Unscored severity · published Aug 15, 2015
CVE-2015-2475
Cross-site scripting (XSS) vulnerability in uddi/search/frames.aspx in the UDDI Services component in Microsoft Windows Server 2008 SP2 and BizTalk Server 2010, 2013 Gold, and…
–
CVSS
14.6%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in uddi/search/frames.aspx in the UDDI Services component in Microsoft Windows Server 2008 SP2 and BizTalk Server 2010, 2013 Gold, and 2013 R2 allows remote attackers to inject arbitrary web script or HTML via the search parameter, aka "UDDI Services Elevation of Privilege Vulnerability."
Exploitation
Is it being used?
Exploit prediction (EPSS)14.6% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BS
Biztalk Server · Microsoft
2010; 2013; 2013 · source: NVD
WS
Windows Server 2008 · Microsoft
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-2475
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-2475
www.securityfocus.com
http://www.securityfocus.com/bid/76259
www.securitytracker.com
http://www.securitytracker.com/id/1033246
docs.microsoft.com
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-087
More from Biztalk Server
8.8
CVE-2012-0158
Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability
–
CVE-2009-2496
Heap-based buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Components SP3,…
–
CVE-2007-1201
Unspecified vulnerability in certain COM objects in Microsoft Office Web Components 2000 allows user-assisted remote attackers to execute arbitrary code via vectors related to…
–
CVE-2007-0940
Unspecified vulnerability in the Cryptographic API Component Object Model Certificates ActiveX control (CAPICOM.dll) in Microsoft CAPICOM and BizTalk Server 2004 SP1 and SP2…
–
CVE-2003-0118
SQL injection vulnerability in the Document Tracking and Administration (DTA) website of Microsoft BizTalk Server 2000 and 2002 allows remote attackers to execute operating system…