4699 matches found
CVE-2002-0190
Microsoft Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to execute arbitrary code under fewer security restrictions via a malformed web page that requires NetBIOS connectivity, aka "Zone Spoofing through Malformed Web Page" vulnerability...
CVE-2002-0189
Cross-site scripting vulnerability in Internet Explorer 6.0 allows remote attackers to execute scripts in the Local Computer zone via a URL that exploits a local HTML resource file, aka the "Cross-Site Scripting in Local HTML Resource" vulnerability...
Six new bugs in Internet Explorer
Crossite scripting, local files disclosure, security zone spoofing, etc...
IE dot bug - Sandblad advisory #7
Sandblad advisory 7 - ---..---..---..---..---..---..---..---..---..---..---..---..---- Title: IE dot bug updated IE: Remote webpage can script in local zone Date: 2002-05-19 Software: Internet Explorer Patches: MS02-023, MS02-015 issue still not 100 solved Vendor: http://www.microsoft.com/...
AOL Instant Messenger installer adds "http://free.aol.com" to Trusted Sites Zone in Microsoft Internet Explorer
Overview The installer for AOL Instant Messenger contains a vulnerability that weakens the security settings of Microsoft Internet Explorer. Description There is a vulnerability in the installer for AOL Instant Messenger AIM that silently adds "http://free.aol.com" to the list of Trusted Sites in...
Microsoft Internet Explorer 5.5/6.0 - History List Script Injection
source: https://www.securityfocus.com/bid/4505/info A vulnerability has been reported in some versions of Internet Explorer. It is possible to inject JavaScript code into the browser history list, and execute it within any page context given appropriate user interaction. Internet Explorer stores...
CVE-2002-1591
AOL Instant Messenger AIM 4.7.2480 adds free.aol.com to the Trusted Sites Zone in Internet Explorer without user approval, which could allow code from free.aol.com to bypass intended access restrictions...
Security Bulletin MS02-015
---------------------------------------------------------------------- Title: 28 March 2002 Cumulative Patch for Internet Explorer Date: 28 March 2002 Software: Internet Explorer Impact: Two vulnerabilities, the most serious of which would allow script to run in the Local Computer Zone. Max Risk:...
Microsoft Internet Explorer Permits Remote Command Execution Through <OBJECT> Tag
Overview Microsoft Internet Explorer IE permits the remote execution of arbitrary commands via the tag. Description A vulnerability exists in the way that Microsoft Internet Explorer IE handles tags. If the CLASSID CLSID is unrecognized, then Internet Explorer will execute arbitrary commands...
Microsoft Internet Explorer does not adequately evaluate malformed URLs
Overview Microsoft Internet Explorer contains a serious vulnerability in its handling of zone determination. Description Microsoft Internet Explorer contains a vulnerability in the way in which it handles zone determination. Specifically, HTML scripts stored in cookies should be executed in the...
Executable launch via Windows Medial Player from Microsoft Outlook/Outlook express
Via Windows Media file wma it's possible to open HTML file in local security zone, from html it's open chm, from chm - executable...
CVE-1999-1087
CVE-1999-1087 affects Internet Explorer 4 where a 32-bit number in a URL (a “dotless IP address”) is treated as the hostname rather than as an IP address. This causes the web page to inherit Local Intranet Zone settings, enabling remote malicious servers to perform unauthorized activities using U...
CVE-2001-0664
Summary (CVE-2001-0664 / CVE-2001-0724): Internet Explorer 5.01 and 5.5 are vulnerable to a zone-spoofing flaw where dotless IP addresses in URLs cause the page to be treated as Intranet Zone, bypassing some security restrictions. This can enable execution of scripts/ActiveX that would otherwise ...
CVE-2001-0664
Internet Explorer 5.5 and 5.01 allows remote attackers to bypass security restrictions via malformed URLs that contain dotless IP addresses, which causes Internet Explorer to process the page in the Intranet Zone, which may have fewer security restrictions, aka the "Zone Spoofing vulnerability."...
CVE-2002-0057
XMLHTTP control in Microsoft XML Core Services 2.6 and later does not properly handle IE Security Zone settings, which allows remote attackers to read arbitrary files by specifying a local file as an XML Data Source...
CVE-2001-0848
join.cfm in e-Zone Media Fuse Talk allows a local user to execute arbitrary SQL code via a semi-colon ; in a form variable...
CVE-2001-0848
join.cfm in e-Zone Media Fuse Talk allows a local user to execute arbitrary SQL code via a semi-colon ; in a form variable...
CVE-2001-0848
CVE-2001-0848 affects join.cfm in e-Zone Media Fuse Talk, where a local user can inject and execute arbitrary SQL through a semicolon in a form variable. The vulnerability is tied to SQL injection in the application’s handling of input data, enabling partial confidentiality/integrity/availability...
CVE-2001-0724
Internet Explorer 5.5 allows remote attackers to bypass security restrictions via malformed URLs that contain dotless IP addresses, which causes Internet Explorer to process the page in the Intranet Zone, which may have fewer security restrictions, aka the "Zone Spoofing Vulnerability variant" of...