*:*:*:*",
              "matchCriteriaId": "7E057F77-9197-4BC9-A0A1-A71850F59D70",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:visio_professional:2007:*:*:*:*:*:*:*",
              "matchCriteriaId": "F9A72192-B10A-4E42-AE68-FE1CB8DA573F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:visio_standard:2007:*:*:*:*:*:*:*",
              "matchCriteriaId": "9D837BA2-BAC0-4B72-A1DD-CB4A1CA5A347",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:windows_live_mail:2008:*:*:*:*:*:*:*",
              "matchCriteriaId": "AD3CA537-AAF9-4356-AE7E-0AC14E5AFADF",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by using an arbitrary URL from a certificate embedded in a (1) S/MIME e-mail message or (2) signed document, which allows remote attackers to obtain reading times and IP addresses of recipients, and port-scan results, via a crafted certificate with an Authority Information Access (AIA) extension."
    },
    {
      "lang": "es",
      "value": "Microsoft Crypto API 5.131.2600.2180 hasta la 6.0, como las usadas en Outlook, Windows Live Mail, y Office 2007, realiza una lista de revocaci\u00f3n de certificado (CRL) utilizando una URL arbitraria de un certificado incluido en (1) mensaje de correo electr\u00f3nico S/MIME o (2) documento firmado, lo que permite a atacantes remotos conseguir tiempos de lectura  y direcciones IP de recipientes, y resultados de escaneo de puerto, a trav\u00e9s de \r\nun certificado manipulado con una extensi\u00f3n de de una Authority Information Access (AIA).\r\n"
    }
  ],
  "id": "CVE-2008-3068",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": true,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2008-07-07T23:41:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://securityreason.com/securityalert/3978"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/493947/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/494101/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/28548"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securitytracker.com/id?1019736"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securitytracker.com/id?1019737"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securitytracker.com/id?1019738"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.cynops.de/advisories/AKLINK-SA-2008-002.txt"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.cynops.de/advisories/AKLINK-SA-2008-003.txt"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.cynops.de/advisories/AKLINK-SA-2008-004.txt"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.cynops.de/techzone/http_over_x509.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.klink.name/security/aklink-sa-2008-002-outlook-smime.txt"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.klink.name/security/aklink-sa-2008-003-live-mail-smime.txt"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.klink.name/security/aklink-sa-2008-004-office2007-signatures.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securityreason.com/securityalert/3978"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/493947/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/494101/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/28548"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id?1019736"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id?1019737"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id?1019738"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.cynops.de/advisories/AKLINK-SA-2008-002.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.cynops.de/advisories/AKLINK-SA-2008-003.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.cynops.de/advisories/AKLINK-SA-2008-004.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.cynops.de/techzone/http_over_x509.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.klink.name/security/aklink-sa-2008-002-outlook-smime.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.klink.name/security/aklink-sa-2008-003-live-mail-smime.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.klink.name/security/aklink-sa-2008-004-office2007-signatures.txt"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2011-1892 (GCVE-0-2011-1892)

Vulnerability from cvelistv5 – Published: 2011-09-15 10:00 – Updated: 2024-08-06 22:46
VLAI?
Summary
Microsoft Office Groove 2007 SP2, SharePoint Workspace 2010 Gold and SP1, Office Forms Server 2007 SP2, Office SharePoint Server 2007 SP2, Office SharePoint Server 2010 Gold and SP1, Office Groove Data Bridge Server 2007 SP2, Office Groove Management Server 2007 SP2, Groove Server 2010 Gold and SP1, Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010, and Office Web Apps 2010 Gold and SP1 do not properly handle Web Parts containing XML classes referencing external entities, which allows remote authenticated users to read arbitrary files via a crafted XML and XSL file, aka "SharePoint Remote File Disclosure Vulnerability."
