CVE-2015-6158

CVE-2015-6158 affects Microsoft Edge and Internet Explorer 11. The connected OpenVAS entry links this CVE to Microsoft Security Bulletin MS15-125 and indicates a critical update is needed. The vulnerability involves memory corruption triggered by a crafted web site, enabling remote code execution...

CVE-2013-3166

CVE-2013-3166 is an XSS vulnerability in Microsoft Internet Explorer (IE6–IE10) that arises from incorrect auto‑selection of the Shift JIS encoding, enabling remote script/HTML execution via cross‑domain scrolling events. The issue is documented as the Shift JIS Character Encoding Vulnerability a...

CVE-2013-3187

Summary: CVE-2013-3187 affects Microsoft Internet Explorer 9 and 10. The vulnerability is a memory corruption flaw triggered by visiting a crafted web site, enabling remote code execution or a denial of service. The underlying issue is memory corruption in IE’s handling of web content. Impact (as...

CVE-2014-1795

CVE-2014-1795 corresponds to a memory-corruption vulnerability in Microsoft Internet Explorer 9–11 that can be triggered by visiting a crafted web site, potentially enabling remote code execution or memory corruption-based denial of service. The connected documents show this family of vulnerabili...

CVE-2014-1804

Microsoft Internet Explorer 8 is affected by memory corruption bugs leading to remote code execution or denial of service via a crafted web site (CVE-2014-1804). The vulnerability is part of a set of IE8 memory corruption issues (also CVE-2014-1781, CVE-2014-1792, CVE-2014-2770) but the connected...

CVE-2014-2792

CVE-2014-2792 affects Microsoft Internet Explorer 9–11, where memory corruption can be triggered by a crafted web site, enabling remote code execution or a crash. Connected sources confirm this family of IE memory-corruption vulnerabilities (alongside CVE-2014-2786 and CVE-2014-2813) and note exp...

CVE-2014-2806

Microsoft Internet Explorer 11 is affected by CVE-2014-2806 (Internet Explorer Memory Corruption Vulnerability). A crafted website can allow remote attackers to execute arbitrary code or cause a denial of service via memory corruption. Public exploits exist for this vulnerability. A patch is avai...

CVE-2014-4086

CVE-2014-4086 affects Microsoft Internet Explorer 6–8. The vulnerability allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) by instructing a user to visit a crafted web page. Root cause is described as memory corruption related to how IE handles cer...

CVE-2014-4092

Microsoft Internet Explorer 8–11 contains multiple use-after-free memory corruption vulnerabilities (CTableCell, CTableOMRowCache, CGeneratedTreeNode) that can lead to remote code execution. Exploitation requires visiting a crafted or malicious page/file; attacker-controlled in-memory objects can...

CVE-2014-4098

CVE-2014-4098 corresponds to a memory corruption/remote-code-execution vulnerability in Microsoft Internet Explorer 8–11. The Connected documents identify use-after-free flaws in IE components that can be triggered via crafted web content, with several specific sub-vulnerabilities tied to in-memo...

CVE-2014-4112

CVE-2014-4112 affects Microsoft Internet Explorer 11 and is described as a memory corruption vulnerability that can allow remote attackers to execute arbitrary code or cause a denial of service via a crafted web site. The CVSSv3 vector indicates NETWORK attack vector, HIGH impact on confidentiali...

CVE-2014-4126

CVE-2014-4126 affects Microsoft Internet Explorer 10 and 11 . The vulnerability allows a remote attacker to execute arbitrary code or cause a denial of service through memory corruption triggered by a crafted web page. Affected products are IE 10 and IE 11. The root cause is memory corruption in ...

CVE-2014-6339

CVE-2014-6339 affects Microsoft Internet Explorer 8 and 9. Description: a crafted web page can bypass Address Space Layout Randomization (ASLR), enabling remote attackers to bypass memory protections. Context from connected sources confirms IE ASLR bypass and links to MS14-065 (cumulative IE upda...

CVE-2014-6340

CVE-2014-6340 affects Microsoft Internet Explorer (IE) 6–11. The vulnerability is a cross-domain information-disclosure flaw caused by improper enforcement of cross-domain policies, allowing remote attackers to read content from a different domain or security zone via a crafted web page. Public e...

CVE-2015-0018

CVE-2015-0040 pertains to Microsoft Internet Explorer 11 memory corruption vulnerability triggered by visiting a crafted web page. The issue allows remote code execution or memory corruption resulting in denial of service, with an exploit publicly documented (Exploits referenced by Exploit-DB). A...

