IE8 Activity to lookup CVEs and Microsoft bulletins

  • Article

Update: Added Microsoft bulletin stuff.

I'm always looking up CVEs so I want to get to the data as quickly as possible, especially if I'm digging through a load of them. 

Three years ago I posted some code to perform CVE lookup using Smart Tags in Microsoft Office.

IE8 offers similar functionality to Smart Tags, but way more flexible, named Activities. So I did a bit of digging around, and found this article by Jane Kim in the IE8 team that explains how to use and create Activities (and provides links to all the appropriate documentation.)

So I decided to write my own activity to look up CVEs from within IE8. Here's the XML:

<?

xml version="1.0" encoding="utf-8"?>
<openServiceDescription xmlns="https://www.microsoft.com/schemas/openservicedescription/1.0">
<homepageUrl>https://nvd.nist.gov</homepageUrl>
<display>
<name>Lookup CVE with NIST</name>
<icon>https://nvd.nist.gov/favicon.ico</icon>
</display>
<activity category="define">
<activityAction context="selection" >
<preview action="https://nvd.nist.gov/nvd.cfm">
<parameter name="cvename" value="{selection}" />
</preview>
<execute action="https://nvd.nist.gov/nvd.cfm">
<parameter name="cvename" value="{selection}" type="text" />
</execute>
</activityAction>
</activity>
</openServiceDescription>

 Here's the same code, but tweaked for Microsoft Security bulletins:

<?

xml version="1.0" encoding="utf-8"?>
<openServiceDescription
    xmlns="https://www.microsoft.com/schemas/openservicedescription/1.0">
<homepageUrl>https://www.microsoft.com</homepageUrl>
<display>
<name>Lookup Microsoft Bulletin</name>
<icon>https://www.microsoft.com/favicon.ico</icon>
</display>
<activity category="define">
<activityAction context="selection" >
<preview action="https://www.microsoft.com/technet/security/bulletin/{selection}.mspx">
</preview>
<execute action="https://www.microsoft.com/technet/security/bulletin/{selection}.mspx">
</execute>
</activityAction>
</activity>
</openServiceDescription>

To install, copy the file(s) to a Web server, and then run the following from within IE8:

<

button
  onclick="window.external.addService('https://localhost/<name>.xml')">
  CVE Lookup Activity
</button>

Now when you click a CVE, you'll have the option to do a CVE lookup: 

Voila!