Microsoft Internet Explorer does not properly validate source of URL stored in Travel Log

🗓️ 02 Feb 2004 00:00:00Reported by CERTType

cert

cert🔗 www.kb.cert.org👁 46 Views

Microsoft Internet Explorer fails to validate URL sources in Travel Log, risking arbitrary code execution.

Reporter	Title	Published	Views	Family All 8
CVE	CVE-2003-1026	8 Jan 200405:00	–	cve
Cvelist	CVE-2003-1026	8 Jan 200405:00	–	cvelist
NVD	CVE-2003-1026	20 Jan 200405:00	–	nvd
OpenVAS	IE 5.01 5.5 6.0 Cumulative patch (890923)	3 Nov 200500:00	–	openvas
OpenVAS	Microsoft Internet Explorer 5.01, 5.5, 6.0 Cumulative Patch (890923, MS05-020)	3 Nov 200500:00	–	openvas
Packet Storm	JSinject.txt	3 Feb 200400:00	–	packetstorm
securityvulns	Microsoft Security Bulletin MS04-004	3 Feb 200400:00	–	securityvulns
securityvulns	Sandblad #12: Inject javascript url in history list (revisited)	4 Feb 200400:00	–	securityvulns

Source	Link
securityfocus	www.securityfocus.com/archive/1/345617
safecenter	www.safecenter.net/UMBRELLAWEBV4/BackToFramedJpu/BackToFramedJpu-Content.htm
securityfocus	www.securityfocus.com/archive/1/352460
microsoft	www.microsoft.com/technet/security/bulletin/MS04-004.asp
msdn	www.msdn.microsoft.com/workshop/browser/travellog/travellog.asp
msdn	www.msdn.microsoft.com/workshop/browser/webbrowser/browser_control_ovw_entry.asp
msdn	www.msdn.microsoft.com/workshop/author/om/xframe_scripting_security.asp
msdn	www.msdn.microsoft.com/workshop/security/szone/overview/overview.asp
msdn	www.msdn.microsoft.com/workshop/security/szone/overview/overview.asp
msdn	www.msdn.microsoft.com/workshop/author/dhtml/reference/methods/navigateandfind.asp

17 Feb 2004 22:24Current

7.3High risk

Vulners AI Score7.3

CVSS 29.3

EPSS0.5582

microsoft internet explorer travel log vulnerability script evaluation cross-domain security arbitrary code execution.