CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
AI Score
Confidence
High
EPSS
Percentile
98.3%
Cross-domain vulnerability in Microsoft XML Core Services 3.0 and 4.0, as used in Internet Explorer, allows remote attackers to obtain sensitive information from another domain via a crafted XML document, related to improper error checks for external DTDs, aka “MSXML DTD Cross-Domain Scripting Vulnerability.”
Vendor | Product | Version | CPE |
---|---|---|---|
microsoft | internet_explorer | * | cpe:2.3:a:microsoft:internet_explorer:*:*:*:*:*:*:*:* |
microsoft | windows_2000 | sp4 | cpe:2.3:o:microsoft:windows_2000:sp4:*:*:*:*:*:*:* |
microsoft | windows_server_2003 | * | cpe:2.3:o:microsoft:windows_server_2003:*:*:*:*:*:*:*:* |
microsoft | windows_server_2003 | * | cpe:2.3:o:microsoft:windows_server_2003:*:sp1:*:*:*:*:*:* |
microsoft | windows_server_2003 | * | cpe:2.3:o:microsoft:windows_server_2003:*:sp1:itanium:*:*:*:*:* |
microsoft | windows_server_2003 | * | cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:* |
microsoft | windows_server_2008 | * | cpe:2.3:o:microsoft:windows_server_2008:*:*:itanium:*:*:*:*:* |
microsoft | windows_server_2008 | * | cpe:2.3:o:microsoft:windows_server_2008:*:*:x32:*:*:*:*:* |
microsoft | windows_server_2008 | * | cpe:2.3:o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:* |
microsoft | windows_vista | * | cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:* |
marc.info/?l=bugtraq&m=122703006921213&w=2
securitytracker.com/id?1021164
www.securityfocus.com/bid/32155
www.us-cert.gov/cas/techalerts/TA08-316A.html
www.vupen.com/english/advisories/2008/3111
docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-069
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5999