{"id": "SMB_NT_MS15-107.NASL", "bulletinFamily": "scanner", "title": "MS15-107: Cumulative Security Update for Microsoft Edge (3096448)", "description": "The version of Microsoft Edge installed on the remote Windows host is\nmissing Cumulative Security Update 3096448. It is, therefore, affected\nby multiple vulnerabilities :\n\n - An information disclosure vulnerability exists due to\n improper handling of objects in memory. A remote\n attacker can exploit this, via a specially crafted\n website, to disclose arbitrary memory content.\n (CVE-2015-6057)\n\n - A cross-site scripting filter bypass vulnerability\n exists due to improper disabling of an HTML attribute in\n otherwise appropriately filtered HTTP response data. A\n remote attacker can exploit this vulnerability by\n convincing a user to visit a website containing\n specially crafted content, resulting in the execution of\n arbitrary script code in the wrong security context.\n (CVE-2015-6058)", "published": "2015-10-13T00:00:00", "modified": "2019-11-02T00:00:00", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "href": "https://www.tenable.com/plugins/nessus/86372", "reporter": "This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2015/ms15-107"], "cvelist": ["CVE-2015-6058", "CVE-2015-6057"], "type": "nessus", "lastseen": "2019-11-22T03:35:15", "history": [{"bulletin": {"bulletinFamily": "scanner", "cpe": ["cpe:/o:microsoft:windows", "cpe:/a:microsoft:edge"], "cvelist": ["CVE-2015-6058", "CVE-2015-6057"], "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "description": "The version of Microsoft Edge installed on the remote Windows host is\nmissing Cumulative Security Update 3096448. It is, therefore, affected\nby multiple vulnerabilities :\n\n - An information disclosure vulnerability exists due to\n improper handling of objects in memory. A remote\n attacker can exploit this, via a specially crafted\n website, to disclose arbitrary memory content.\n (CVE-2015-6057)\n\n - A cross-site scripting filter bypass vulnerability\n exists due to improper disabling of an HTML attribute in\n otherwise appropriately filtered HTTP response data. A\n remote attacker can exploit this vulnerability by\n convincing a user to visit a website containing\n specially crafted content, resulting in the execution of\n arbitrary script code in the wrong security context.\n (CVE-2015-6058)", "edition": 9, "enchantments": {"dependencies": {"modified": "2019-01-16T20:22:31", "references": [{"idList": ["OPENVAS:1361412562310807024"], "type": "openvas"}, {"idList": ["SMNTC-76990", "SMNTC-76980"], "type": "symantec"}, {"idList": ["SECURITYVULNS:VULN:14734"], "type": "securityvulns"}, {"idList": ["KLA10674"], "type": "kaspersky"}, {"idList": ["CVE-2015-6058", "CVE-2015-6057"], "type": "cve"}]}, "score": {"value": 4.3, "vector": "NONE"}}, "hash": "1b1819d68906ea2572d7276eac5f9fcaee2225daf20b9500a2a41f80e7723e26", "hashmap": [{"hash": "178aac353323673bb786a7923bf8ca5f", "key": "published"}, {"hash": "93deaaadc104e49ef97b0399db05f227", "key": "cpe"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "015cb78ce50d3bd4e2fbe18f25603329", "key": "modified"}, {"hash": "8b5b04cb3efc3c1609a9be65f9f45ff9", "key": "cvelist"}, {"hash": "c9898bc973bfffca5119f1a3bfa73a8d", "key": "naslFamily"}, {"hash": "babb304fc5a224280f12a2188ce63ffd", "key": "sourceData"}, {"hash": "fa72f14c0890a0e76ed1e0332159edc6", "key": "pluginID"}, {"hash": "a792e2393dff1e200b885c5245988f6f", "key": "cvss"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "5b30a8b36e8ceb85ea96dfce859726cb", "key": "references"}, {"hash": "b8b9cfd519c369c834c94074015f4e55", "key": "description"}, {"hash": "fbb0c6c67942445ceadbe128a3ba84e0", "key": "title"}, {"hash": "b7dbfae98a6a619f11806e0877575828", "key": "href"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=86372", "id": "SMB_NT_MS15-107.NASL", "lastseen": "2019-01-16T20:22:31", "modified": "2018-11-15T00:00:00", "naslFamily": "Windows : Microsoft Bulletins", "objectVersion": "1.3", "pluginID": "86372", "published": "2015-10-13T00:00:00", "references": ["https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2015/ms15-107"], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(86372);\n script_version(\"1.10\");\n script_cvs_date(\"Date: 2018/11/15 20:50:31\");\n\n script_cve_id(\"CVE-2015-6057\", \"CVE-2015-6058\");\n script_bugtraq_id(76980, 76990);\n script_xref(name:\"MSFT\", value:\"MS15-107\");\n script_xref(name:\"MSKB\", value:\"3096448\");\n\n script_name(english:\"MS15-107: Cumulative Security Update for Microsoft Edge (3096448)\");\n script_summary(english:\"Checks the file version of edgehtml.dll.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote host has a web browser installed that is affected by\nmultiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of Microsoft Edge installed on the remote Windows host is\nmissing Cumulative Security Update 3096448. It is, therefore, affected\nby multiple vulnerabilities :\n\n - An information disclosure vulnerability exists due to\n improper handling of objects in memory. A remote\n attacker can exploit this, via a specially crafted\n website, to disclose arbitrary memory content.\n (CVE-2015-6057)\n\n - A cross-site scripting filter bypass vulnerability\n exists due to improper disabling of an HTML attribute in\n otherwise appropriately filtered HTTP response data. A\n remote attacker can exploit this vulnerability by\n convincing a user to visit a website containing\n specially crafted content, resulting in the execution of\n arbitrary script code in the wrong security context.\n (CVE-2015-6058)\");\n script_set_attribute(attribute:\"see_also\", value:\"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2015/ms15-107\");\n script_set_attribute(attribute:\"solution\", value:\n\"Microsoft has released a set of patches for Windows 10.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/10/13\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/10/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/10/13\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:edge\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.\");\n\n script_dependencies(\"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"smb_reg_query.