[SA12765] Microsoft Internet Explorer Disclosure of Sensitive XML Information

TITLE: Microsoft Internet Explorer Disclosure of Sensitive XML Information SECUNIA ADVISORY ID: SA12765 VERIFY ADVISORY: http://secunia.com/advisories/12765/ CRITICAL: Less critical IMPACT: Exposure of sensitive information WHERE: From remote SOFTWARE: Microsoft Internet Explorer 6...

CVE-2004-0839

Internet Explorer in Windows XP SP2, and other versions including 5.01 and 5.5, allows remote attackers to install arbitrary programs via a web page that uses certain styles and the AnchorClick behavior, popup windows, and drag-and-drop capabilities to drop the program in the local startup folder...

CVE-2001-0643

Internet Explorer 5.5 does not display the Class ID CLSID when it is at the end of the file name, which could allow attackers to trick the user into executing dangerous programs by making it appear that the document is of a safe file type...

CVE-2002-1188

Internet Explorer 5.01 through 6.0 allows remote attackers to identify the path to the Temporary Internet Files folder and obtain user information such as cookies via certain uses of the OBJECT tag, which are not subjected to the proper security checks, aka "Temporary Internet Files folders Name...

What A Drag! -revisited-

Most people i talked to consider the Internet Explorer drag and drop vulnerability found by http-equiv not as a serious problem, because it requires some user interaction and the press pushes this topic way to much as the "first security problem in SP2". In an article on BetaNews even Microsoft...

CVE-2004-0212

Stack-based buffer overflow in the Task Scheduler for Windows 2000 and XP, and Internet Explorer 6 on Windows NT 4.0, allows local or remote attackers to execute arbitrary code via a .job file containing long parameters, as demonstrated using Internet Explorer and accessing a .job file on an...

Microsoft Internet Explorer 6 - mms Protocol Handler Executable Command Line Injection

source: https://www.securityfocus.com/bid/10879/info A vulnerability has been reported to exist in Microsoft Internet Explorer that may allow remote attackers to pass arbitrary command line arguments to an application associated with the mms: URI protocol handler. Windows Media Player is the...

Microsoft Internet Explorer - mshtml.dll Remote Null Pointer Crash

Microsoft Internet Explorer - mshtml.dll Remote Null Pointer Crash Right Click aOn Me And Click "Save Target As" // milw0rm.com 2004-08-04...

Microsoft Internet Explorer contains an integer overflow in the processing of bitmap files

Overview A vulnerability in Microsoft Internet Explorer could allow a remote attacker to execute arbitrary code on a vulnerable system. Description Microsoft Internet Explorer IE is a web browser. An integer overflow vulnerability has been discovered in the way that Internet Explorer processes...

MSIE Overly Trusted Location Variant Method Cache Vulnerability

This vulnerability as well as many more can be found at http://www.greyhats.cjb.net Overly Trusted Location Variant Method Cache Vulnerability Tested IEXPLORE.EXE file version 6.0.2800.1106 MSHTML.DLL file version 6.00.2800.1400 Microsoft Windows XP sp1 Discussion Apparently, Internet Explorer...

Microsoft Internet Explorer - Overly Trusted Location Cache

Microsoft Internet Explorer - Overly Trusted Location Cache Overly Trusted Location Variant Method Cache Vulnerability GO! This vulnerability seems to be unstable. For some reason, it crashes my internet explorer unless the exploit is executed onlo +ad and even then it crashes sometimes. var...

Microsoft Internet Explorer - Remote Wscript.Shell

Microsoft Internet Explorer - Remote Wscript.Shell ----------------------------------------------------- default.htm ------------------------------------------------------- function InjectedDuringRedirection...

Microsoft Internet Explorer 5.0.1 - Popup.show Mouse Event Hijacking

Microsoft Internet Explorer 5.0.1 - Popup.show Mouse Event Hijacking source: https://www.securityfocus.com/bid/10690/info A vulnerability exists in Microsoft Internet Explorer that may permit a malicious Web page to hijack mouse events. This could potentially be exploited to trick an unsuspecting...

Microsoft Internet Explorer - Remote Application.Shell

function InjectedDuringRedirection showModalDialog'md.htm',window,"dialogTop:-10000;dialogLeft:-10000;dialogHeight:1; dialogWidth:1;".location="vbscript:"""; setTimeout"myiframe.execScriptInjectedDuringRedirection.toString",100; setTimeout"myiframe.execScript'InjectedDuringRedirection' ",101;...

MS KB870669: ADODB.Stream object from Internet Explorer

The remote host contains a vulnerability in IE. The ADODB.Stream object can be used by a malicious web page to read and write to local files. An attacker could use this flaw to gain access to the data on the remote host. To exploit this flaw, an attacker would need to set up a rogue website and...

Microsoft Internet Explorer 6 - Shell.Application Object Script Execution

Microsoft Internet Explorer 6 - Shell.Application Object Script Execution source: https://www.securityfocus.com/bid/10652/info Microsoft Internet Explorer is reported prone to a security weakness that may permit malicious HTML documents the ability to execute script code. This script code has the...

Microsoft Internet Explorer 6 - HREF Save As Denial of Service

Microsoft Internet Explorer 6 - HREF Save As Denial of Service source: https://www.securityfocus.com/bid/10552/info A vulnerability is reported to exist in Internet Explorer that may allow an attacker to cause the application to crash. The issue presents itself when a user attempts to invoke the...

Microsoft Internet Explorer 5.0.1 - Wildcard DNS Cross-Site Scripting

Microsoft Internet Explorer 5.0.1 - Wildcard DNS Cross-Site Scripting source: https://www.securityfocus.com/bid/10554/info Microsoft Internet Explorer is reported to contain a cross-site scripting vulnerability for sites that have a wildcard DNS entry. A web server with a wildcard DNS entry will...

Microsoft Internet Explorer 5.0.1 / Opera 7.51 - URI Obfuscation

source: https://www.securityfocus.com/bid/10517/info A weakness is reported in Microsoft Internet Explorer and Opera allowing an attacker to obfuscate the URI of a link. This could facilitate the impersonation of legitimate web sites in order to steal sensitive information from unsuspecting users...

CVE-2004-0526

Unknown versions of Internet Explorer and Outlook allow remote attackers to spoof a legitimate URL in the status bar via A HREF tags with modified "alt" values that point to the legitimate site, combined with an image map whose href points to the malicious site, which facilitates a "phishing"...