CVE-2014-0266 — Sensitive Information Exposure in Microsoft Windows Server 2008

CWE-200 — Sensitive Information Exposure6 documents5 sources
Severity
7.1HIGHNVD
EPSS
31.9%
top 3.18%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Microsoft Windows Server 2008Microsoft Windows Server 2012
Timeline
PublishedFeb 12
Latest updateMay 14

Description

The XMLHTTP ActiveX controls in XML Core Services 3.0 in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to bypass the Same Origin Policy via a web page that is visited in Internet Explorer, aka "MSXML Information Disclosure Vulnerability."

CVSS vector

AV:N/AC:M/C:C/I:N/A:NExploitability: 8.6 | Impact: 6.9

Affected Packages1 packages

Patches

Patch: docs.microsoft.com ↗Patch: docs.microsoft.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-4f72-53xg-j632: The XMLHTTP ActiveX controls in XML Core Services 3↗2022-05-14
▶
VulnCheck
Microsoft Windows Exposure of Sensitive Information to an Unauthorized Actor↗2014
▶

🕵️Threat Intelligence

3
Talos
Microsoft Update Tuesday: February 2014, huge fix for Internet Explorer↗2014-02-11
▶
Talos
Microsoft Update Tuesday: February 2014, huge fix for Internet Explorer↗2014-02-11
▶
Zscaler
Zscaler found Multiple Security Vulnerabilities | 02-11-2014↗
▶