CVE-2001-1325

Internet Explorer 5.0 and 5.5, and Outlook Express 5.0 and 5.5, allow remote attackers to execute scripts when Active Scripting is disabled by including the scripts in XML stylesheets XSL that are referenced using an IFRAME tag, possibly due to a vulnerability in Windows Scripting Host WSH...

CVE-2002-0242

Cross-site scripting vulnerability in Internet Explorer 6 earlier allows remote attackers to execute arbitrary script via an Extended HTML Form, whose output from the remote server is not properly cleansed...

Microsoft Internet Explorer 5/6 - Self-Referential Object Denial of Service

source: https://www.securityfocus.com/bid/4564/info Microsoft Internet Explorer is vulnerable to a denial of service due to an error in handling certain self-referential definitions in HTML documents. This occurs when an object of type "text/html" is specified, with the DATA field referencing the...

Re: IE allows universal Cross Site Scripting (TL#002)

Hello, This can also be exploited in IE5 and IE5.5 as well as IE6 by using a different resource file. Thor's demonstration is confined to IE6 because the resource he found to be exploitable first appeared in IE6 privacy policy. Proof of concept and HTML version:...

IE allows universal Cross Site Scripting (TL#002)

Thor Larholm security advisory TL002 ------------------------------------- By Thor Larholm, Denmark. 16 April 2002 HTML Format: http://jscript.dk/adv/TL002/ Topic: IE allows universal Cross Site Scripting. Discovery date: 18 March 2002. Severity: High Affected applications: ----------------------...

Microsoft Internet Explorer 5.56.0 - History List Script Injection

Microsoft Internet Explorer 5.56.0 - History List Script Injection source: https://www.securityfocus.com/bid/4505/info A vulnerability has been reported in some versions of Internet Explorer. It is possible to inject JavaScript code into the browser history list, and execute it within any page...

Microsoft Internet Explorer Permits Remote Command Execution Through <OBJECT> Tag

Overview Microsoft Internet Explorer IE permits the remote execution of arbitrary commands via the tag. Description A vulnerability exists in the way that Microsoft Internet Explorer IE handles tags. If the CLASSID CLSID is unrecognized, then Internet Explorer will execute arbitrary commands...

Microsoft Internet Explorer 56 Mozilla 0.80.9.x Opera 56 - JavaScript Interpreter Denial of Service

Microsoft Internet Explorer 56 Mozilla 0.80.9.x Opera 56 - JavaScript Interpreter Denial of Service source: https://www.securityfocus.com/bid/4322/info It is possible to create a loop in JavaScript which is capable of crashing various web browsers. This is due to a flaw in the JavaScript...

CVE-2001-1218

Microsoft Internet Explorer for Unix 5.0SP1 allows local users to possibly cause a denial of service crash in CDE or the X server on Solaris 2.6 by rapidly scrolling Chinese characters or maximizing the window...

CVE-2001-0667

Internet Explorer 6 and earlier, when used with the Telnet client in Services for Unix SFU 2.0, allows remote attackers to execute commands by spawning Telnet with a log file option on the command line and writing arbitrary code into an executable file which is later executed, aka a new variant o...

CVE-2001-0664

Internet Explorer 5.5 and 5.01 allows remote attackers to bypass security restrictions via malformed URLs that contain dotless IP addresses, which causes Internet Explorer to process the page in the Intranet Zone, which may have fewer security restrictions, aka the "Zone Spoofing vulnerability."...

CVE-2002-0052

Internet Explorer 6.0 and earlier does not properly handle VBScript in certain domain security checks, which allows remote attackers to read arbitrary files...

Auto file execution vulnerability in Mac OS

Auto file execution vulnerability in Mac OS http://homepage.mac.com/vmconverter/macautoexecvuln.html Overview We found a vulnerability in Mac OS and Mac OS X with Classic Environment. If victims only browse malicious web-page; 1.Browsers start automatically download a compressed disc-image file...

Security Bulletin MS02-009

---------------------------------------------------------------------- Title: Incorrect VBScript Handling in IE can Allow Web Pages to Read Local Files Date: 21 February 2002 Software: Internet Explorer Impact: Information Disclosure Max Risk: Critical Bulletin: MS02-009 Microsoft encourages...

MS02-008: XML Core Services patch (318203)

The remote host is running a version of Internet Explorer that could allow an attacker to read local files on the remote host. To exploit this flaw, an attacker would need to lure a victim on the remote system into visiting a rogue website. C Tenable Network Security, Inc. include"compat.inc"; if...

More reading of local files in MSIE

More reading of local files in MSIE Description There is a security vulnerability in IE 5.5 and 6 probably other versions as well which allows reading and sending of local files. The problem lies in the fact that you are able to access a local file's dom by calling the execScript function on a...

Microsoft Internet Explorer 5 - JavaScript Local File Enumeration (1)

Microsoft Internet Explorer 5 - JavaScript Local File Enumeration 1 source: https://www.securityfocus.com/bid/3779/info Microsoft Internet Explorer is prone to a vulnerability which may disclose sensitive information to a malicious webmaster. When script code includes a file outside of the docume...

Microsoft Internet Explorer 5 - JavaScript Local File Enumeration (1)

source: https://www.securityfocus.com/bid/3779/info Microsoft Internet Explorer is prone to a vulnerability which may disclose sensitive information to a malicious webmaster. When script code includes a file outside of the document it is embedded in and the file does not exist, the onError event...

Microsoft Internet Explorer 5 - JavaScript Local File Enumeration (2)

source: https://www.securityfocus.com/bid/3779/info Microsoft Internet Explorer is prone to a vulnerability which may disclose sensitive information to a malicious webmaster. When script code includes a file outside of the document it is embedded in and the file does not exist, the onError event...

IE https certificate attack

e-matters GmbH www.e-matters.de -= Security Advisory =- Advisory: Interner Explorer HTTPS certificate attack Release Date: 2001/12/22 Author: Stefan Esser [email protected] Application: Microsoft Internet Explorer 5.0/5.5/6.0 Severity: Vulnerability in IE's SSL Certificate handling allows...