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
https://docs.microsoft.com/en-us/security-updates… vendor-advisoryx_refsource_MS
http://securityreason.com/securityalert/8386 third-party-advisoryx_refsource_SREASON
http://www.us-cert.gov/cas/techalerts/TA11-256A.html third-party-advisoryx_refsource_CERT
https://oval.cisecurity.org/repository/search/def… vdb-entrysignaturex_refsource_OVAL
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T22:46:00.763Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "MS11-074",
            "tags": [
              "vendor-advisory",
              "x_refsource_MS",
              "x_transferred"
            ],
            "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-074"
          },
          {
            "name": "8386",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/8386"
          },
          {
            "name": "TA11-256A",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA11-256A.html"
          },
          {
            "name": "oval:org.mitre.oval:def:12907",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12907"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-09-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Microsoft Office Groove 2007 SP2, SharePoint Workspace 2010 Gold and SP1, Office Forms Server 2007 SP2, Office SharePoint Server 2007 SP2, Office SharePoint Server 2010 Gold and SP1, Office Groove Data Bridge Server 2007 SP2, Office Groove Management Server 2007 SP2, Groove Server 2010 Gold and SP1, Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010, and Office Web Apps 2010 Gold and SP1 do not properly handle Web Parts containing XML classes referencing external entities, which allows remote authenticated users to read arbitrary files via a crafted XML and XSL file, aka \"SharePoint Remote File Disclosure Vulnerability.\""
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-12T19:57:01",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "MS11-074",
          "tags": [
            "vendor-advisory",
            "x_refsource_MS"
          ],
          "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-074"
        },
        {
          "name": "8386",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/8386"
        },
        {
          "name": "TA11-256A",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/cas/techalerts/TA11-256A.html"
        },
        {
          "name": "oval:org.mitre.oval:def:12907",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12907"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@microsoft.com",
          "ID": "CVE-2011-1892",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Microsoft Office Groove 2007 SP2, SharePoint Workspace 2010 Gold and SP1, Office Forms Server 2007 SP2, Office SharePoint Server 2007 SP2, Office SharePoint Server 2010 Gold and SP1, Office Groove Data Bridge Server 2007 SP2, Office Groove Management Server 2007 SP2, Groove Server 2010 Gold and SP1, Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010, and Office Web Apps 2010 Gold and SP1 do not properly handle Web Parts containing XML classes referencing external entities, which allows remote authenticated users to read arbitrary files via a crafted XML and XSL file, aka \"SharePoint Remote File Disclosure Vulnerability.\""
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "MS11-074",
              "refsource": "MS",
              "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-074"
            },
            {
              "name": "8386",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/8386"
            },
            {
              "name": "TA11-256A",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/cas/techalerts/TA11-256A.html"
            },
            {
              "name": "oval:org.mitre.oval:def:12907",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12907"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2011-1892",
    "datePublished": "2011-09-15T10:00:00",
    "dateReserved": "2011-05-04T00:00:00",
    "dateUpdated": "2024-08-06T22:46:00.763Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2010-3146 (GCVE-0-2010-3146)

Vulnerability from cvelistv5 – Published: 2010-08-27 18:10 – Updated: 2024-08-07 02:55
VLAI?
Summary
Multiple untrusted search path vulnerabilities in Microsoft Groove 2007 SP2 allow local users to gain privileges via a Trojan horse (1) mso.dll or (2) GroovePerfmon.dll file in the current working directory, as demonstrated by a directory that contains a Groove vCard (.vcg) or Groove Tool Archive (.gta) file, aka "Microsoft Groove Insecure Library Loading Vulnerability."