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');\n\nbulletin = 'MS15-107';\nkb = '3096448'; # Cumulative update for Windows 10: October 13, 2015\n\nkbs = make_list(kb);\nif (get_kb_item('Host/patch_management_checks')) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_WARNING);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nget_kb_item_or_exit('SMB/WindowsVersion', exit_code:1);\n\n# Server core is not affected\nif (hotfix_check_server_core() == 1) audit(AUDIT_WIN_SERVER_CORE);\n\nif (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nshare = hotfix_get_systemdrive(exit_on_fail:TRUE, as_share:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n # Windows 10\n hotfix_is_vulnerable(os:\"10\", sp:0, file:\"edgehtml.dll\", version:\"11.0.10240.16549\", dir:\"\\system32\", bulletin:bulletin, kb:kb)\n)\n{\n set_kb_item(name:\"www/0/XSS\", value:TRUE);\n set_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_warning();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, 'affected');\n}\n", "title": "MS15-107: Cumulative Security Update for Microsoft Edge (3096448)", "type": "nessus", "viewCount": 1}, "differentElements": ["description"], "edition": 9, "lastseen": "2019-01-16T20:22:31"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": ["cpe:/o:microsoft:windows", "cpe:/a:microsoft:edge"], "cvelist": ["CVE-2015-6058", "CVE-2015-6057"], "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "description": "The version of Microsoft Edge installed on the remote Windows host is missing Cumulative Security Update 3096448. It is, therefore, affected by multiple vulnerabilities :\n\n - An information disclosure vulnerability exists due to improper handling of objects in memory. A remote attacker can exploit this, via a specially crafted website, to disclose arbitrary memory content.\n (CVE-2015-6057)\n\n - A cross-site scripting filter bypass vulnerability exists due to improper disabling of an HTML attribute in otherwise appropriately filtered HTTP response data. A remote attacker can exploit this vulnerability by convincing a user to visit a website containing specially crafted content, resulting in the execution of arbitrary script code in the wrong security context.\n (CVE-2015-6058)", "edition": 5, "enchantments": {"score": {"value": 4.3, "vector": "NONE"}}, "hash": "55ac2d4e3b72f0b5dfd0ce34c7be1cd757b6e9c75a582d0d405658f9173ac30e", "hashmap": [{"hash": "178aac353323673bb786a7923bf8ca5f", "key": "published"}, {"hash": "e47b948210398b8df300b310ab0dc955", "key": "description"}, {"hash": "93deaaadc104e49ef97b0399db05f227", "key": "cpe"}, {"hash": "3b33040e1ee70c0673ab567f99a67d3f", "key": "modified"}, {"hash": "7e11e88999c4b9ef7a133b22fe75dcc9", "key": "sourceData"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "8b5b04cb3efc3c1609a9be65f9f45ff9", "key": "cvelist"}, {"hash": "c9898bc973bfffca5119f1a3bfa73a8d", "key": "naslFamily"}, {"hash": "fa72f14c0890a0e76ed1e0332159edc6", "key": "pluginID"}, {"hash": "a792e2393dff1e200b885c5245988f6f", "key": "cvss"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "fbb0c6c67942445ceadbe128a3ba84e0", "key": "title"}, {"hash": "2b8358513f0cb9ed763c8f61f7c9aec4", "key": "references"}, {"hash": "b7dbfae98a6a619f11806e0877575828", "key": "href"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=86372", "id": "SMB_NT_MS15-107.NASL", "lastseen": "2018-07-31T09:57:33", "modified": "2018-07-30T00:00:00", "naslFamily": "Windows : Microsoft Bulletins", "objectVersion": "1.3", "pluginID": "86372", "published": "2015-10-13T00:00:00", "references": ["https://technet.microsoft.com/library/security/ms15-107"], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(86372);\n script_version(\"1.9\");\n script_cvs_date(\"Date: 2018/07/30 15:31:33\");\n\n script_cve_id(\"CVE-2015-6057\", \"CVE-2015-6058\");\n script_bugtraq_id(76980, 76990);\n script_xref(name:\"MSFT\", value:\"MS15-107\");\n script_xref(name:\"MSKB\", value:\"3096448\");\n\n script_name(english:\"MS15-107: Cumulative Security Update for Microsoft Edge (3096448)\");\n script_summary(english:\"Checks the file version of edgehtml.dll.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote host has a web browser installed that is affected by\nmultiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of Microsoft Edge installed on the remote Windows host is\nmissing Cumulative Security Update 3096448. It is, therefore, affected\nby multiple vulnerabilities :\n\n - An information disclosure vulnerability exists due to\n improper handling of objects in memory. A remote\n attacker can exploit this, via a specially crafted\n website, to disclose arbitrary memory content.\n (CVE-2015-6057)\n\n - A cross-site scripting filter bypass vulnerability\n exists due to improper disabling of an HTML attribute in\n otherwise appropriately filtered HTTP response data. A\n remote attacker can exploit this vulnerability by\n convincing a user to visit a website containing\n specially crafted content, resulting in the execution of\n arbitrary script code in the wrong security context.\n (CVE-2015-6058)\");\n script_set_attribute(attribute:\"see_also\", value:\"https://technet.microsoft.com/library/security/ms15-107\");\n script_set_attribute(attribute:\"solution\", value:\n\"Microsoft has released a set of patches for Windows 10.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/10/13\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/10/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/10/13\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:edge\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.\");\n\n script_dependencies(\"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"smb_reg_query.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');\n\nbulletin = 'MS15-107';\nkb = '3096448'; # Cumulative update for Windows 10: October 13, 2015\n\nkbs = make_list(kb);\nif (get_kb_item('Host/patch_management_checks')) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_WARNING);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nget_kb_item_or_exit('SMB/WindowsVersion', exit_code:1);\n\n# Server core is not affected\nif (hotfix_check_server_core() == 1) audit(AUDIT_WIN_SERVER_CORE);\n\nif (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nshare = hotfix_get_systemdrive(exit_on_fail:TRUE, as_share:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n # Windows 10\n hotfix_is_vulnerable(os:\"10\", sp:0, file:\"edgehtml.dll\", version:\"11.0.10240.16549\", dir:\"\\system32\", bulletin:bulletin, kb:kb)\n)\n{\n set_kb_item(name:\"www/0/XSS\", value:TRUE);\n set_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_warning();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, 'affected');\n}\n", "title": "MS15-107: Cumulative Security Update for Microsoft Edge (3096448)", "type": "nessus", "viewCount": 1}, "differentElements": ["cvss"], "edition": 5, "lastseen": "2018-07-31T09:57:33"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": ["cpe:/o:microsoft:windows", "cpe:/a:microsoft:edge"], "cvelist": ["CVE-2015-6058", "CVE-2015-6057"], "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "description": "The version of Microsoft Edge installed on the remote Windows host is missing Cumulative Security Update 3096448. It is, therefore, affected by multiple vulnerabilities :\n\n - An information disclosure vulnerability exists due to improper handling of objects in memory. A remote attacker can exploit this, via a specially crafted website, to disclose arbitrary memory content.