CVE-2014-0266

Description

The XMLHTTP ActiveX controls in XML Core Services 3.0 in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to bypass the Same Origin Policy via a web page that is visited in Internet Explorer, aka "MSXML Information Disclosure Vulnerability."

Related CPE's

omicrosoftwindows_xp-sp3******

omicrosoftwindows_server_2008r2sp1****x64*

omicrosoftwindows_server_2012r2*******

omicrosoftwindows_rt-*******

omicrosoftwindows_server_2008r2sp1****itanium*

omicrosoftwindows_8.1-*******

omicrosoftwindows_server_2008-sp2******

omicrosoftwindows_7-sp1******

omicrosoftwindows_rt_8.1-*******

omicrosoftwindows_vista-sp2******

References

1029746

Third Party AdvisoryVDB Entry

56771

Third Party Advisory

103189

Broken Link

MS14-005

PatchVendor Advisory

CvssV3 impact

Could not find any metrics

CvssV2 impact

Version

2.0

VectorString

AV:N/AC:M/Au:N/C:C/I:N/A:N

AccessVector

NETWORK

AccessComplexity

MEDIUM

Authentication

NONE

ConfidentialityImpact

COMPLETE

IntegrityImpact

NONE

AvailabilityImpact

NONE

BaseScore

7.099999904632568

Created by Yello
About Severity.io