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://www.vupen.com/english/advisories/2010/2188 vdb-entryx_refsource_VUPEN
http://www.exploit-db.com/exploits/14746/ exploitx_refsource_EXPLOIT-DB
http://www.us-cert.gov/cas/techalerts/TA11-067A.html third-party-advisoryx_refsource_CERT
https://docs.microsoft.com/en-us/security-updates… vendor-advisoryx_refsource_MS
https://oval.cisecurity.org/repository/search/def… vdb-entrysignaturex_refsource_OVAL
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T02:55:46.865Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "ADV-2010-2188",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2010/2188"
          },
          {
            "name": "14746",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "http://www.exploit-db.com/exploits/14746/"
          },
          {
            "name": "TA11-067A",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA11-067A.html"
          },
          {
            "name": "MS11-016",
            "tags": [
              "vendor-advisory",
              "x_refsource_MS",
              "x_transferred"
            ],
            "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-016"
          },
          {
            "name": "oval:org.mitre.oval:def:12632",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12632"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2010-08-25T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple untrusted search path vulnerabilities in Microsoft Groove 2007 SP2 allow local users to gain privileges via a Trojan horse (1) mso.dll or (2) GroovePerfmon.dll file in the current working directory, as demonstrated by a directory that contains a Groove vCard (.vcg) or Groove Tool Archive (.gta) file, aka \"Microsoft Groove Insecure Library Loading Vulnerability.\""
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-12T19:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "ADV-2010-2188",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2010/2188"
        },
        {
          "name": "14746",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "http://www.exploit-db.com/exploits/14746/"
        },
        {
          "name": "TA11-067A",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/cas/techalerts/TA11-067A.html"
        },
        {
          "name": "MS11-016",
          "tags": [
            "vendor-advisory",
            "x_refsource_MS"
          ],
          "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-016"
        },
        {
          "name": "oval:org.mitre.oval:def:12632",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12632"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2010-3146",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple untrusted search path vulnerabilities in Microsoft Groove 2007 SP2 allow local users to gain privileges via a Trojan horse (1) mso.dll or (2) GroovePerfmon.dll file in the current working directory, as demonstrated by a directory that contains a Groove vCard (.vcg) or Groove Tool Archive (.gta) file, aka \"Microsoft Groove Insecure Library Loading Vulnerability.\""
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "ADV-2010-2188",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2010/2188"
            },
            {
              "name": "14746",
              "refsource": "EXPLOIT-DB",
              "url": "http://www.exploit-db.com/exploits/14746/"
            },
            {
              "name": "TA11-067A",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/cas/techalerts/TA11-067A.html"
            },
            {
              "name": "MS11-016",
              "refsource": "MS",
              "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-016"
            },
            {
              "name": "oval:org.mitre.oval:def:12632",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12632"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2010-3146",
    "datePublished": "2010-08-27T18:10:00",
    "dateReserved": "2010-08-27T00:00:00",
    "dateUpdated": "2024-08-07T02:55:46.865Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2008-3068 (GCVE-0-2008-3068)

Vulnerability from cvelistv5 – Published: 2008-07-07 23:00 – Updated: 2024-08-07 09:21
VLAI?
Summary
Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by using an arbitrary URL from a certificate embedded in a (1) S/MIME e-mail message or (2) signed document, which allows remote attackers to obtain reading times and IP addresses of recipients, and port-scan results, via a crafted certificate with an Authority Information Access (AIA) extension.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T09:21:34.955Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.cynops.de/advisories/AKLINK-SA-2008-003.txt"
          },
          {
            "name": "3978",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/3978"
          },
          {
            "name": "20080709 Re: Unauthorized reading confirmation from Outlook",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/494101/100/0/threaded"
          },
          {
            "name": "28548",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/28548"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.klink.name/security/aklink-sa-2008-004-office2007-signatures.txt"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.cynops.de/advisories/AKLINK-SA-2008-002.txt"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.cynops.de/advisories/AKLINK-SA-2008-004.txt"
          },
          {
            "name": "1019736",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1019736"
          },
          {
            "name": "1019738",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1019738"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.klink.name/security/aklink-sa-2008-003-live-mail-smime.txt"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.klink.name/security/aklink-sa-2008-002-outlook-smime.txt"
          },
          {
            "name": "1019737",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1019737"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.cynops.de/techzone/http_over_x509.html"
          },
          {
