Information disclosure in Microsoft Internet_explorer
CVE-2012-1858
The toStaticHTML API (aka the SafeHTML component) in Microsoft Internet Explorer 8 and 9, Communicator 2007 R2, and Lync 2010 and 2010 Attendee does not properly handle event attributes and script, which makes it easier for remote attacker…
Vulnerability class: Information Disclosure
EPSS: 0.383 (97.3th percentile) — read the EPSS interpretation.
Affected products
- Microsoft Internet_explorer — versions 8, 9
- Microsoft Lync — versions 2010
- Microsoft Office_communicator — versions 2007
- Microsoft Windows_2003_server
- Microsoft Windows_7
- Microsoft Windows_server_2003
- Microsoft Windows_server_2008 — versions r2
- Microsoft Windows_vista
- Microsoft Windows_xp
- N/a — versions n/a
Weakness classification (CWE)
References
- TA12-192A (US Government Resource, x_refsource_CERT, third-party-advisory)
- MS12-050 (x_refsource_MS, vendor-advisory)
- TA12-164A (US Government Resource, x_refsource_CERT, third-party-advisory)
- MS12-037 (x_refsource_MS, vendor-advisory)
- oval:org.mitre.oval:def:15530 (x_refsource_OVAL, signature, vdb-entry)
- MS12-039 (x_refsource_MS, vendor-advisory)