CVE-2010-1257

Microsoft Office InfoPath <2007 SP2 - XSS

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in the toStaticHTML API, as used in Microsoft Office InfoPath 2003 SP3, 2007 SP1, and 2007 SP2; Office SharePoint Server 2007 SP1 and SP2; SharePoint Services 3.0 SP1 and SP2; and Internet Explorer 8 allows remote attackers to inject arbitrary web script or HTML via vectors related to sanitization.

References (7)

[Vendor Advisory] http://support.avaya.com/css/P8/documents/100089747

[US Government Resource] http://www.us-cert.gov/cas/techalerts/TA10-159B.html

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/58866

[Third Party Advisory, VDB Entry] https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6677

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/40409

[Vendor Advisory] https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-035

[Vendor Advisory] https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-039

Scores

EPSS 0.3686

EPSS Percentile 97.1%

Classification

CWE

CWE-79

Status published

Affected Products (13)

microsoft/office_infopath

microsoft/office_infopath

microsoft/office_infopath

microsoft/sharepoint_server

microsoft/sharepoint_server

microsoft/sharepoint_server

microsoft/sharepoint_server

microsoft/sharepoint_services

microsoft/sharepoint_services

microsoft/sharepoint_services

microsoft/sharepoint_services

microsoft/internet_explorer

n/a/n/a

Timeline

Published Jun 08, 2010

Tracked Since Feb 18, 2026