{"title": "CVE-2015-6176", "reporter": "NVD", "published": "2015-12-09T06:59:57", "cpe": ["cpe:/a:microsoft:edge:-"], "cvelist": ["CVE-2015-6176"], "viewCount": 0, "objectVersion": "1.3", "type": "cve", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6176", "bulletinFamily": "NVD", "hashmap": [{"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "5c5b331a655063e4dab1630b640b74f5", "key": "cpe"}, {"hash": "5a90c87cd5f4f842e8e65496927fb32d", "key": "cvelist"}, {"hash": "6e9bdd2021503689a2ad9254c9cdf2b3", "key": "cvss"}, {"hash": "afd202b153d36d9bfcce34cb4c2b3c5f", "key": "description"}, {"hash": "b02bb98e2b02c45dce07f115a68c545e", "key": "href"}, {"hash": "b72592d0e1df91894846ddc0691ae8a9", "key": "modified"}, {"hash": "47ae8f89df7199ec326e66873f5e2a8a", "key": "published"}, {"hash": "39e5a8eddfeb3e0f823300d103b481ff", "key": "references"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "d5c2978780f2689f21741c149ff35cc4", "key": "title"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}], "history": [{"bulletin": {"reporter": "NVD", "published": "2015-12-09T06:59:57", "cvelist": ["CVE-2015-6176"], "title": "CVE-2015-6176", "objectVersion": "1.2", "description": "Microsoft Edge mishandles HTML attributes in HTTP responses, which allows remote attackers to bypass a cross-site scripting (XSS) protection mechanism via unspecified vectors, aka \"Microsoft Edge XSS Filter Bypass Vulnerability.\"", "type": "cve", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6176", "bulletinFamily": "NVD", "id": "CVE-2015-6176", "history": [], "scanner": [], "enchantments": {}, "modified": "2015-12-09T13:05:04", "hash": "399a539b7660bce2ef01a1f860279a3b5d1215c3422982163851f565ac819d78", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "viewCount": 0, "edition": 1, "cpe": ["cpe:/a:microsoft:edge:-"], "references": ["http://technet.microsoft.com/security/bulletin/MS15-125"], "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "6e9bdd2021503689a2ad9254c9cdf2b3", "key": "cvss"}, {"hash": "b02bb98e2b02c45dce07f115a68c545e", "key": "href"}, {"hash": "5a90c87cd5f4f842e8e65496927fb32d", "key": "cvelist"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "c044d64714ec448060260a3a3f0b5cbe", "key": "modified"}, {"hash": "d5c2978780f2689f21741c149ff35cc4", "key": "title"}, {"hash": "b588302d9b20190b09ea324fd8fd8fd3", "key": "references"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "47ae8f89df7199ec326e66873f5e2a8a", "key": "published"}, {"hash": "5c5b331a655063e4dab1630b640b74f5", "key": "cpe"}, {"hash": "afd202b153d36d9bfcce34cb4c2b3c5f", "key": "description"}], "lastseen": "2016-09-03T23:02:36", "assessment": {"name": "", "href": "", "system": ""}}, "differentElements": ["references", "modified"], "edition": 1, "lastseen": "2016-09-03T23:02:36"}], "scanner": [], "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "modified": "2017-09-12T21:29:04", "hash": "492e188ccb00508aa1e567c06af8ea01665fe7603536338ac66086b893a3e861", "enchantments": {"vulnersScore": 4.3}, "edition": 2, "description": "Microsoft Edge mishandles HTML attributes in HTTP responses, which allows remote attackers to bypass a cross-site scripting (XSS) protection mechanism via unspecified vectors, aka \"Microsoft Edge XSS Filter Bypass Vulnerability.\"", "references": ["http://technet.microsoft.com/security/bulletin/MS15-125", "http://www.securitytracker.com/id/1034316"], "id": "CVE-2015-6176", "lastseen": "2017-09-13T10:56:37", "assessment": {"name": "", "href": "", "system": ""}}