            "name": "20080703 Unauthorized reading confirmation from Outlook",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/493947/100/0/threaded"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-07-03T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by using an arbitrary URL from a certificate embedded in a (1) S/MIME e-mail message or (2) signed document, which allows remote attackers to obtain reading times and IP addresses of recipients, and port-scan results, via a crafted certificate with an Authority Information Access (AIA) extension."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-11T19:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.cynops.de/advisories/AKLINK-SA-2008-003.txt"
        },
        {
          "name": "3978",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/3978"
        },
        {
          "name": "20080709 Re: Unauthorized reading confirmation from Outlook",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/494101/100/0/threaded"
        },
        {
          "name": "28548",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/28548"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.klink.name/security/aklink-sa-2008-004-office2007-signatures.txt"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.cynops.de/advisories/AKLINK-SA-2008-002.txt"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.cynops.de/advisories/AKLINK-SA-2008-004.txt"
        },
        {
          "name": "1019736",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1019736"
        },
        {
          "name": "1019738",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1019738"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.klink.name/security/aklink-sa-2008-003-live-mail-smime.txt"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.klink.name/security/aklink-sa-2008-002-outlook-smime.txt"
        },
        {
          "name": "1019737",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1019737"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.cynops.de/techzone/http_over_x509.html"
        },
        {
          "name": "20080703 Unauthorized reading confirmation from Outlook",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/493947/100/0/threaded"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-3068",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by using an arbitrary URL from a certificate embedded in a (1) S/MIME e-mail message or (2) signed document, which allows remote attackers to obtain reading times and IP addresses of recipients, and port-scan results, via a crafted certificate with an Authority Information Access (AIA) extension."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.cynops.de/advisories/AKLINK-SA-2008-003.txt",
              "refsource": "MISC",
              "url": "https://www.cynops.de/advisories/AKLINK-SA-2008-003.txt"
            },
            {
              "name": "3978",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/3978"
            },
            {
              "name": "20080709 Re: Unauthorized reading confirmation from Outlook",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/494101/100/0/threaded"
            },
            {
              "name": "28548",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/28548"
            },
            {
              "name": "https://www.klink.name/security/aklink-sa-2008-004-office2007-signatures.txt",
              "refsource": "MISC",
              "url": "https://www.klink.name/security/aklink-sa-2008-004-office2007-signatures.txt"
            },
            {
              "name": "https://www.cynops.de/advisories/AKLINK-SA-2008-002.txt",
              "refsource": "MISC",
              "url": "https://www.cynops.de/advisories/AKLINK-SA-2008-002.txt"
            },
            {
              "name": "https://www.cynops.de/advisories/AKLINK-SA-2008-004.txt",
              "refsource": "MISC",
              "url": "https://www.cynops.de/advisories/AKLINK-SA-2008-004.txt"
            },
            {
              "name": "1019736",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1019736"
            },
            {
              "name": "1019738",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1019738"
            },
            {
              "name": "https://www.klink.name/security/aklink-sa-2008-003-live-mail-smime.txt",
              "refsource": "MISC",
              "url": "https://www.klink.name/security/aklink-sa-2008-003-live-mail-smime.txt"
            },
            {
              "name": "https://www.klink.name/security/aklink-sa-2008-002-outlook-smime.txt",
              "refsource": "MISC",
              "url": "https://www.klink.name/security/aklink-sa-2008-002-outlook-smime.txt"
            },
            {
              "name": "1019737",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1019737"
            },
            {
              "name": "https://www.cynops.de/techzone/http_over_x509.html",
              "refsource": "MISC",
              "url": "https://www.cynops.de/techzone/http_over_x509.html"
            },
            {
              "name": "20080703 Unauthorized reading confirmation from Outlook",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/493947/100/0/threaded"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-3068",
    "datePublished": "2008-07-07T23:00:00",
    "dateReserved": "2008-07-07T00:00:00",
    "dateUpdated": "2024-08-07T09:21:34.955Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2011-1892 (GCVE-0-2011-1892)

Vulnerability from nvd – Published: 2011-09-15 10:00 – Updated: 2024-08-06 22:46
VLAI?
Summary
Microsoft Office Groove 2007 SP2, SharePoint Workspace 2010 Gold and SP1, Office Forms Server 2007 SP2, Office SharePoint Server 2007 SP2, Office SharePoint Server 2010 Gold and SP1, Office Groove Data Bridge Server 2007 SP2, Office Groove Management Server 2007 SP2, Groove Server 2010 Gold and SP1, Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010, and Office Web Apps 2010 Gold and SP1 do not properly handle Web Parts containing XML classes referencing external entities, which allows remote authenticated users to read arbitrary files via a crafted XML and XSL file, aka "SharePoint Remote File Disclosure Vulnerability."
