Internet Explorer Drag and Drop Elevation of Privilege (MS04-038; CVE-2004-0839)

Microsoft Internet Explorer provides a number of ways to represent remote or local content. One of it's more powerful features is the Web folder view. The Web folder provides easy access to files located on a web server. A vulnerability exists in the way Internet Explorer uses the web folder view...

CVE-2005-1989

CVE-2005-1989 is part of a set of Internet Explorer flaws affecting IE 5.0/5.5/6.0 via Web Folder Behaviors Cross‑Domain Vulnerability (CAN-2005-1989) and related issues (CAN-2005-1988 JPEG Rendering; CAN-2005-1990 COM Object Instantiation). The connected records confirm a cross‑domain informatio...

Microsoft Internet Explorer Web Folder Behaviors Cross-Domain Scripting Vulnerability

Description Microsoft Internet Explorer is prone to a security vulnerability that may let a Web page execute malicious script code in the context of an arbitrary domain or browser security zone. This issue is the result of a security flaw in the browser security model when handling URIs when a We...

MS05-038: Cumulative Security Update for Internet Explorer (896727)

The remote host contains a version of the Internet Explorer that is vulnerable to multiple security flaws JPEG Rendering, Web Folder, COM Object that could allow an attacker to execute arbitrary code on the remote host by constructing a malicious web page and entice a victim to visit this web pag...

SILLY BEHAVIOR Part II : Internet Explorer 5.5 - 6.0

Thursday, May 1, 2003 The following represents a trivial yet elaborate method of injecting arbitrary html into the "My Computer" zone on win98 using the Internet Explorer series of browsers. The manufacturer, commonly known as "Microsoft" has a done a splendid job of battening down the hatches wi...

CVE-2002-0980

The CVE-2002-0980 entry describes a vulnerability in the Web Folder component of Internet Explorer 5.5/6.0 whereby an error message is written to a known temp location. An attacker can inject arbitrary code into that error message and cause execution by referencing the error message file via an m...

CVE-2002-0980: Undefined Security Weakness

The Web Folder component for Internet Explorer 5.5 and 6.0 writes an error message to a known location in the temporary folder, which allows remote attackers to execute arbitrary code by injecting it into the error message, then referring to the error message file via a mhtml: URL...

SILLY BEHAVIOR : Internet Explorer 5.5 - 6.0

Wednesday, August 14, 2002 The following represents a trivial yet elaborate method of injecting arbitrary html into the "My Computer" zone on win98 using the Internet Explorer series of browsers. Internet Explorer enjoys a unique component called the "Web Folder" component. This is a selectable...