CVE-2004-0475

The showHelp function in Internet Explorer 6 on Windows XP Pro allows remote attackers to execute arbitrary local .CHM files via a double backward slash "\" before the target CHM file, as demonstrated using an "ms-its" URL to ntshared.chm. NOTE: this bug may overlap CVE-2003-1041...

Microsoft Internet Explorer 5.0.1 - CSS Style Sheet Memory Corruption

source: https://www.securityfocus.com/bid/10382/info A vulnerability identified in Internet Explorer may allow an attacker to cause the application to crash. The issue presents itself when the browser attempts to process an HTML page containing a table and loads a css style sheet from a file. Thi...

Microsoft Internet Explorer 6 - HTML Form Status Bar Misrepresentation

source: https://www.securityfocus.com/bid/10023/info A vulnerability has been identified in Microsoft Internet Explorer that allows an attacker to misrepresent the status bar in the browser, allowing vulnerable users to be mislead into following a link to a malicious site. The issue presents itse...

ASPR #2004-01-20-1: Internet Explorer/Outlook double null character DoS

=====BEGIN-ACROS-REPORT===== PUBLIC ========================================================================= ACROS Security Problem Report 2004-01-20-1 ------------------------------------------------------------------------- ASPR 2004-01-20-1: Internet Explorer/Outlook double null character DoS...

Microsoft Internet Explorer 5.0.1 - LoadPicture File Enumeration

Microsoft Internet Explorer 5.0.1 - LoadPicture File Enumeration source: https://www.securityfocus.com/bid/9611/info Microsoft Internet Explorer is prone to an issue that may permit a remote site to enumerate the existence of files on the client system. This may be exploited via abuse of the...

CVE-2003-0817

Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions and read arbitrary files via an XML object...

Microsoft Internet Explorer 5 - NavigateAndFind() Cross-Zone Policy (MS04-004)

source: https://www.securityfocus.com/bid/9568/info A vulnerability has been reported in Microsoft Internet Explorer. Because of this, an attacker may be able to violate cross-zone policy. It has been reported that the issue presents itself due to a failure by Internet Explorer to remove JavaScri...

JSinject.txt

Sandblad advisory 12 - /--------------------------------------------------------------/ Title: Inject javascript url in history list revisited Date: 2004-02-03 Software: Internet Explorer Vendor: http://www.microsoft.com/ Status: Patched by MS04-004 Type: Cross site/zone scripting Impact: Reading...

CVE-2003-1025

Internet Explorer 5.01 through 6 SP1 allows remote attackers to spoof the domain of a URL via a "%01" character before an @ sign in the user@domain portion of the URL, which hides the rest of the URL, including the real site, in the address bar, aka the "Improper URL Canonicalization Vulnerabilit...

CVE-2003-0816

Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions by 1 using the NavigateAndFind method to load a file: URL containing Javascript, as demonstrated by NAFfileJPU, 2 using the window.open method to load a file: URL containing Javascript, as demonstrated using...

CVE-2003-1028

The download function of Internet Explorer 6 SP1 allows remote attackers to obtain the cache directory name via an HTTP response with an invalid ContentType and a .htm file, which could allow remote attackers to bypass security mechanisms that rely on random names, as demonstrated by threadid1000...

Microsoft Internet Explorer does not properly display URLs

Overview Microsoft Internet Explorer does not properly display the location of HTML documents. An attacker could exploit this behavior to mislead users into revealing sensitive information. Description Web browsers frequently display the Uniform Resource Locator URL in the address bar. Users expe...

Openwares.org Internet Explorer Patch Buffer Overflow Vulnerability

Description It has been reported that the Internet Explorer patch supplied by Openwares.org for the Multiple Browser URI Display Obfuscation Weakness BID 9182 may be prone to a buffer overflow condition that may allow an attacker to execute arbitrary code on a vulnerable system in order to gain...

CVE-2003-0838

Internet Explorer allows remote attackers to bypass zone restrictions to inject and execute arbitrary programs by creating a popup window and inserting ActiveX object code with a "data" tag pointing to the malicious code, which Internet Explorer treats as HTML or Javascript, but later executes as...

Microsoft Internet Explorer Mouse Click Event Hijacking Vulnerability

Description A vulnerability exists in Internet Explorer when handling specific DHTML events, allowing a malicious Web page to intercept mouse click events to perform unintended drag and drop operations. In particular, it is possible to simulate a mouse drag and drop event through use of the moveB...

Microsoft Internet Explorer XML Object Zone Restriction Bypass Vulnerability

Description Microsoft has announced that a vulnerability exists in Internet Explorer when handling malicious XML objects. The problem is said to occur due to Internet Explorer failing to validate a supplied path when binding local data to the XML document. As a result, a malicious HTML containing...

Microsoft Internet Explorer Self Executing HTML Arbitrary Code Execution Vulnerability

...

Redirection and refresh parses local file

Redirection and refresh parses local file "that's all" is the end of file if you are in a hurry tested OS:WinXp Microsoft Internet Explorer v6.Sp1; up-to-date on 2003/10/30 demo http://www.safecenter.net/UMBRELLAWEBV4/IredirNrefresh/IredirNrefresh-MyPage.htm exp if an iframe whose SRC points to a...

Internet Explorer and Opera local zone restriction bypass

Internet Explorer and Opera local zone restriction bypass. =--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--= ---------------------- Vendor Information: ---------------------- Homepage : http://www.microsoft.com Vendor : informed Mailed advisory: 23/10/03 Vender Response : None yet...

Microsoft Internet Explorer 6 - Double Slash Cache Zone Bypass

Microsoft Internet Explorer 6 - Double Slash Cache Zone Bypass source: https://www.securityfocus.com/bid/8980/info A vulnerability has been reported in Internet Explorer that may allow cached Internet content to be rendered in the My Computer zone. It is possible to exploit this issue by includin...