Microsoft Forefront Unified Access Gateway vulnerabilities

12 CVEs affecting Microsoft Forefront Unified Access Gateway, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-12571, published 2018-07-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2012-0147, published 2012-04-10. Medium severity, CVSS 5.0. EPSS: 35.6% chance of exploitation in the next 30 days. Microsoft Forefront Unified Access Gateway (UAG) 2010 SP1 and SP1 Update 1 does not properly configure the default web site, which allows remote attackers to obtain sensitive information via a…
CVE-2018-12571, published 2018-07-05. Critical severity, CVSS 9.8. EPSS: 30.7% chance of exploitation in the next 30 days. uniquesig0/InternalSite/InitParams.aspx in Microsoft Forefront Unified Access Gateway 2010 allows remote attackers to trigger outbound DNS queries for arbitrary hosts via a comma-separated list of…
CVE-2010-3936, published 2010-11-10. Medium severity, CVSS 4.3. EPSS: 18.8% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Signurl.asp in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, 2010 Update 1, and 2010 Update 2 allows remote attackers to inject arbitrary web…
CVE-2011-1969, published 2011-10-12. High severity, CVSS 9.3. EPSS: 17.3% chance of exploitation in the next 30 days. Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, Update 1, Update 2, and SP1 provides the MicrosoftClient.jar file containing a signed Java applet, which allows remote attackers to execute…
CVE-2011-2012, published 2011-10-12. Medium severity, CVSS 5.0. EPSS: 16.6% chance of exploitation in the next 30 days. Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, Update 1, Update 2, and SP1 does not properly validate session cookies, which allows remote attackers to cause a denial of service (IIS…
CVE-2010-2734, published 2010-11-10. Medium severity, CVSS 4.3. EPSS: 14.2% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the mobile portal in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, 2010 Update 1, and 2010 Update 2 allows remote attackers to inject…
CVE-2010-2733, published 2010-11-10. Medium severity, CVSS 4.3. EPSS: 14.2% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the Web Monitor in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, 2010 Update 1, and 2010 Update 2 allows remote attackers to inject arbitrary…
CVE-2010-2732, published 2010-11-10. Medium severity, CVSS 5.8. EPSS: 13.4% chance of exploitation in the next 30 days. Open redirect vulnerability in the web interface in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, 2010 Update 1, and 2010 Update 2 allows remote attackers to redirect users to arbitrary…
CVE-2011-1895, published 2011-10-12. Medium severity, CVSS 4.3. EPSS: 11.1% chance of exploitation in the next 30 days. CRLF injection vulnerability in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, Update 1, Update 2, and SP1 allows remote attackers to inject arbitrary HTTP headers, and conduct HTTP…
CVE-2012-0146, published 2012-04-10. Medium severity, CVSS 5.8. EPSS: 11% chance of exploitation in the next 30 days. Open redirect vulnerability in Microsoft Forefront Unified Access Gateway (UAG) 2010 SP1 and SP1 Update 1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks…

Latest

CVE-2011-1897, published 2011-10-12. Medium severity, CVSS 4.3. EPSS: 8.4% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, Update 1, Update 2, and SP1 allows remote attackers to inject arbitrary web script or HTML via…
CVE-2011-1896, published 2011-10-12. Medium severity, CVSS 4.3. EPSS: 8.3% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, Update 1, Update 2, and SP1 allows remote attackers to inject arbitrary web script or HTML via…