\n (CVE-2015-6057)\n\n - A cross-site scripting filter bypass vulnerability exists due to improper disabling of an HTML attribute in otherwise appropriately filtered HTTP response data. A remote attacker can exploit this vulnerability by convincing a user to visit a website containing specially crafted content, resulting in the execution of arbitrary script code in the wrong security context.\n (CVE-2015-6058)", "edition": 4, "enchantments": {"score": {"value": 4.3, "vector": "NONE"}}, "hash": "49d2306588da44659445bd1ea3f1e4cbe05c0e415f36f37b5aaaada75dd58100", "hashmap": [{"hash": "178aac353323673bb786a7923bf8ca5f", "key": "published"}, {"hash": "e47b948210398b8df300b310ab0dc955", "key": "description"}, {"hash": "93deaaadc104e49ef97b0399db05f227", "key": "cpe"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "8b5b04cb3efc3c1609a9be65f9f45ff9", "key": "cvelist"}, {"hash": "c9898bc973bfffca5119f1a3bfa73a8d", "key": "naslFamily"}, {"hash": "bef2be53201f803137af6a42c1ac9809", "key": "modified"}, {"hash": "fa72f14c0890a0e76ed1e0332159edc6", "key": "pluginID"}, {"hash": "a792e2393dff1e200b885c5245988f6f", "key": "cvss"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "c373190b8cd7d80f48e21edeb107b885", "key": "sourceData"}, {"hash": "fbb0c6c67942445ceadbe128a3ba84e0", "key": "title"}, {"hash": "2b8358513f0cb9ed763c8f61f7c9aec4", "key": "references"}, {"hash": "b7dbfae98a6a619f11806e0877575828", "key": "href"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=86372", "id": "SMB_NT_MS15-107.NASL", "lastseen": "2017-10-29T13:38:39", "modified": "2017-07-24T00:00:00", "naslFamily": "Windows : Microsoft Bulletins", "objectVersion": "1.3", "pluginID": "86372", "published": "2015-10-13T00:00:00", "references": ["https://technet.microsoft.com/library/security/ms15-107"], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(86372);\n script_version(\"$Revision: 1.8 $\");\n script_cvs_date(\"$Date: 2017/07/24 20:45:41 $\");\n\n script_cve_id(\"CVE-2015-6057\", \"CVE-2015-6058\");\n script_bugtraq_id(76980, 76990);\n script_osvdb_id(128804, 128805);\n script_xref(name:\"MSFT\", value:\"MS15-107\");\n script_xref(name:\"MSKB\", value:\"3096448\");\n\n script_name(english:\"MS15-107: Cumulative Security Update for Microsoft Edge (3096448)\");\n script_summary(english:\"Checks the file version of edgehtml.dll.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote host has a web browser installed that is affected by\nmultiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of Microsoft Edge installed on the remote Windows host is\nmissing Cumulative Security Update 3096448. It is, therefore, affected\nby multiple vulnerabilities :\n\n - An information disclosure vulnerability exists due to\n improper handling of objects in memory. A remote\n attacker can exploit this, via a specially crafted\n website, to disclose arbitrary memory content.\n (CVE-2015-6057)\n\n - A cross-site scripting filter bypass vulnerability\n exists due to improper disabling of an HTML attribute in\n otherwise appropriately filtered HTTP response data. A\n remote attacker can exploit this vulnerability by\n convincing a user to visit a website containing\n specially crafted content, resulting in the execution of\n arbitrary script code in the wrong security context.\n (CVE-2015-6058)\");\n script_set_attribute(attribute:\"see_also\", value:\"https://technet.microsoft.com/library/security/ms15-107\");\n script_set_attribute(attribute:\"solution\", value:\n\"Microsoft has released a set of patches for Windows 10.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/10/13\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/10/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/10/13\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:edge\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2015-2017 Tenable Network Security, Inc.\");\n\n script_dependencies(\"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"smb_reg_query.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');\n\nbulletin = 'MS15-107';\nkb = '3096448'; # Cumulative update for Windows 10: October 13, 2015\n\nkbs = make_list(kb);\nif (get_kb_item('Host/patch_management_checks')) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_WARNING);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nget_kb_item_or_exit('SMB/WindowsVersion', exit_code:1);\n\n# Server core is not affected\nif (hotfix_check_server_core() == 1) audit(AUDIT_WIN_SERVER_CORE);\n\nif (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nshare = hotfix_get_systemdrive(exit_on_fail:TRUE, as_share:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n # Windows 10\n hotfix_is_vulnerable(os:\"10\", sp:0, file:\"edgehtml.dll\", version:\"11.0.10240.16549\", dir:\"\\system32\", bulletin:bulletin, kb:kb)\n)\n{\n set_kb_item(name:\"www/0/XSS\", value:TRUE);\n set_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_warning();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, 'affected');\n}\n", "title": "MS15-107: Cumulative Security Update for Microsoft Edge (3096448)", "type": "nessus", "viewCount": 1}, "differentElements": ["modified", "sourceData"], "edition": 4, "lastseen": "2017-10-29T13:38:39"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": ["cpe:/o:microsoft:windows", "cpe:/a:microsoft:edge"], "cvelist": ["CVE-2015-6058", "CVE-2015-6057"], "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "description": "The version of Microsoft Edge installed on the remote Windows host is\nmissing Cumulative Security Update 3096448. It is, therefore, affected\nby multiple vulnerabilities :\n\n - An information disclosure vulnerability exists due to\n improper handling of objects in memory. A remote\n attacker can exploit this, via a specially crafted\n website, to disclose arbitrary memory content.\n (CVE-2015-6057)\n\n - A cross-site scripting filter bypass vulnerability\n exists due to improper disabling of an HTML attribute in\n otherwise appropriately filtered HTTP response data. A\n remote attacker can exploit this vulnerability by\n convincing a user to visit a website containing\n specially crafted content, resulting in the execution of\n arbitrary script code in the wrong security context.