Microsoft Internet Explorer Scripting Engine CVE-2018-8296 Remote Memory Corruption Vulnerability

Description Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed attacks will cause denial of service conditions. Technologies Affected Microsoft Internet...

Microsoft Internet Explorer and Edge CVE-2018-8288 Remote Memory Corruption Vulnerability

Description Microsoft Internet Explorer and Edge are prone to an remote memory-corruption vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted web page. Successfully exploiting this issue allows remote attackers to execute arbitrary code in...

Microsoft Internet Explorer Security Feature Bypass (CVE-2018-0949)

A security feature bypass vulnerability exists in Microsoft Internet Explorer. The vulnerability is due to improper implementation of the mixed content warning security feature. A remote attacker can exploit this issue by enticing a user to open a specially crafted web-page with an affected versi...

Microsoft Internet Explorer Scripting Engine CVE-2018-8242 Remote Memory Corruption Vulnerability

Description Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed attacks will cause denial of service conditions. Internet Explorer 9, 10 and 11 are...

KB4338819: Windows 10 Version 1803 and Windows Server Version 1803 July 2018 Security Update

The remote Windows host is missing security update 4338819. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability exists in .NET Framework which could allow an attacker to elevate their privilege level. CVE-2018-8202 - A security feature bypass...

KLA12551 Multiple vulnerabilities in Microsoft Products (ESU)

Multiple vulnerabilities were found in Microsoft Products Extended Security Update. Malicious users can exploit these vulnerabilities to obtain sensitive information, cause denial of service, bypass security restrictions, gain privileges, spoof user interface, execute arbitrary code. Below is a...

Privilege Escalation

microsoft.chakracore is vulnerable to privilege escalation. This happens when the regex parser does not properly handle a regex with more than 2^15 capturing groups, causing an integer overflow that can allow a non-privileged user to gain the rights of current user. This CVE ID is different from...

Remote Code Execution (RCE)

microsoft.chakracore is vulnerable to remote code execution. This happens because the scripting engine does not properly handle the objects in memory, causing memory corruption. This CVE ID is different from CVE-2017-11886, CVE-2017-11889, CVE-2017-11890, CVE-2017-11893, CVE-2017-11894,...

Privilege Escalation

microsoft.chakracore is vulnerable to privilege escalation. This happens because the application does not properly initialize the array during regex construction in RegexCompileTime.cpp, leading to memory corruption which can allow an attacker to gain user rights and other possible attacks such a...

Remote Code Execution (RCE)

microsoft.chakracore is vulnerable to remote code execution. The scripting engine does not properly handle the objects in memory, causing memory corruption which could allow an attacker to execute code in the context of the current user. This CVE ID is different from CVE-2018-0758, CVE-2018-0762,...

The vulnerability of the JavaScript script handler ChakraCore in Microsoft Edge and Internet Explorer browsers allows a perpetrator to execute arbitrary code.

The vulnerability of the JavaScript script handler ChakraCore in Microsoft Edge and Internet Explorer browsers is caused by an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Information Leakage

microsoft.chakracore is vulnerable to information leakage. This happens because the finalName parameter in the ConstructName function of JavascriptObject.cpp can contain null characters in between, leaving part of it uninitialized. This CVE ID is unique from CVE-2017-11887 and CVE-2017-11906.This...

Remote Code Execution (RCE) Via Memory Corruption

microsoft.chakracore is vulnerable to remote code execution via memory corruption vulnerability. This happens when an attacker inputs a large numeric or spread array literal to ByteCodeGenerator, leading to an out-of-bounds write. This CVE ID is different from CVE-2017-11886, CVE-2017-11889,...

Delving deep into VBScript

In late April we found and wrote a description of CVE-2018-8174, a new zero-day vulnerability for Internet Explorer that was picked up by our sandbox. The vulnerability uses a well-known technique from the proof-of-concept exploit CVE-2014-6332 that essentially "corrupts" two memory objects and...

The vulnerability of Internet Explorer’s JavaScript script handlers allows a hacker to execute arbitrary code.

The vulnerability of Internet Explorer’s JavaScript script handlers arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafted web page or Microsoft Office document...

The vulnerability of Internet Explorer’s JavaScript script handlers allows a hacker to execute arbitrary code.

The vulnerability of Internet Explorer’s JavaScript script handlers arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafted web page or Microsoft Office document...

The vulnerability of the JavaScript script handler ChakraCore in browsers Internet Explorer and Microsoft Edge allows a hacker to execute arbitrary code.

The vulnerability of the JavaScript script handler ChakraCore in browsers Internet Explorer and Microsoft Edge arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafted web...

The vulnerability of the JavaScript script handler ChakraCore in browsers Internet Explorer and Microsoft Edge allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of ChakraCore JavaScript handlers in browsers Internet Explorer and Microsoft Edge is related to errors in memory object handling. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information...

The vulnerability of JavaScript script handlers in Internet Explorer allows a perpetrator to execute arbitrary code.

The vulnerability of JavaScript script handlers in Internet Explorer arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafted web page or Microsoft Office document...

Microsoft Windows: IE security prompt for Windows Installer scripts

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winieinstallerscripts.nasl 11363 2018-09-12 13:46:05Z emoss $ Check value for Prevent Internet Explorer security prompt for Windows Installer scripts Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH,...