CVE-2017-0065

Microsoft Edge allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability." This vulnerability is different from those described in CVE-2017-0009, CVE-2017-0011, CVE-2017-0017, and CVE-2017-0068...

CVE-2017-0135

Microsoft Edge allows remote attackers to bypass the Same Origin Policy for HTML elements in other browser windows, aka "Microsoft Edge Security Feature Bypass Vulnerability." This vulnerability is different from those described in CVE-2017-0066 and CVE-2017-0140...

CVE-2017-0135

CVE-2017-0135 describes a security feature bypass in Microsoft Edge enabling a SOP bypass for HTML elements across browser windows. The core official description notes it is distinct from CVE-2017-0066/0140. A connected article discusses bypassing Edge’s XSS filter/CSP handling, but the provided ...

CVE-2017-0034

A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. The vulnerability could corrupt memory in a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability...

CVE-2017-0011

Technical details for CVE-2017-0011 are not provided in the supplied documents; no affected product/version or remediation specifics are specified. Monitor for updates.

CVE-2017-0023

CVE-2017-0023 is a remote code execution vulnerability in the Microsoft Edge PDF Library, affecting Windows 8.1, Windows Server 2012/2012 R2, Windows RT 8.1, and Windows 10 (variants such as 1511/1607). Public reports describe memory corruption in the PDF rendering library leading to arbitrary co...

CVE-2017-0034

Summary: CVE-2017-0034 is a remote code execution vulnerability in Microsoft Edge stemming from improper handling of objects in memory, enabling an attacker to run code in the context of the current user (potentially with administrative rights). The issue is tied to Edge (and EdgeHTML-based compo...

CVE-2017-0011

Microsoft Edge allows remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Edge Information Disclosure Vulnerability." This vulnerability is different from those described in CVE-2017-0009, CVE-2017-0017, CVE-2017-0065, and CVE-2017-0068...

CVE-2017-0069

Microsoft Edge allows remote attackers to spoof web content via a crafted web site, aka "Microsoft Edge Spoofing Vulnerability." This vulnerability is different from those described in CVE-2017-0012 and CVE-2017-0033...

CVE-2017-0023

The PDF library in Microsoft Edge; Windows 8.1; Windows Server 2012 and R2; Windows RT 8.1; and Windows 10, 1511, and 1607 allows remote attackers to execute arbitrary code via a crafted PDF file, aka "Microsoft PDF Remote Code Execution Vulnerability."...

CVE-2017-0066

Microsoft Edge allows remote attackers to bypass the Same Origin Policy for HTML elements in other browser windows, aka "Microsoft Edge Security Feature Bypass Vulnerability." This vulnerability is different from those described in CVE-2017-0135 and CVE-2017-0140...

CVE-2017-0068

Technical details (affected product/component/versions/root cause/impact) for CVE-2017-0068 are not publicly provided in the supplied documents. Monitor for updates in connected sources to capture concrete details.

CVE-2017-0017

The RegEx class in the XSS filter in Microsoft Edge allows remote attackers to conduct cross-site scripting XSS attacks and obtain sensitive information via unspecified vectors, aka "Microsoft Edge Information Disclosure Vulnerability." This vulnerability is different from those described in...

CVE-2017-0140

Microsoft Edge allows remote attackers to bypass the Same Origin Policy for HTML elements in other browser windows, aka "Microsoft Edge Security Feature Bypass Vulnerability." This vulnerability is different from those described in CVE-2017-0066 and CVE-2017-0135...

CVE-2017-0068

Browsers in Microsoft Edge allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Microsoft Edge Information Disclosure Vulnerability." This vulnerability is different from those described in CVE-2017-0009, CVE-2017-0011, CVE-2017-0017, and...

CVE-2017-0069

Technical details about CVE-2017-0069 are not publicly available in the provided documents. Monitor updates from official advisories to obtain affected products, impact, and remediation.

Microsoft IE And Microsoft Edge Flash Player Multiple Vulnerabilities (3167685)

This host is missing a critical security update according to Microsoft Bulletin MS16-083. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Hackers Take Down Reader, Safari, Edge, Ubuntu Linux at Pwn2Own 2017

Hackers took down Adobe Reader, Apple Safari, Microsoft Edge, and Ubuntu Linux over the course of 11 hours on Wednesday, the first day of Pwn2Own, the annual hacking competition held in tandem with the CanSecWest conference in Vancouver. Contestants with the Chinese security firm Qihoo 360 were t...

Microsoft Edge read:// urlhandler Information Disclosure Vulnerability (CVE-2017-0065 )

This exploit was reported to Microsoft and I was acknowledged for doing so. The exploit has been patched on March 14th 2017 under names cve-2017-0065 and MS17-007 and will not work if related patches are applied. Sourcecode is provided for educational purposes only. General This exploit requires...

Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CNVD-2017-03378)

Microsoft Edge is a web browser developed by Microsoft and is the default browser that comes with the Windows 10 operating system.Scripting Engine is one of the JavaScript engine components. A memory corruption vulnerability exists in the Scripting Engine component in Microsoft Edge. A remote...