\n (CVE-2015-6058)", "edition": 12, "enchantments": {"dependencies": {"modified": "2019-11-03T12:15:49", "references": [{"idList": ["OPENVAS:1361412562310807024"], "type": "openvas"}, {"idList": ["SMNTC-76990", "SMNTC-76980"], "type": "symantec"}, {"idList": ["SECURITYVULNS:VULN:14734"], "type": "securityvulns"}, {"idList": ["KLA10674"], "type": "kaspersky"}, {"idList": ["KB3096448"], "type": "mskb"}, {"idList": ["CVE-2015-6058", "CVE-2015-6057"], "type": "cve"}]}, "score": {"modified": "2019-11-03T12:15:49", "value": 6.8, "vector": "NONE"}}, "hash": "85b3a56cf149b01838e818f49b6f49299a77c493da2dae193608731d229c7f94", "hashmap": [{"hash": "178aac353323673bb786a7923bf8ca5f", "key": "published"}, {"hash": "83d85f0b2082533b5c390c185dd3e8ce", "key": "reporter"}, {"hash": "93deaaadc104e49ef97b0399db05f227", "key": "cpe"}, {"hash": "474d7e4ced0edb1a1725b1997235d38a", "key": "href"}, {"hash": "abcf9266f425f12dda38f529cd4a94bc", "key": "modified"}, {"hash": "8b5b04cb3efc3c1609a9be65f9f45ff9", "key": "cvelist"}, {"hash": "a89198c45ce87f7ec9735a085150b708", "key": "cvss"}, {"hash": "c9898bc973bfffca5119f1a3bfa73a8d", "key": "naslFamily"}, {"hash": "babb304fc5a224280f12a2188ce63ffd", "key": "sourceData"}, {"hash": "fa72f14c0890a0e76ed1e0332159edc6", "key": "pluginID"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "5b30a8b36e8ceb85ea96dfce859726cb", "key": "references"}, {"hash": "b8b9cfd519c369c834c94074015f4e55", "key": "description"}, {"hash": "fbb0c6c67942445ceadbe128a3ba84e0", "key": "title"}], "history": [], "href": "https://www.tenable.com/plugins/nessus/86372", "id": "SMB_NT_MS15-107.NASL", "lastseen": "2019-11-03T12:15:49", "modified": "2019-11-02T00:00:00", "naslFamily": "Windows : Microsoft Bulletins", "objectVersion": "1.3", "pluginID": "86372", "published": "2015-10-13T00:00:00", "references": ["https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2015/ms15-107"], "reporter": "This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(86372);\n script_version(\"1.10\");\n script_cvs_date(\"Date: 2018/11/15 20:50:31\");\n\n script_cve_id(\"CVE-2015-6057\", \"CVE-2015-6058\");\n script_bugtraq_id(76980, 76990);\n script_xref(name:\"MSFT\", value:\"MS15-107\");\n script_xref(name:\"MSKB\", value:\"3096448\");\n\n script_name(english:\"MS15-107: Cumulative Security Update for Microsoft Edge (3096448)\");\n script_summary(english:\"Checks the file version of edgehtml.dll.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote host has a web browser installed that is affected by\nmultiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of Microsoft Edge installed on the remote Windows host is\nmissing Cumulative Security Update 3096448. It is, therefore, affected\nby multiple vulnerabilities :\n\n - An information disclosure vulnerability exists due to\n improper handling of objects in memory. A remote\n attacker can exploit this, via a specially crafted\n website, to disclose arbitrary memory content.\n (CVE-2015-6057)\n\n - A cross-site scripting filter bypass vulnerability\n exists due to improper disabling of an HTML attribute in\n otherwise appropriately filtered HTTP response data. A\n remote attacker can exploit this vulnerability by\n convincing a user to visit a website containing\n specially crafted content, resulting in the execution of\n arbitrary script code in the wrong security context.\n (CVE-2015-6058)\");\n script_set_attribute(attribute:\"see_also\", value:\"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2015/ms15-107\");\n script_set_attribute(attribute:\"solution\", value:\n\"Microsoft has released a set of patches for Windows 10.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/10/13\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/10/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/10/13\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:edge\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.\");\n\n script_dependencies(\"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"smb_reg_query.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');\n\nbulletin = 'MS15-107';\nkb = '3096448'; # Cumulative update for Windows 10: October 13, 2015\n\nkbs = make_list(kb);\nif (get_kb_item('Host/patch_management_checks')) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_WARNING);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nget_kb_item_or_exit('SMB/WindowsVersion', exit_code:1);\n\n# Server core is not affected\nif (hotfix_check_server_core() == 1) audit(AUDIT_WIN_SERVER_CORE);\n\nif (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nshare = hotfix_get_systemdrive(exit_on_fail:TRUE, as_share:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n # Windows 10\n hotfix_is_vulnerable(os:\"10\", sp:0, file:\"edgehtml.dll\", version:\"11.0.10240.16549\", dir:\"\\system32\", bulletin:bulletin, kb:kb)\n)\n{\n set_kb_item(name:\"www/0/XSS\", value:TRUE);\n set_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_warning();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, 'affected');\n}\n", "title": "MS15-107: Cumulative Security Update for Microsoft Edge (3096448)", "type": "nessus", "viewCount": 1}, "differentElements": ["reporter", "sourceData"], "edition": 12, "lastseen": "2019-11-03T12:15:49"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": ["cpe:/o:microsoft:windows", "cpe:/a:microsoft:edge"], "cvelist": ["CVE-2015-6058", "CVE-2015-6057"], "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "description": "The version of Microsoft Edge installed on the remote Windows host is missing Cumulative Security Update 3096448. It is, therefore, affected by multiple vulnerabilities :\n\n - An information disclosure vulnerability exists due to improper handling of objects in memory. A remote attacker can exploit this, via a specially crafted website, to disclose arbitrary memory content.\n (CVE-2015-6057)\n\n - A cross-site scripting filter bypass vulnerability exists due to improper disabling of an HTML attribute in otherwise appropriately filtered HTTP response data. A remote attacker can exploit this vulnerability by convincing a user to visit a website containing specially crafted content, resulting in the execution of arbitrary script code in the wrong security context.