The toStaticHTML API (aka the SafeHTML component) in Microsoft Internet Explorer 8 and 9, Communicator 2007 R2, and Lync 2010 and 2010 Attendee does not properly handle event attributes and script, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted HTML document, aka "HTML Sanitization Vulnerability."

The versions of InfoPath, Office SharePoint Server, SharePoint Server, Groove Server, Windows SharePoint Services, SharePoint Foundation, or Office Web Apps installed on the remote host are affected by multiple privilege escalation and information disclosure vulnerabilities :

  - An information disclosure vulnerability exists in the     way that HTML strings are sanitized. An attacker who     successfully exploited this vulnerability could perform     cross-site scripting attacks and run script in the     security context of the logged-on user. (CVE-2012-1858)

  - A cross-site scripting and a privilege escalation     vulnerability allow attacker-controlled JavaScript to     run in the context of the user clicking a link. An     anonymous attacker could also potentially issue     SharePoint commands in the context of an authenticated     user on the site. (CVE-2012-1859)

  - An information disclosure vulnerability exists in the     way that SharePoint stores search scopes. An attacker     could view or tamper with other users' search scopes.
    (CVE-2012-1860)

  - A cross-site scripting vulnerability exists that allows     attacker-controlled JavaScript to run in the context of     the user clicking a link. An anonymous attacker could     also potentially issue SharePoint commands in the     context of an authenticated user. (CVE-2012-1861)

  - A URL redirection vulnerability exists in SharePoint.
    The vulnerability could lead to spoofing and information     disclosure and could allow an attacker to redirect a     user to an external URL. (CVE-2012-1862)

  - A cross-site scripting vulnerability exists that allows     attacker-controlled JavaScript to run in the context of     the user clicking a link. An anonymous attacker could     also potentially issue SharePoint commands in the     context of an authenticated user. (CVE-2012-1863).

The remote Windows host is potentially affected by the following vulnerabilities :

  - Multiple code execution vulnerabilities exist in the     handling of specially crafted TrueType font files.
    (CVE-2011-3402, CVE-2012-0159)

  - An insecure library loading vulnerability exists in the     way that Microsoft Lync handles the loading of DLL     files. (CVE-2012-1849)

  - An HTML sanitization vulnerability exists in the way     that HTML is filtered. (CVE-2012-1858)

The remote host is missing Internet Explorer (IE) Security Update 2699988.

The installed version of IE is affected by several vulnerabilities that could allow an attacker to execute arbitrary code on the remote host.

ID	Name	Product	Family	Type	Severity
59913	MS12-050: Vulnerabilities in SharePoint Could Allow Elevation of Privilege (2695502)	Nessus	Windows : Microsoft Bulletins	Local	medium
59457	MS12-039: Vulnerabilities in Lync Could Allow Remote Code Execution (2707956)	Nessus	Windows : Microsoft Bulletins	Local	high
59455	MS12-037: Cumulative Security Update for Internet Explorer (2699988)	Nessus	Windows : Microsoft Bulletins	Local	high

Detections

Analytics

CVE-2012-1858

medium

Tenable Plugins

medium

high

high