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
https://docs.microsoft.com/en-us/security-updates… vendor-advisoryx_refsource_MS
http://securityreason.com/securityalert/8386 third-party-advisoryx_refsource_SREASON
http://www.us-cert.gov/cas/techalerts/TA11-256A.html third-party-advisoryx_refsource_CERT
https://oval.cisecurity.org/repository/search/def… vdb-entrysignaturex_refsource_OVAL
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T22:46:00.763Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "MS11-074",
            "tags": [
              "vendor-advisory",
              "x_refsource_MS",
              "x_transferred"
            ],
            "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-074"
          },
          {
            "name": "8386",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/8386"
          },
          {
            "name": "TA11-256A",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA11-256A.html"
          },
          {
            "name": "oval:org.mitre.oval:def:12907",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12907"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-09-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Microsoft Office Groove 2007 SP2, SharePoint Workspace 2010 Gold and SP1, Office Forms Server 2007 SP2, Office SharePoint Server 2007 SP2, Office SharePoint Server 2010 Gold and SP1, Office Groove Data Bridge Server 2007 SP2, Office Groove Management Server 2007 SP2, Groove Server 2010 Gold and SP1, Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010, and Office Web Apps 2010 Gold and SP1 do not properly handle Web Parts containing XML classes referencing external entities, which allows remote authenticated users to read arbitrary files via a crafted XML and XSL file, aka \"SharePoint Remote File Disclosure Vulnerability.\""
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-12T19:57:01",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "MS11-074",
          "tags": [
            "vendor-advisory",
            "x_refsource_MS"
          ],
          "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-074"
        },
        {
          "name": "8386",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/8386"
        },
        {
          "name": "TA11-256A",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/cas/techalerts/TA11-256A.html"
        },
        {
          "name": "oval:org.mitre.oval:def:12907",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12907"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@microsoft.com",
          "ID": "CVE-2011-1892",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Microsoft Office Groove 2007 SP2, SharePoint Workspace 2010 Gold and SP1, Office Forms Server 2007 SP2, Office SharePoint Server 2007 SP2, Office SharePoint Server 2010 Gold and SP1, Office Groove Data Bridge Server 2007 SP2, Office Groove Management Server 2007 SP2, Groove Server 2010 Gold and SP1, Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010, and Office Web Apps 2010 Gold and SP1 do not properly handle Web Parts containing XML classes referencing external entities, which allows remote authenticated users to read arbitrary files via a crafted XML and XSL file, aka \"SharePoint Remote File Disclosure Vulnerability.\""
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "MS11-074",
              "refsource": "MS",
              "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-074"
            },
            {
              "name": "8386",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/8386"
            },
            {
              "name": "TA11-256A",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/cas/techalerts/TA11-256A.html"
            },
            {
              "name": "oval:org.mitre.oval:def:12907",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12907"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2011-1892",
    "datePublished": "2011-09-15T10:00:00",
    "dateReserved": "2011-05-04T00:00:00",
    "dateUpdated": "2024-08-06T22:46:00.763Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2010-3146 (GCVE-0-2010-3146)

Vulnerability from nvd – Published: 2010-08-27 18:10 – Updated: 2024-08-07 02:55
VLAI?
Summary
Multiple untrusted search path vulnerabilities in Microsoft Groove 2007 SP2 allow local users to gain privileges via a Trojan horse (1) mso.dll or (2) GroovePerfmon.dll file in the current working directory, as demonstrated by a directory that contains a Groove vCard (.vcg) or Groove Tool Archive (.gta) file, aka "Microsoft Groove Insecure Library Loading Vulnerability."