{"result": {"symantec": [{"id": "SMNTC-78518", "type": "symantec", "title": "Microsoft Edge XSS Filter CVE-2015-6176 Security Bypass Vulnerability", "description": "### Description\n\nMicrosoft Edge is prone to a security-bypass vulnerability that affects the XSS Filter. An attacker can exploit this issue by tricking an unsuspecting victim into viewing a page containing malicious content. An attacker can exploit this issue to execute arbitrary script code in the context of the user running the application. This may allow the attacker to steal cookie-based authentication credentials and other sensitive data that may aid in further attacks. Other attacks are possible.\n\n### Technologies Affected\n\n * Microsoft Edge \n * Microsoft Windows 10 for 32-bit Systems \n * Microsoft Windows 10 for x64-based Systems \n * Microsoft Windows 10 version 1511 for 32-bit Systems \n * Microsoft Windows 10 version 1511 for x64-based Systems \n\n### Recommendations\n\n**Run all software as a nonprivileged user with minimal access rights.** \nRun all non-administrative software as a non-administrative user with the least amount of privileges required to successfully operate. This will greatly reduce the potential damage that successful exploitation may achieve.\n\n**Do not follow links provided by unknown or untrusted sources.** \nNever follow links provided by unknown or untrusted sources.\n\n**Set web browser security to disable the execution of script code or active content.** \nSince the exploitation of some of these issues allows the execution of malicious script code in web clients, consider disabling support for script code and active content within the client browser. Note that this mitigation tactic might adversely affect websites that rely on the execution of browser-based script code.\n\nUpdates are available. Please see the references or vendor advisory for more information.\n", "published": "2015-12-08T00:00:00", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "href": "https://www.symantec.com/content/symantec/english/en/security-center/vulnerabilities/writeup.html/78518", "cvelist": ["CVE-2015-6176"], "lastseen": "2018-03-13T12:08:06"}], "nessus": [{"id": "SMB_NT_MS15-125.NASL", "type": "nessus", "title": "MS15-125: Cumulative Security Update for Microsoft Edge (3116184)", "description": "The version of Microsoft Edge installed on the remote host is missing Cumulative Security Update 3116184. It is, therefore, affected by multiple vulnerabilities, the majority of which are remote code execution vulnerabilities. An unauthenticated, remote attacker can exploit these issues by convincing a user to visit a specially crafted website, resulting in the execution of arbitrary code in the context of the current user.", "published": "2015-12-08T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=87254", "cvelist": ["CVE-2015-6139", "CVE-2015-6154", "CVE-2015-6168", "CVE-2015-6148", "CVE-2015-6155", "CVE-2015-6142", "CVE-2015-6161", "CVE-2015-6158", "CVE-2015-6140", "CVE-2015-6151", "CVE-2015-6169", "CVE-2015-6159", "CVE-2015-6176", "CVE-2015-6170", "CVE-2015-6153"], "lastseen": "2017-10-29T13:45:27"}], "openvas": [{"id": "OPENVAS:1361412562310807023", "type": "openvas", "title": "Microsoft Edge Multiple Vulnerabilities (3116184)", "description": "This host is missing a critical security\n update according to Microsoft Bulletin MS15-125.", "published": "2016-01-05T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310807023", "cvelist": ["CVE-2015-6139", "CVE-2015-6154", "CVE-2015-6168", "CVE-2015-6148", "CVE-2015-6155", "CVE-2015-6142", "CVE-2015-6161", "CVE-2015-6158", "CVE-2015-6140", "CVE-2015-6151", "CVE-2015-6169", "CVE-2015-6159", "CVE-2015-6176", "CVE-2015-6170", "CVE-2015-6153"], "lastseen": "2017-07-02T21:13:01"}], "kaspersky": [{"id": "KLA10720", "type": "kaspersky", "title": "\r KLA10720Multiple vulnerabilities in Microsoft Internet Explorer & Edge\t\t\t ", "description": "### *CVSS*:\n9.3\n\n### *Detect date*:\n12/08/2015\n\n### *Severity*:\nCritical\n\n### *Description*:\nMultiple serious vulnerabilities have been found in Microsoft Internet Explorer &amp; Edge. Malicious users can exploit these vulnerabilities to spoof user interface, bypass security restrictions, inject or execute arbitrary code, gain privileges or obtain sensitive information.