PT-2016-2590

Name of the Vulnerable Software and Affected Versions Internet Explorer versions prior to the fixed version Description The issue is caused by a buffer overflow. It allows a remote attacker to execute arbitrary code using a specially crafted web page. Multiple remote code execution vulnerabilitie...

Microsoft Internet Explorer and Edge CVE-2016-3289 Remote Memory Corruption Vulnerability

Description Microsoft Internet Explorer and Edge are prone to a remote memory-corruption vulnerability due to a use-after-free error. Specifically, this issue occur within the 'CAnchor' object. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted web page...

CVE-2016-3293: Improper Restriction of Operations within the Bounds of a Memory Buffer

Microsoft Internet Explorer 9 through 11 and Edge allow remote attackers to execute arbitrary code via a crafted web page, aka "Microsoft Browser Memory Corruption Vulnerability."...

CVE-2016-3321: Exposure of Sensitive Information to an Unauthorized Actor

Microsoft Internet Explorer 10 and 11 load different files for attempts to open a file:// URL depending on whether the file exists, which allows local users to enumerate files via vectors involving a file:// URL and an HTML5 sandbox iframe, aka "Internet Explorer Information Disclosure...

KLA10858 Multiple vulnerabilities in Microsoft Edge and Internet Explorer

Multiple serious vulnerabilities have been found in Microsoft Internet Explorer and Edge. Malicious users can exploit these vulnerabilities to execute arbitrary code or obtain sensitive information. Below is a complete list of vulnerabilities 1. An improper memory objects handling can be exploite...

Microsoft Internet Explorer Information Disclosure (MS16-095: CVE-2016-3321)

An information disclosure vulnerability has been reported in Microsoft Internet Explorer. The vulnerability is due to an error in Microsoft Internet Explorer while handling URIs. A remote attacker can exploit this issue by enticing a user to open a specially crafted web-page with an affected...

Microsoft Internet Explorer CAnchor Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The vulnerability relates to how...

CVE-2016-3327: Exposure of Sensitive Information to an Unauthorized Actor

Microsoft Internet Explorer 9 through 11 and Edge allow remote attackers to obtain sensitive information via a crafted web page, aka "Microsoft Browser Information Disclosure Vulnerability," a different vulnerability than CVE-2016-3326...

MS16-095: Cumulative Security Update for Internet Explorer (3177356)

The version of Internet Explorer installed on the remote Windows host is missing Cumulative Security Update 3177356. It is, therefore, affected by multiple vulnerabilities, the majority of which are remote code execution vulnerabilities. An unauthenticated, remote attacker can exploit these...

CVE-2015-8935

The sapiheaderop function in main/SAPI.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 supports deprecated line folding without considering browser compatibility, which allows remote attackers to conduct cross-site scripting XSS attacks against Internet Explorer by leveraging ...

Cross site scripting

The sapiheaderop function in main/SAPI.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 supports deprecated line folding without considering browser compatibility, which allows remote attackers to conduct cross-site scripting XSS attacks against Internet Explorer by leveraging ...

CVE-2015-8935

CVE-2015-8935 affects PHP’s sapi_header_op in main/SAPI.c, where legacy line folding is allowed without considering browser compatibility. This enables remote XSS against Internet Explorer via header folding payloads such as %0A%20 or %0D%0A%20. Affected PHP branches include 5.4.x up to 5.4.38, 5...

CVE-2015-8935: Improper Neutralization of Input During Web Page Generation

The sapiheaderop function in main/SAPI.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 supports deprecated line folding without considering browser compatibility, which allows remote attackers to conduct cross-site scripting XSS attacks against Internet Explorer by leveraging ...

Internet Explorer 11 VBScript Engine Memory Corruption

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule "Internet Explorer 11 VBScript Engine Memory Corruption", 'Description' = %q This module exploits the memory corruption...

Windows A high-risk vulnerability allows a hacker in the user access to phishing pages to steal their Microsoft account and related services-vulnerability warning-the black bar safety net

! In all Windows System are the presence of a security may cause the user to visit a phishing site case leaked their Microsoft account user name, password, and Microsoft account binding and is associated with a large number of important business, this information will also be affected Including:...

ownCloud: [forum.owncloud.org] IE, Edge XSS via Request-URI

PoC Internet Explorer, Edge: https://blackfan.ru/x?r=https://forum.owncloud.org//%252e%252e blackfan.ru/x?r - simple redirection script, that necessary for exploitation HTTP Response: html Information No route found for "GET //%2e%2e"...

Internet Explorer Typed URLs

Nessus was able to generate a list URLs that were manually typed into the Internet Explorer address bar. C Tenable Network Security, Inc. include"compat.inc"; if !definedfunc"nasllevel" || nasllevel 5200 exit0, "Not Nessus 5.2+"; if description scriptid92421; scriptversion"1.6";...

Cumulative update for Windows 10 Version 1511 and Windows Server 2016 Technical Preview 4: July 12, 2016

None None...

Cumulative update for Windows 10: July 12, 2016

None None...

Neutrino EK Spotted Leveraging Patched IE Zero Day

Attackers behind the Neutrino Exploit Kit didn’t take long to co-op a recently patched Internet Explorer zero-day into its arsenal. Researchers claim the kit has been pushing CVE-2016-0189, a vulnerability that was reportedly used in targeted attacks on South Korean organizations earlier this yea...