\n (CVE-2015-6058)", "edition": 7, "enchantments": {"score": {"value": 4.3, "vector": "NONE"}}, "hash": "55ac2d4e3b72f0b5dfd0ce34c7be1cd757b6e9c75a582d0d405658f9173ac30e", "hashmap": [{"hash": "178aac353323673bb786a7923bf8ca5f", "key": "published"}, {"hash": "e47b948210398b8df300b310ab0dc955", "key": "description"}, {"hash": "93deaaadc104e49ef97b0399db05f227", "key": "cpe"}, {"hash": "3b33040e1ee70c0673ab567f99a67d3f", "key": "modified"}, {"hash": "7e11e88999c4b9ef7a133b22fe75dcc9", "key": "sourceData"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "8b5b04cb3efc3c1609a9be65f9f45ff9", "key": "cvelist"}, {"hash": "c9898bc973bfffca5119f1a3bfa73a8d", "key": "naslFamily"}, {"hash": "fa72f14c0890a0e76ed1e0332159edc6", "key": "pluginID"}, {"hash": "a792e2393dff1e200b885c5245988f6f", "key": "cvss"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "fbb0c6c67942445ceadbe128a3ba84e0", "key": "title"}, {"hash": "2b8358513f0cb9ed763c8f61f7c9aec4", "key": "references"}, {"hash": "b7dbfae98a6a619f11806e0877575828", "key": "href"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=86372", "id": "SMB_NT_MS15-107.NASL", "lastseen": "2018-09-01T23:48:08", "modified": "2018-07-30T00:00:00", "naslFamily": "Windows : Microsoft Bulletins", "objectVersion": "1.3", "pluginID": "86372", "published": "2015-10-13T00:00:00", "references": ["https://technet.microsoft.com/library/security/ms15-107"], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(86372);\n script_version(\"1.9\");\n script_cvs_date(\"Date: 2018/07/30 15:31:33\");\n\n script_cve_id(\"CVE-2015-6057\", \"CVE-2015-6058\");\n script_bugtraq_id(76980, 76990);\n script_xref(name:\"MSFT\", value:\"MS15-107\");\n script_xref(name:\"MSKB\", value:\"3096448\");\n\n script_name(english:\"MS15-107: Cumulative Security Update for Microsoft Edge (3096448)\");\n script_summary(english:\"Checks the file version of edgehtml.dll.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote host has a web browser installed that is affected by\nmultiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of Microsoft Edge installed on the remote Windows host is\nmissing Cumulative Security Update 3096448. It is, therefore, affected\nby multiple vulnerabilities :\n\n - An information disclosure vulnerability exists due to\n improper handling of objects in memory. A remote\n attacker can exploit this, via a specially crafted\n website, to disclose arbitrary memory content.\n (CVE-2015-6057)\n\n - A cross-site scripting filter bypass vulnerability\n exists due to improper disabling of an HTML attribute in\n otherwise appropriately filtered HTTP response data. A\n remote attacker can exploit this vulnerability by\n convincing a user to visit a website containing\n specially crafted content, resulting in the execution of\n arbitrary script code in the wrong security context.\n (CVE-2015-6058)\");\n script_set_attribute(attribute:\"see_also\", value:\"https://technet.microsoft.com/library/security/ms15-107\");\n script_set_attribute(attribute:\"solution\", value:\n\"Microsoft has released a set of patches for Windows 10.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/10/13\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/10/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/10/13\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:edge\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.\");\n\n script_dependencies(\"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"smb_reg_query.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');\n\nbulletin = 'MS15-107';\nkb = '3096448'; # Cumulative update for Windows 10: October 13, 2015\n\nkbs = make_list(kb);\nif (get_kb_item('Host/patch_management_checks')) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_WARNING);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nget_kb_item_or_exit('SMB/WindowsVersion', exit_code:1);\n\n# Server core is not affected\nif (hotfix_check_server_core() == 1) audit(AUDIT_WIN_SERVER_CORE);\n\nif (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nshare = hotfix_get_systemdrive(exit_on_fail:TRUE, as_share:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n # Windows 10\n hotfix_is_vulnerable(os:\"10\", sp:0, file:\"edgehtml.dll\", version:\"11.0.10240.16549\", dir:\"\\system32\", bulletin:bulletin, kb:kb)\n)\n{\n set_kb_item(name:\"www/0/XSS\", value:TRUE);\n set_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_warning();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, 'affected');\n}\n", "title": "MS15-107: Cumulative Security Update for Microsoft Edge (3096448)", "type": "nessus", "viewCount": 1}, "differentElements": ["references", "modified", "sourceData"], "edition": 7, "lastseen": "2018-09-01T23:48:08"}], "edition": 13, "hashmap": [{"key": "bulletinFamily", "hash": "bbdaea376f500d25f6b0c1050311dd07"}, {"key": "cpe", "hash": "93deaaadc104e49ef97b0399db05f227"}, {"key": "cvelist", "hash": "8b5b04cb3efc3c1609a9be65f9f45ff9"}, {"key": "cvss", "hash": "a89198c45ce87f7ec9735a085150b708"}, {"key": "description", "hash": "b8b9cfd519c369c834c94074015f4e55"}, {"key": "href", "hash": "474d7e4ced0edb1a1725b1997235d38a"}, {"key": "modified", "hash": "abcf9266f425f12dda38f529cd4a94bc"}, {"key": "naslFamily", "hash": "c9898bc973bfffca5119f1a3bfa73a8d"}, {"key": "pluginID", "hash": "fa72f14c0890a0e76ed1e0332159edc6"}, {"key": "published", "hash": "178aac353323673bb786a7923bf8ca5f"}, {"key": "references", "hash": "5b30a8b36e8ceb85ea96dfce859726cb"}, {"key": "reporter", "hash": "f82feb6b55f329a4801a7908bc18a9d6"}, {"key": "sourceData", "hash": "8d703bc5f4cc898e0e9e39a357e1f6ab"}, {"key": "title", "hash": "fbb0c6c67942445ceadbe128a3ba84e0"}, {"key": "type", "hash": "5e0bd03bec244039678f2b955a2595aa"}], "hash": "c75ff6fe9dd3578a0d56807301d90d1d9243ca7eff2780a1e0209ad82b89d940", "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2015-6057", "CVE-2015-6058"]}, {"type": "symantec", "idList": ["SMNTC-76980", "SMNTC-76990"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310807024"]}, {"type": "mskb", "idList": ["KB3096448"]}, {"type": "kaspersky", "idList": ["KLA10674"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:14734"]}], "modified": "2019-11-22T03:35:15"}, "score": {"value": 6.7, "vector": "NONE", "modified": "2019-11-22T03:35:15"}, "vulnersScore": 6.7}, "objectVersion": "1.3", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(86372);\n script_version(\"1.11\");\n script_cvs_date(\"Date: 2019/11/20\");\n\n script_cve_id(\"CVE-2015-6057\", \"CVE-2015-6058\");\n script_bugtraq_id(76980, 76990);\n script_xref(name:\"MSFT\", value:\"MS15-107\");\n script_xref(name:\"MSKB\", value:\"3096448\");\n\n script_name(english:\"MS15-107: Cumulative Security Update for Microsoft Edge (3096448)\");\n script_summary(english:\"Checks the file version of edgehtml.dll.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote host has a web browser installed that is affected by\nmultiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of Microsoft Edge installed on the remote Windows host is\nmissing Cumulative Security Update 3096448. It is, therefore, affected\nby multiple vulnerabilities :\n\n - An information disclosure vulnerability exists due to\n improper handling of objects in memory. A remote\n attacker can exploit this, via a specially crafted\n website, to disclose arbitrary memory content.