\n\n### *Affected products*:\nMicrosoft Internet Explorer versions 7 through 11 \nMicrosoft Edge\n\n### *Solution*:\nInstall necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)\n\n### *Original advisories*:\n[MS15-124](<https://technet.microsoft.com/en-us/library/security/MS15-124>) \n[MS15-125](<https://technet.microsoft.com/en-us/library/security/MS15-125>) \n\n\n### *Impacts*:\nSUI \n\n### *Related products*:\n[Microsoft Internet Explorer](<https://threats.kaspersky.com/en/product/Microsoft-Internet-Explorer/>)\n\n### *CVE-IDS*:\n[CVE-2015-6176](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6176>) \n[CVE-2015-6170](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6170>) \n[CVE-2015-6169](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6169>) \n[CVE-2015-6168](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6168>) \n[CVE-2015-6164](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6164>) \n[CVE-2015-6162](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6162>) \n[CVE-2015-6161](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6161>) \n[CVE-2015-6160](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6160>) \n[CVE-2015-6159](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6159>) \n[CVE-2015-6158](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6158>) \n[CVE-2015-6157](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6157>) \n[CVE-2015-6156](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6156>) \n[CVE-2015-6155](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6155>) \n[CVE-2015-6154](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6154>) \n[CVE-2015-6153](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6153>) \n[CVE-2015-6152](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6152>) \n[CVE-2015-6151](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6151>) \n[CVE-2015-6150](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6150>) \n[CVE-2015-6149](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6149>) \n[CVE-2015-6148](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6148>) \n[CVE-2015-6147](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6147>) \n[CVE-2015-6146](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6146>) \n[CVE-2015-6145](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6145>) \n[CVE-2015-6144](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6144>) \n[CVE-2015-6143](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6143>) \n[CVE-2015-6142](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6142>) \n[CVE-2015-6141](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6141>) \n[CVE-2015-6140](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6140>) \n[CVE-2015-6139](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6139>) \n[CVE-2015-6138](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6138>) \n[CVE-2015-6136](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6136>) \n[CVE-2015-6135](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6135>) \n[CVE-2015-6134](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6134>) \n[CVE-2015-6083](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6083>) \n\n\n### *Microsoft official advisories*:\n[MS15-124](<https://technet.microsoft.com/en-us/library/security/MS15-124>)\n\n### *KB list*:\n[3116869](<http://support.microsoft.com/kb/3116869>) \n[3105579](<http://support.microsoft.com/kb/3105579>) \n[3105578](<http://support.microsoft.com/kb/3105578>) \n[3116900](<http://support.microsoft.com/kb/3116900>) \n[3104002](<http://support.microsoft.com/kb/3104002>) \n[3116184](<http://support.microsoft.com/kb/3116184>) \n[3116180](<http://support.microsoft.com/kb/3116180>)", "published": "2015-12-08T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://threats.kaspersky.com/en/vulnerability/KLA10720", "cvelist": ["CVE-2015-6139", "CVE-2015-6154", "CVE-2015-6144", "CVE-2015-6157", "CVE-2015-6150", "CVE-2015-6162", "CVE-2015-6146", "CVE-2015-6168", "CVE-2015-6148", "CVE-2015-6147", "CVE-2015-6136", "CVE-2015-6155", "CVE-2015-6142", "CVE-2015-6138", "CVE-2015-6160", "CVE-2015-6161", "CVE-2015-6149", "CVE-2015-6164", "CVE-2015-6083", "CVE-2015-6135", "CVE-2015-6158", "CVE-2015-6143", "CVE-2015-6140", "CVE-2015-6151", "CVE-2015-6134", "CVE-2015-6169", "CVE-2015-6159", "CVE-2015-6152", "CVE-2015-6176", "CVE-2015-6170", "CVE-2015-6141", "CVE-2015-6145", "CVE-2015-6153", "CVE-2015-6156"], "lastseen": "2018-03-30T14:11:50"}]}}