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://www.vupen.com/english/advisories/2010/2188 vdb-entryx_refsource_VUPEN
http://www.exploit-db.com/exploits/14746/ exploitx_refsource_EXPLOIT-DB
http://www.us-cert.gov/cas/techalerts/TA11-067A.html third-party-advisoryx_refsource_CERT
https://docs.microsoft.com/en-us/security-updates… vendor-advisoryx_refsource_MS
https://oval.cisecurity.org/repository/search/def… vdb-entrysignaturex_refsource_OVAL
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T02:55:46.865Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "ADV-2010-2188",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2010/2188"
          },
          {
            "name": "14746",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "http://www.exploit-db.com/exploits/14746/"
          },
          {
            "name": "TA11-067A",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA11-067A.html"
          },
          {
            "name": "MS11-016",
            "tags": [
              "vendor-advisory",
              "x_refsource_MS",
              "x_transferred"
            ],
            "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-016"
          },
          {
            "name": "oval:org.mitre.oval:def:12632",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12632"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2010-08-25T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple untrusted search path vulnerabilities in Microsoft Groove 2007 SP2 allow local users to gain privileges via a Trojan horse (1) mso.dll or (2) GroovePerfmon.dll file in the current working directory, as demonstrated by a directory that contains a Groove vCard (.vcg) or Groove Tool Archive (.gta) file, aka \"Microsoft Groove Insecure Library Loading Vulnerability.\""
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-12T19:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "ADV-2010-2188",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2010/2188"
        },
        {
          "name": "14746",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "http://www.exploit-db.com/exploits/14746/"
        },
        {
          "name": "TA11-067A",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/cas/techalerts/TA11-067A.html"
        },
        {
          "name": "MS11-016",
          "tags": [
            "vendor-advisory",
            "x_refsource_MS"
          ],
          "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-016"
        },
        {
          "name": "oval:org.mitre.oval:def:12632",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12632"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2010-3146",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple untrusted search path vulnerabilities in Microsoft Groove 2007 SP2 allow local users to gain privileges via a Trojan horse (1) mso.dll or (2) GroovePerfmon.dll file in the current working directory, as demonstrated by a directory that contains a Groove vCard (.vcg) or Groove Tool Archive (.gta) file, aka \"Microsoft Groove Insecure Library Loading Vulnerability.\""
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "ADV-2010-2188",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2010/2188"
            },
            {
              "name": "14746",
              "refsource": "EXPLOIT-DB",
              "url": "http://www.exploit-db.com/exploits/14746/"
            },
            {
              "name": "TA11-067A",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/cas/techalerts/TA11-067A.html"
            },
            {
              "name": "MS11-016",
              "refsource": "MS",
              "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-016"
            },
            {
              "name": "oval:org.mitre.oval:def:12632",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12632"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2010-3146",
    "datePublished": "2010-08-27T18:10:00",
    "dateReserved": "2010-08-27T00:00:00",
    "dateUpdated": "2024-08-07T02:55:46.865Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2008-3068 (GCVE-0-2008-3068)

Vulnerability from nvd – Published: 2008-07-07 23:00 – Updated: 2024-08-07 09:21
VLAI?