\n (CVE-2015-6057)\n\n - A cross-site scripting filter bypass vulnerability\n exists due to improper disabling of an HTML attribute in\n otherwise appropriately filtered HTTP response data. A\n remote attacker can exploit this vulnerability by\n convincing a user to visit a website containing\n specially crafted content, resulting in the execution of\n arbitrary script code in the wrong security context.\n (CVE-2015-6058)\");\n script_set_attribute(attribute:\"see_also\", value:\"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2015/ms15-107\");\n script_set_attribute(attribute:\"solution\", value:\n\"Microsoft has released a set of patches for Windows 10.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2015-6057\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/10/13\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/10/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/10/13\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:edge\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"smb_reg_query.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');\n\nbulletin = 'MS15-107';\nkb = '3096448'; # Cumulative update for Windows 10: October 13, 2015\n\nkbs = make_list(kb);\nif (get_kb_item('Host/patch_management_checks')) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_WARNING);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nget_kb_item_or_exit('SMB/WindowsVersion', exit_code:1);\n\n# Server core is not affected\nif (hotfix_check_server_core() == 1) audit(AUDIT_WIN_SERVER_CORE);\n\nif (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nshare = hotfix_get_systemdrive(exit_on_fail:TRUE, as_share:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n # Windows 10\n hotfix_is_vulnerable(os:\"10\", sp:0, file:\"edgehtml.dll\", version:\"11.0.10240.16549\", dir:\"\\system32\", bulletin:bulletin, kb:kb)\n)\n{\n set_kb_item(name:\"www/0/XSS\", value:TRUE);\n set_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_warning();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, 'affected');\n}\n", "naslFamily": "Windows : Microsoft Bulletins", "pluginID": "86372", "cpe": ["cpe:/o:microsoft:windows", "cpe:/a:microsoft:edge"], "scheme": null}

{"cve": [{"lastseen": "2019-05-29T18:14:43", "bulletinFamily": "NVD", "description": "Microsoft Edge mishandles HTML attributes in HTTP responses, which allows remote attackers to bypass a cross-site scripting (XSS) protection mechanism via unspecified vectors, aka \"Microsoft Edge XSS Filter Bypass.\"", "modified": "2018-10-12T22:10:00", "id": "CVE-2015-6058", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6058", "published": "2015-10-14T01:59:00", "title": "CVE-2015-6058", "type": "cve", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2019-05-29T18:14:43", "bulletinFamily": "NVD", "description": "Microsoft Edge allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka \"Microsoft Edge Information Disclosure Vulnerability.\"", "modified": "2018-10-12T22:10:00", "id": "CVE-2015-6057", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6057", "published": "2015-10-14T01:59:00", "title": "CVE-2015-6057", "type": "cve", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}], "symantec": [{"lastseen": "2018-03-12T06:25:13", "bulletinFamily": "software", "description": "### Description\n\nMicrosoft Edge is prone to an information disclosure vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted webpage. Successful exploits will allow attackers to obtain sensitive information that may aid in further attacks.\n\n### Technologies Affected\n\n * Microsoft Edge \n * Microsoft Windows 10 for 32-bit Systems \n * Microsoft Windows 10 for x64-based Systems \n\n### Recommendations\n\n**Run all software as a nonprivileged user with minimal access rights.** \nTo reduce the impact of latent vulnerabilities, always run nonadministrative software as an unprivileged user with minimal access rights.\n\n**Deploy network intrusion detection systems to monitor network traffic for malicious activity.** \nDeploy NIDS to monitor network traffic for signs of anomalous or suspicious activity. This includes but is not limited to requests that include NOP sleds and unexplained incoming and outgoing traffic. This may indicate exploit attempts or activity that results from successful exploits\n\n**Do not follow links provided by unknown or untrusted sources.** \nWeb users should be cautious about following links to sites that are provided by unfamiliar or suspicious sources. Filtering HTML from emails may help remove a possible vector for transmitting malicious links to users.\n\nUpdates are available. Please see the references or vendor advisory for more information.\n", "modified": "2015-10-13T00:00:00", "published": "2015-10-13T00:00:00", "id": "SMNTC-76980", "href": "https://www.symantec.com/content/symantec/english/en/security-center/vulnerabilities/writeup.html/76980", "type": "symantec", "title": "Microsoft Edge CVE-2015-6057 Information Disclosure Vulnerability", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}, {"lastseen": "2018-03-14T22:39:20", "bulletinFamily": "software", "description": "### Description\n\nMicrosoft Edge is prone to a security-bypass vulnerability. Successful exploits will allow attackers to bypass the cross-site scripting filter and gain access to sensitive information; This may aid in further attacks.\n\n### Technologies Affected\n\n * Microsoft Edge \n * Microsoft Windows 10 for 32-bit Systems \n * Microsoft Windows 10 for x64-based Systems \n\n### Recommendations\n\n**Run all software as a nonprivileged user with minimal access rights.** \nWhen possible, run all software as a user with minimal privileges and limited access to system resources. Use additional precautions such as restrictive environments to insulate software that may potentially handle malicious content.\n\n**Deploy network intrusion detection systems to monitor network traffic for malicious activity.** \nDeploy NIDS to monitor network traffic for signs of anomalous or suspicious activity. This may indicate exploit attempts or activity that results from successful exploits.\n\n**Do not follow links provided by unknown or untrusted sources.** \nWeb users should be cautious about following links to sites that are provided by unfamiliar or suspicious sources. Filtering HTML from emails may help remove a possible vector for transmitting malicious links to users.\n\n**Set web browser security to disable the execution of script code or active content.** \nSince a successful exploit of this issue requires malicious code to execute in web clients, consider disabling support for script code and active content within the client browser. Note that this mitigation tactic might adversely affect legitimate websites that rely on the execution of browser-based script code.