CVE-2002-1217

Cross-Frame scripting vulnerability in the WebBrowser control as used in Internet Explorer 5.5 and 6.0 allows remote attackers to execute arbitrary code, read arbitrary files, or conduct other unauthorized activities via script that accesses the Document property, which bypasses and domain...

Thor Larholm security advisory TL#004

Thor Larholm security advisory TL004 Topic: Windows Help buffer overflow Discovery date: 31 July 2002 Affected applications Microsoft Windows 98 Microsoft Windows 98 Second Edition Microsoft Windows Millennium Edition Microsoft Windows NT 4.0 Microsoft Windows NT 4.0, Terminal Server Edition...

CVE-2002-0696

Microsoft Visual FoxPro 6.0 does not register its associated files with Internet Explorer, which allows remote attackers to execute Visual FoxPro applications without warning via HTML that references specially-crafted filenames...

Microsoft Internet Explorer 5 - Document Reference Zone Bypass

Microsoft Internet Explorer 5 - Document Reference Zone Bypass source: https://www.securityfocus.com/bid/5841/info A vulnerability has been reported in Microsoft Internet Explorer that may allow for remote attackers to execute script code in the context of other domains/security Zones. The cause...

Microsoft Internet Explorer allows read access to local files via incorrect VBScript handling

Overview A vulnerability in the cross-domain frame security model of Internet Explorer may allow remote attackers to view the contents of local files when a user views a malicious web page. Description There's a vulnerability in the cross-domain frame security model of Internet Explorer that may...

CVE-2002-0980

The Web Folder component for Internet Explorer 5.5 and 6.0 writes an error message to a known location in the temporary folder, which allows remote attackers to execute arbitrary code by injecting it into the error message, then referring to the error message file via a mhtml: URL...

Who framed Internet Explorer (GM#010-IE)

GreyMagic Security Advisory GM010-IE ===================================== By GreyMagic Software, Israel. 09 Sep 2002. Available in HTML format at http://security.greymagic.com/adv/gm010-ie/. Topic: Who framed Internet Explorer. Discovery date: 04 Aug 2002. Affected applications:...

CVE-2002-0976

Internet Explorer 4.0 and later allows remote attackers to read arbitrary files via a web page that accesses a legacy XML Datasource applet com.ms.xml.dso.XMLDSO.class and modifies the base URL to point to the local system, which is trusted by the applet...

Microsoft Internet Explorer 5/6 - XML Redirect File Disclosure

source: https://www.securityfocus.com/bid/5560/info A flaw in Microsoft Internet Explorer may reveal the entire contents of XML files and partial contents of other files to attackers. This vulnerability allows an attacker to read the entire contents of XML files, and fragments of other files,...

Microsoft Internet Explorer 4/5/6 - XML Datasource Applet File Disclosure

source: https://www.securityfocus.com/bid/5490/info A problem in Microsoft Internet Explorer could lead to the disclosure of sensitive information. Due to the design of the datasource applet, it may be possible for a user to view the contents of local files via a remote page. By building a...

Google Toolbar 1.1.60 - Search Function Denial of Service

source: https://www.securityfocus.com/bid/5477/info Reportedly, when the Google Toolbar receives a search query it may cause Microsoft Internet Explorer to crash. When a user views a malicious web page it will cause the Google Toolbar to throw an exception in 'oleaut32.dll'. // it raises the...

[SECURITY] [DSA 147-1] New mailman packages fix cross-site scripting problem

-------------------------------------------------------------------------- Debian Security Advisory DSA 147-1 [email protected] http://www.debian.org/security/ Martin Schulze August 8th, 2002 - -------------------------------------------------------------------------- Package : mailman...

CVE-2002-0025

Internet Explorer 5.01, 5.5 and 6.0 does not properly handle the Content-Type HTML header field, which allows remote attackers to modify which application is used to process a document...

CVE-2002-0461

Internet Explorer 5.01 through 6 allows remote attackers to cause a denial of service application crash via Javascript in a web page that calls location.replace on itself, causing a loop...

Microsoft Internet Explorer may handle certain web pages in an incorrect, less restrictive security zone (MS02-023)

Overview Microsoft Internet Explorer IE may handle malformed Internet pages accessed through the NetBIOS protocol as if they belong to the IE's Intranet or Trusted Sites security zones, instead of the more restrictive Internet security zone. Description If a user views a page on the Internet that...

CVE-2002-0269

Internet Explorer 5.x and 6 interprets an object as an HTML document even when its MIME Content-Type is text/plain, which could allow remote attackers to execute arbitrary script in documents that the user does not expect, possibly through web applications that use a text/plain type to prevent...

[SNS Advisory No.48] Microsoft Internet Explorer Still Download And Execute ANY Program Automatically

---------------------------------------------------------------------- SNS Advisory No.48 Microsoft Internet Explorer Still Download And Execute ANY Program Automatically Problem first discovered: Wed, 13 Feb 2002 Published: Mon, 18 Mar 2002 Revised: Thu, 16 May 2002...

Microsoft Internet Explorer 5.0.16.0 - Content-Disposition Handling File Execution

Microsoft Internet Explorer 5.0.16.0 - Content-Disposition Handling File Execution source: https://www.securityfocus.com/bid/4752/info An issue exists in the way Microsoft Internet Explorer handles conflicting information in some HTTP headers used to describe non-HTML content. A malicious web...

Microsoft Internet Explorer 5.0.1/6.0 - Content-Disposition Handling File Execution

source: https://www.securityfocus.com/bid/4752/info An issue exists in the way Microsoft Internet Explorer handles conflicting information in some HTTP headers used to describe non-HTML content. A malicious web server may provide content with misleading values in the content-type and...

AOL Instant Messenger installer adds "http://free.aol.com" to Trusted Sites Zone in Microsoft Internet Explorer

Overview The installer for AOL Instant Messenger contains a vulnerability that weakens the security settings of Microsoft Internet Explorer. Description There is a vulnerability in the installer for AOL Instant Messenger AIM that silently adds "http://free.aol.com" to the list of Trusted Sites in...