Cross-site scripting (XSS) vulnerability in the SafeHTML function in the toStaticHTML API in Microsoft Internet Explorer 7 and 8, Office SharePoint Server 2007 SP2, Office SharePoint Server 2010 Gold and SP1, Groove Server 2010 Gold and SP1, Windows SharePoint Services 3.0 SP2, and SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via unspecified strings, aka "toStaticHTML Information Disclosure Vulnerability" or "HTML Sanitization Vulnerability."

The version of SharePoint Services, SharePoint Server, Groove, or Office Web Apps installed on the remote host has multiple privilege escalation and information disclosure vulnerabilities.

A remote attacker could exploit them by tricking a user into making a malicious request, resulting in arbitrary script code execution.

The remote host is missing Internet Explorer (IE) Security Update 2497640.

The installed version of IE is affected by several vulnerabilities that could allow an attacker to execute arbitrary code on the remote host.

ID	Name	Product	Family	Severity
56177	MS11-074: Vulnerabilities in Microsoft SharePoint Could Allow Elevation of Privilege (2451858)	Nessus	Windows : Microsoft Bulletins	medium
55130	MS11-050: Cumulative Security Update for Internet Explorer (2530548)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2011-1252

medium

Tenable Plugins

medium

high