MS06-013 Microsoft Internet Explorer createTextRange() Code Execution

This module exploits a code execution vulnerability in Microsoft Internet Explorer. Both IE6 and IE7 Beta 2 are vulnerable. It will corrupt memory in a way, which, under certain circumstances, can lead to an invalid/corrupt table pointer dereference. EIP will point to a very remote, non-existent...

Microsoft Internet Explorer array index overflow

Array index overflow for large number of HTML tag's events handlers. Vulnerability can be used for hidden malware installation...

CVE-2006-1245: Undefined Security Weakness

Buffer overflow in mshtml.dll in Microsoft Internet Explorer 6.0.2900.2180, and probably other versions, allows remote attackers to execute arbitrary code via an HTML tag with a large number of script action handlers such as onload and onmouseover, as demonstrated using onclick, aka the "Multiple...

Microsoft Internet Explorer 5.0.1 - Script Action Handler Buffer Overflow

Microsoft Internet Explorer 5.0.1 - Script Action Handler Buffer Overflow source: https://www.securityfocus.com/bid/17131/info Microsoft Internet Explorer is susceptible to a remote buffer-overflow vulnerability in 'MSHTML.DLL'. The application fails to properly bounds-check user-supplied input...

Microsoft Internet Explorer 5.0.1 - Script Action Handler Buffer Overflow

source: https://www.securityfocus.com/bid/17131/info Microsoft Internet Explorer is susceptible to a remote buffer-overflow vulnerability in 'MSHTML.DLL'. The application fails to properly bounds-check user-supplied input data before copying it into an insufficiently sized memory buffer. Remote...

Microsoft Internet Explorer IsComponentInstalled buffer overflow

Problem is fixed in Windows 2000 SP4 / Windows XP SP1...

CVE-2006-0799

Microsoft Internet Explorer allows remote attackers to spoof a legitimate URL in the status bar and conduct a phishing attack via a web page with an anchor element with a legitimate "href" attribute, a form whose action points to a malicious URL, and an INPUT submit element that is modified to lo...

CVE-2006-0799: Undefined Security Weakness

Microsoft Internet Explorer allows remote attackers to spoof a legitimate URL in the status bar and conduct a phishing attack via a web page with an anchor element with a legitimate "href" attribute, a form whose action points to a malicious URL, and an INPUT submit element that is modified to lo...

CVE-2006-0753: Undefined Security Weakness

Memory leak in Microsoft Internet Explorer 6 for Windows XP Service Pack 2 allows remote attackers to cause a denial of service memory consumption via JavaScript that uses setInterval to repeatedly call a function to set the value of window.status...

CVE-2005-4717: Undefined Security Weakness

Microsoft Internet Explorer 6.0 on Windows NT 4.0 SP6a, Windows 2000 SP4, Windows XP SP1, Windows XP SP2, and Windows Server 2003 SP1 allows remote attackers to cause a denial of service client crash via a certain combination of a malformed HTML file and a CSS file that triggers a null dereferenc...

CVE-2005-3240: Concurrent Execution using Shared Resource with Improper Synchronization

Race condition in Microsoft Internet Explorer allows user-assisted attackers to overwrite arbitrary files and possibly execute code by tricking a user into performing a drag-and-drop action from certain objects, such as file objects within a folder view, then predicting the drag action, and...

Microsoft Internet Explorer Drag-and-Drop Redeux

Microsoft Internet Explorer Drag-and-Drop Redeux I. SYNOPSIS Affected Systems: Microsoft Internet Explorer 5.01 Microsoft Internet Explorer 5.5 Microsoft Internet Explorer 6.0 - Windows 98 - Windows 98 Second Edition - Windows Millennium Edition - Windows 2000 - Windows XP - Windows Server 2003...

[NT] Microsoft Internet Explorer Drag-and-Drop Redeux

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

CVE-2006-0585

jscript.dll in Microsoft Internet Explorer 6.0 SP1 and earlier allows remote attackers to cause a denial of service application crash via a Shockwave Flash object that contains ActionScript code that calls VBScript, which in turn calls the Javascript document.write function, which triggers a null...

CVE-2006-0585: Undefined Security Weakness

jscript.dll in Microsoft Internet Explorer 6.0 SP1 and earlier allows remote attackers to cause a denial of service application crash via a Shockwave Flash object that contains ActionScript code that calls VBScript, which in turn calls the Javascript document.write function, which triggers a null...

Microsoft Internet Explorer 7.0 Beta 2 - urlmon.dll Denial of Service

Microsoft Internet Explorer 7.0 Beta 2 - urlmon.dll Denial of Service Tested on: Windows XP SP2 Vulnerable Versions: IE 7.0.5296.0 1/31/2006 Security-Protocols.com This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License version 2,...

Microsoft Internet Explorer 7 beta version buffer overflow

urlmon.dll bgsound tag oversized SRC filename paramter buffer overflow...

Code injection

urlmon.dll in Microsoft Internet Explorer 7.0 beta 2 aka 7.0.5296.0 allows remote attackers to cause a denial of service application crash and possibly execute arbitrary code via a BGSOUND element with its SRC attribute set to "file://" followed by a large number of "-" dash of hyphen characters...

CVE-2006-0544

urlmon.dll in Microsoft Internet Explorer 7.0 beta 2 aka 7.0.5296.0 allows remote attackers to cause a denial of service application crash and possibly execute arbitrary code via a BGSOUND element with its SRC attribute set to "file://" followed by a large number of "-" dash of hyphen characters...

CVE-2006-0544

urlmon.dll in Microsoft Internet Explorer 7.0 beta 2 aka 7.0.5296.0 allows remote attackers to cause a denial of service application crash and possibly execute arbitrary code via a BGSOUND element with its SRC attribute set to "file://" followed by a large number of "-" dash of hyphen characters...