Summary
Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by using an arbitrary URL from a certificate embedded in a (1) S/MIME e-mail message or (2) signed document, which allows remote attackers to obtain reading times and IP addresses of recipients, and port-scan results, via a crafted certificate with an Authority Information Access (AIA) extension.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T09:21:34.955Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.cynops.de/advisories/AKLINK-SA-2008-003.txt"
          },
          {
            "name": "3978",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/3978"
          },
          {
            "name": "20080709 Re: Unauthorized reading confirmation from Outlook",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/494101/100/0/threaded"
          },
          {
            "name": "28548",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/28548"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.klink.name/security/aklink-sa-2008-004-office2007-signatures.txt"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.cynops.de/advisories/AKLINK-SA-2008-002.txt"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.cynops.de/advisories/AKLINK-SA-2008-004.txt"
          },
          {
            "name": "1019736",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1019736"
          },
          {
            "name": "1019738",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1019738"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.klink.name/security/aklink-sa-2008-003-live-mail-smime.txt"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.klink.name/security/aklink-sa-2008-002-outlook-smime.txt"
          },
          {
            "name": "1019737",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1019737"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.cynops.de/techzone/http_over_x509.html"
          },
          {
            "name": "20080703 Unauthorized reading confirmation from Outlook",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/493947/100/0/threaded"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-07-03T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by using an arbitrary URL from a certificate embedded in a (1) S/MIME e-mail message or (2) signed document, which allows remote attackers to obtain reading times and IP addresses of recipients, and port-scan results, via a crafted certificate with an Authority Information Access (AIA) extension."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-11T19:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.cynops.de/advisories/AKLINK-SA-2008-003.txt"
        },
        {
          "name": "3978",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/3978"
        },
        {
          "name": "20080709 Re: Unauthorized reading confirmation from Outlook",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/494101/100/0/threaded"
        },
        {
          "name": "28548",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/28548"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.klink.name/security/aklink-sa-2008-004-office2007-signatures.txt"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.cynops.de/advisories/AKLINK-SA-2008-002.txt"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.cynops.de/advisories/AKLINK-SA-2008-004.txt"
        },
        {
          "name": "1019736",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1019736"
        },
        {
          "name": "1019738",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1019738"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.klink.name/security/aklink-sa-2008-003-live-mail-smime.txt"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.klink.name/security/aklink-sa-2008-002-outlook-smime.txt"
        },
        {
          "name": "1019737",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1019737"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.cynops.de/techzone/http_over_x509.html"
        },
        {
          "name": "20080703 Unauthorized reading confirmation from Outlook",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/493947/100/0/threaded"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-3068",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by using an arbitrary URL from a certificate embedded in a (1) S/MIME e-mail message or (2) signed document, which allows remote attackers to obtain reading times and IP addresses of recipients, and port-scan results, via a crafted certificate with an Authority Information Access (AIA) extension."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.cynops.de/advisories/AKLINK-SA-2008-003.txt",
              "refsource": "MISC",
              "url": "https://www.cynops.de/advisories/AKLINK-SA-2008-003.txt"
            },
            {
              "name": "3978",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/3978"
            },
            {
              "name": "20080709 Re: Unauthorized reading confirmation from Outlook",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/494101/100/0/threaded"
            },
            {
              "name": "28548",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/28548"
            },
            {
              "name": "https://www.klink.name/security/aklink-sa-2008-004-office2007-signatures.txt",
              "refsource": "MISC",
              "url": "https://www.klink.name/security/aklink-sa-2008-004-office2007-signatures.txt"
            },
            {
              "name": "https://www.cynops.de/advisories/AKLINK-SA-2008-002.txt",
              "refsource": "MISC",
              "url": "https://www.cynops.de/advisories/AKLINK-SA-2008-002.txt"
            },
            {
              "name": "https://www.cynops.de/advisories/AKLINK-SA-2008-004.txt",
              "refsource": "MISC",
              "url": "https://www.cynops.de/advisories/AKLINK-SA-2008-004.txt"
            },
            {
              "name": "1019736",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1019736"
            },
            {
              "name": "1019738",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1019738"
            },
            {
              "name": "https://www.klink.name/security/aklink-sa-2008-003-live-mail-smime.txt",
              "refsource": "MISC",
              "url": "https://www.klink.name/security/aklink-sa-2008-003-live-mail-smime.txt"
            },
            {
              "name": "https://www.klink.name/security/aklink-sa-2008-002-outlook-smime.txt",
              "refsource": "MISC",
              "url": "https://www.klink.name/security/aklink-sa-2008-002-outlook-smime.txt"
            },
            {
              "name": "1019737",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1019737"
            },
            {
              "name": "https://www.cynops.de/techzone/http_over_x509.html",
              "refsource": "MISC",
              "url": "https://www.cynops.de/techzone/http_over_x509.html"
            },
            {
              "name": "20080703 Unauthorized reading confirmation from Outlook",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/493947/100/0/threaded"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-3068",
    "datePublished": "2008-07-07T23:00:00",
    "dateReserved": "2008-07-07T00:00:00",
    "dateUpdated": "2024-08-07T09:21:34.955Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}