\n\nUpdates are available. Please see the references or vendor advisory for more information.\n", "modified": "2015-10-13T00:00:00", "published": "2015-10-13T00:00:00", "id": "SMNTC-76990", "href": "https://www.symantec.com/content/symantec/english/en/security-center/vulnerabilities/writeup.html/76990", "type": "symantec", "title": "Microsoft Edge CVE-2015-6058 Cross Site Scripting Filter Security Bypass Vulnerability", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}], "openvas": [{"lastseen": "2019-05-29T18:35:39", "bulletinFamily": "scanner", "description": "This host is missing a critical security\n update according to Microsoft Bulletin MS15-107.", "modified": "2019-05-03T00:00:00", "published": "2016-01-06T00:00:00", "id": "OPENVAS:1361412562310807024", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310807024", "title": "Microsoft Edge Multiple Information Disclosure Vulnerabilities (3096448)", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Microsoft Edge Multiple Information Disclosure Vulnerabilities (3096448)\n#\n# Authors:\n# Rinu Kuriakose <krinu@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2016 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.807024\");\n script_version(\"2019-05-03T10:54:50+0000\");\n script_cve_id(\"CVE-2015-6057\", \"CVE-2015-6058\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_tag(name:\"last_modification\", value:\"2019-05-03 10:54:50 +0000 (Fri, 03 May 2019)\");\n script_tag(name:\"creation_date\", value:\"2016-01-06 15:54:16 +0530 (Wed, 06 Jan 2016)\");\n script_tag(name:\"qod_type\", value:\"registry\");\n script_name(\"Microsoft Edge Multiple Information Disclosure Vulnerabilities (3096448)\");\n\n script_tag(name:\"summary\", value:\"This host is missing a critical security\n update according to Microsoft Bulletin MS15-107.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exist due to,\n\n - Microsoft Edge improperly discloses the contents of its memory.\n\n - Cross-site scripting (XSS) filter bypass exists in the way that Microsoft\n Edge disables an HTML attribute in otherwise appropriately filtered HTTP\n response data. The bypass could allow initially disabled scripts to run in\n the wrong security context.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow remote\n attackers to obtain sensitive information from process memory and to bypass a\n cross-site scripting (XSS) protection mechanism leading to information\n disclosure.\");\n\n script_tag(name:\"affected\", value:\"Microsoft Edge on Windows 10 x32/x64\");\n\n script_tag(name:\"solution\", value:\"The vendor has released updates. Please see the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_xref(name:\"URL\", value:\"https://support.microsoft.com/en-us/kb/3096448\");\n script_xref(name:\"URL\", value:\"https://technet.microsoft.com/library/security/MS15-107\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"Windows : Microsoft Bulletins\");\n script_dependencies(\"gb_microsoft_edge_detect.nasl\");\n script_require_ports(139, 445);\n script_mandatory_keys(\"MS/Edge/Installed\");\n\n exit(0);\n}\n\ninclude(\"smb_nt.inc\");\ninclude(\"secpod_reg.inc\");\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\ninclude(\"secpod_smb_func.inc\");\n\nif(hotfix_check_sp(win10:1, win10x64:1) <= 0){\n exit(0);\n}\n\nsysPath = smb_get_system32root();\nif(!sysPath ){\n exit(0);\n}\n\ndllVer = fetch_file_version(sysPath:sysPath, file_name:\"edgehtml.dll\");\nif(!dllVer){\n exit(0);\n}\n\nif(hotfix_check_sp(win10:1, win10x64:1) > 0)\n{\n if(version_is_less(version:dllVer, test_version:\"11.0.10240.16549\"))\n {\n report = 'File checked: ' + sysPath + \"\\edgehtml.dll\" + '\\n' +\n 'File version: ' + dllVer + '\\n' +\n 'Vulnerable range: Less than 11.0.10240.16549\\n' ;\n security_message(data:report);\n exit(0);\n }\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}], "mskb": [{"lastseen": "2019-08-22T18:24:14", "bulletinFamily": "microsoft", "description": "<html><body><p>Resolves a vulnerability in Microsoft Edge that could allow remote code execution if a user views a specially crafted webpage in Microsoft Edge.</p><h2>Summary</h2><div class=\"kb-summary-section section\">This security update resolves a vulnerability in Microsoft Edge. The vulnerability could allow remote code execution if a user views a specially crafted webpage in Microsoft Edge. To learn more about the vulnerability, see <a href=\"https://technet.microsoft.com/library/security/ms15-107\" id=\"kb-link-2\" target=\"_self\">Microsoft Security Bulletin MS15-107</a>. <span></span><br/></div><h2>How to obtain and install the update</h2><div class=\"kb-resolution-section section\"><h3 class=\"sbody-h3\">Windows Update</h3>This update is available through Windows Update/Microsoft Update. When you turn on automatic updating, this update will be downloaded and installed automatically. For more information about how to turn on automatic updating, see <a href=\"https://www.microsoft.com/security/pc-security/updates.aspx\" id=\"kb-link-3\" target=\"_self\">Get security updates automatically</a>.</div><h2>More Information</h2><div class=\"kb-moreinformation-section section\"><div class=\"faq-section\" faq-section=\"\"><div class=\"faq-panel\"><div class=\"faq-panel-heading\" faq-panel-heading=\"\"><span class=\"link-expand-image\"><span class=\"faq-chevron win-icon win-icon-ChevronUpSmall\"></span></span><span class=\"bold btn-link link-expand-text\"><span class=\"bold btn-link\">Security update deployment information</span></span></div><div class=\"faq-panel-body\" faq-panel-body=\"\"><span><div class=\"kb-collapsible kb-collapsible-collapsed\"><h4 class=\"sbody-h4\">Windows 10 (all editions)</h4><h5 class=\"sbody-h5 text-subtitle\">Reference Table</h5>The following table contains the security update information for this software. <div class=\"table-responsive\"><table class=\"sbody-table table\"><tr class=\"sbody-tr\"><td class=\"sbody-td\"><span class=\"text-base\">Security update file name</span></td><td class=\"sbody-td\">For Microsoft Edge in all supported 32-bit editions of Windows 10:<br/><span class=\"text-base\">Windows10.0-KB3097617-x86.msu</span></td></tr><tr class=\"sbody-tr\"><td class=\"sbody-td\"></td><td class=\"sbody-td\">For Microsoft Edge in all supported x64-based editions of Windows 10:<br/><span class=\"text-base\">Windows10.0-KB3097617-x64.msu</span></td></tr><tr class=\"sbody-tr\"><td class=\"sbody-td\"><span class=\"text-base\">Installation switches</span></td><td class=\"sbody-td\">See <a href=\"https://support.microsoft.com/help/934307\" id=\"kb-link-4\" target=\"_self\">Microsoft Knowledge Base Article 934307</a></td></tr><tr class=\"sbody-tr\"><td class=\"sbody-td\"><span class=\"text-base\">Restart requirement</span></td><td class=\"sbody-td\">A system restart is required after you apply this security update.