A vulnerability has been reported in multiple Microsoft products, which can be exploited by malicious people to conduct cross-site scripting attacks.

Certain unspecified input is not properly sanitised within the HTML Sanitisation component before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

NOTE: This is currently being actively exploited in limited targeted attacks.

Solution
Apply patches.
Further details available to Secunia VIM customers

Provided and/or discovered by
The vendor credits Drew Hintz, Google Security Team.

Original Advisory
MS12-066 (KB2687439, KB2687440, KB2687436, KB2687417, KB2726391, KB2726382, KB2726388, KB2726384, KB2687405, KB2687435, KB2589280, KB2687402, KB2687356, KB2687434, KB2687401, KB2687434):
http://technet.microsoft.com/en-us/security/bulletin/ms12-066

Deep Links
Links available to Secunia VIM customers