Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2012-0013 — Microsoft Windows Server 2008 vulnerability

8 documents7 sources
Severity
9.3CRITICALNVD
EPSS
86.5%
top 0.59%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Microsoft Windows Server 2008
Timeline
PublishedJan 10
Latest updateMay 4

Description

Incomplete blacklist vulnerability in the Windows Packager configuration in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted ClickOnce application in a Microsoft Office document, related to .application files, aka "Assembly Execution Vulnerability."

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages1 packages

🔴Vulnerability Details

1
GHSA
GHSA-fcv4-86qf-2h62: Incomplete blacklist vulnerability in the Windows Packager configuration in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista S↗2022-05-04
▶

💥Exploits & PoCs

3
Exploit-DB
Microsoft Office - ClickOnce Unsafe Object Package Handling (MS12-005) (Metasploit)↗2012-06-11
▶
Exploit-DB
Microsoft Windows - Assembly Execution (MS12-005)↗2012-01-14
▶
Metasploit
MS12-005 Microsoft Office ClickOnce Unsafe Object Package Handling Vulnerability↗
▶

📋Vendor Advisories

1
Red Hat
libvirt: unintended firewall port exposure after restarting libvirtd when defining a bridged forward-mode network↗2011-12-09
▶

🕵️Threat Intelligence

1
Zscaler
Zscaler Protects against Microsoft's Patch Cycle | Round 13↗
▶

💬Community

1
Bugzilla
CVE-2012-1155 CVE-2012-1156 CVE-2012-1157 CVE-2012-1158 CVE-2012-1159 CVE-2012-1160 CVE-2012-1161 CVE-2012-1168 CVE-2012-1169 CVE-2012-1170 moodle: multiple security fixes in 2.2.2, 2.1.5, 2.0.8, 1.9.↗2012-04-02
▶