</td></tr><tr class=\"sbody-tr\"><td class=\"sbody-td\"><span class=\"text-base\">Removal information</span></td><td class=\"sbody-td\">To uninstall an update installed by WUSA, use the <span class=\"text-base\">/Uninstall</span> setup switch or click <span class=\"text-base\">Control Panel</span>, click <span class=\"text-base\">System and Security</span>, click <span class=\"text-base\">Windows Update</span>, and then under See also, click <span class=\"text-base\">Installed updates</span> and select from the list of updates.</td></tr><tr class=\"sbody-tr\"><td class=\"sbody-td\"><span class=\"text-base\">File information</span></td><td class=\"sbody-td\">See <a href=\"https://support.microsoft.com/help/3096448\" id=\"kb-link-5\" target=\"_self\">Microsoft Knowledge Base Article 3096448</a></td></tr><tr class=\"sbody-tr\"><td class=\"sbody-td\"><span class=\"text-base\">Registry key verification</span></td><td class=\"sbody-td\"><span class=\"text-base\">Note</span> A registry key does not exist to validate the presence of this update.</td></tr></table></div></div><br/></span></div></div></div><div class=\"faq-section\" faq-section=\"\"><div class=\"faq-panel\"><div class=\"faq-panel-heading\" faq-panel-heading=\"\"><span class=\"link-expand-image\"><span class=\"faq-chevron win-icon win-icon-ChevronUpSmall\"></span></span><span class=\"bold btn-link link-expand-text\"><span class=\"bold btn-link\">How to obtain help and support for this security update</span></span></div><div class=\"faq-panel-body\" faq-panel-body=\"\"><span><div class=\"kb-collapsible kb-collapsible-collapsed\">Help for installing updates: <a href=\"https://support.microsoft.com/ph/6527\" id=\"kb-link-6\" target=\"_self\">Support for Microsoft Update</a><br/><br/>Security solutions for IT professionals: <a href=\"https://technet.microsoft.com/security/bb980617.aspx\" id=\"kb-link-7\" target=\"_self\">TechNet Security Troubleshooting and Support</a><br/><br/>Help for protecting your Windows-based computer from viruses and malware: <a href=\"https://support.microsoft.com/contactus/cu_sc_virsec_master\" id=\"kb-link-8\" target=\"_self\">Virus Solution and Security Center</a><br/><br/>Local support according to your country: <a href=\"https://support.microsoft.com/common/international.aspx\" id=\"kb-link-9\" target=\"_self\">International Support</a></div><br/></span></div></div></div></div></body></html>", "modified": "2015-10-13T17:31:37", "id": "KB3096448", "href": "https://support.microsoft.com/en-us/help/3096448/", "published": "2017-01-07T22:30:00", "title": "MS15-107: Cumulative security update for Microsoft Edge: October 13, 2015", "type": "mskb", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}], "kaspersky": [{"lastseen": "2019-03-21T00:15:13", "bulletinFamily": "info", "description": "### *Detect date*:\n10/12/2015\n\n### *Severity*:\nCritical\n\n### *Description*:\nMultiple serious vulnerabilities have been found in Microsoft Windows. Malicious users can exploit these vulnerabilities to bypass security restrictions, gain privileges, execute arbitrary code or obtain sensitive information.\n\n### *Affected products*:\nMicrosoft Windows Vista Service Pack 2 \nMicrosoft Windows Server 2008 Service Pack 2 \nMicrosoft Windows 7 Service Pack 1 \nMicrosoft Windows Server 2008 R2 Service Pack 1 \nMicrosoft Windows 8 \nMicrosoft Windows 8.1 \nMicrosoft Windows Server 2012 \nMicrosoft Windows Server 2012 R2 \nMicrosoft Windows RT \nMicrosoft Windows RT 8.1 \nMicrosoft Windows 10\n\n### *Solution*:\nInstall necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)\n\n### *Original advisories*:\n[CVE-2015-2549](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2015-2549>) \n[CVE-2015-2548](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2015-2548>) \n[CVE-2015-2553](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2015-2553>) \n[CVE-2015-6057](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2015-6057>) \n[CVE-2015-2515](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2015-2515>) \n[CVE-2015-2554](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2015-2554>) \n[CVE-2015-2550](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2015-2550>) \n[CVE-2015-2552](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2015-2552>) \n[CVE-2015-6058](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2015-6058>) \n\n\n### *Impacts*:\nACE \n\n### *Related products*:\n[Microsoft Windows Vista](<https://threats.kaspersky.com/en/product/Microsoft-Windows-Vista-4/>)\n\n### *CVE-IDS*:\n[CVE-2015-2549](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2549>)7.2Critical \n[CVE-2015-2548](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2548>)9.3Critical \n[CVE-2015-2553](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2553>)7.2Critical \n[CVE-2015-6057](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6057>)5.0Critical \n[CVE-2015-2515](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2515>)9.3Critical \n[CVE-2015-2554](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2554>)7.2Critical \n[CVE-2015-2550](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2550>)7.2Critical \n[CVE-2015-2552](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2552>)6.8Critical \n[CVE-2015-6058](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6058>)4.3Critical\n\n### *Microsoft official advisories*:\n\n\n### *KB list*:\n[3097617](<http://support.microsoft.com/kb/3097617>) \n[3096447](<http://support.microsoft.com/kb/3096447>) \n[3088195](<http://support.microsoft.com/kb/3088195>) \n[3096443](<http://support.microsoft.com/kb/3096443>) \n[3093513](<http://support.microsoft.com/kb/3093513>) \n[3096448](<http://support.microsoft.com/kb/3096448>) \n[3080446](<http://support.microsoft.com/kb/3080446>)", "modified": "2019-03-07T00:00:00", "published": "2015-10-12T00:00:00", "id": "KLA10674", "href": "https://threats.kaspersky.com/en/vulnerability/KLA10674", "title": "\r KLA10674Multiple vulnerabilities in Microsoft Windows ", "type": "kaspersky", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "securityvulns": [{"lastseen": "2018-08-31T11:10:02", "bulletinFamily": "software", "description": "Internet Explorer / Edge multiple security vulnerabilities, VBScript / Jscript code execution, Windows Shell code execution, kernel privilege escsalation.", "modified": "2015-10-25T00:00:00", "published": "2015-10-25T00:00:00", "id": "SECURITYVULNS:VULN:14734", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:14734", "title": "Microsoft Windows multiple security vulnerabilities", "type": "securityvulns", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}]}