CVE-2015-0048

CVE-2015-0048 concerns Microsoft Internet Explorer 9, described as a remote memory corruption vulnerability that allows arbitrary code execution or a memory‑corruption–related DoS when visiting a crafted web page. The provided sources indicate remediation via security update MS15-009; affected sy...

CVE-2015-1658

Microsoft Internet Explorer 11 is implicated in a Memory Corruption vulnerability described across CVE-2015-1658 and CNVD-2015-03100/03099/03092/03091/03097 entries. The connected CNVD reports state an unspecified memory corruption flaw in Internet Explorer that could be exploited by a remote att...

CVE-2015-2401

Microsoft Internet Explorer 9–11 is affected by memory corruption vulnerabilities that allow remote code execution (and DoS) via a crafted webpage. Connected sources corroborate a family of IE memory‑corruption flaws, including CVE‑2015‑2401, with MS15‑065 delivering the Cumulative Security Updat...

CVE-2015-6044

CVE-2015-6044 affects Microsoft Internet Explorer 8. An attacker could trigger a remote privilege-escalation by visiting a crafted webpage, enabling a transition from Low to Medium integrity. Publicly documented mitigation is the MS15-106 update (Internet Explorer cumulative security update); app...

CVE-2015-6046

CVE-2015-6046 affects Microsoft Internet Explorer 9–11. A remote attacker can trigger an information-disclosure vulnerability by luring a user to a crafted webpage, allowing access to sensitive data from the browser process memory. Connected sources confirm multiple IE-related vulnerabilities und...

CVE-2015-6064

CVE-2015-6064 affects Microsoft Internet Explorer 10/11 and Microsoft Edge. The Connected/OpenVAS data indicate memory corruption vulnerabilities exploited via a crafted web site, enabling remote code execution or a denial of service. This CVE is described as a distinct issue from CVE-2015-6084/6...

CVE-2015-6065

CVE-2015-6065 affects Microsoft Internet Explorer 9–11 (and related Edge components in some CNVD records) and is described as a memory corruption vulnerability that allows remote code execution or a denial of service via a crafted web site. Connected sources corroborate its association with IE/Ed...

CVE-2018-8126

CVE-2018-8126 is a security feature bypass in Internet Explorer 11 where the component fails to validate User Mode Code Integrity (UMCI) policies, enabling a bypass of security controls. The vulnerability’s impact is described as a high-severity security feature bypass with a CVSS v3 base score o...

CVE-1999-0702

CVE-1999-0702 : Internet Explorer 5.0/5.01 is affected by the Import/Export Favorites vulnerability (ImportExportFavorites). A remote attacker may modify or execute files via this feature. The documentation explicitly links the issue to the Microsoft patch MS99-037 as a remediation. The impact is...

CVE-1999-0891

The CVE-1999-0891 issue concerns Internet Explorer 5’s DHTML “download behavior,” which can be abused to read local files via a server-side redirect. The Red Hat and CERT/CERT-like entries confirm this behavior, describing that a web site can redirect to a local file and expose its contents. The ...

CVE-2000-0329

The CVE concerns a Microsoft ActiveX control vulnerability in the Active Setup Control that allows a remote attacker to execute a malicious cabinet file via an attachment and an embedded script in an HTML email. Affected component is an ActiveX control; impact is remote code execution with partia...

CVE-2001-0712

The CVE concerns Internet Explorer’s rendering engine where MIME types are determined by the client rather than the server. This enables remote servers to coax script execution from files whose MIME type would not normally be treated as executable (e.g., .txt, .jpg). Reported impact scores indica...

CVE-2002-0022

CVE-2002-0022 describes a buffer overflow in the mshtml.dll HTML rendering engine (Internet Explorer 5.5/6.0) triggered by crafted HTML with embedded ActiveX controls, allowing remote code execution. The exploitation targets the SRC/EMBED handling and concatenation of two Unicode strings, enablin...

CVE-2002-1824

CVE-2002-1824 affects Microsoft Internet Explorer 6.0. During an SSL/TLS handshake, when encountering an expired CA-CERT in a webserver’s certificate chain, IE6 does not prompt the user before automatically searching for a newer certificate, which could enable a man-in-the-middle attack. The avai...

CVE-2003-0233

CVE-2003-0233 concerns Internet Explorer (IE) on Windows, describing a heap-based buffer overflow in the plugin.ocx component across IE 5.01, 5.5, and 6.0. The underlying issue is a heap-based overflow triggered via the Load() method, enabling remote code execution. This CVE is stated as a differ...

CVE-2003-1027

CVE-2003-1027 is a remote-code-execution vulnerability related to Internet Explorer’s handling of drag-and-drop. The Drag-and-Drop Vulnerability (CAN-2005-0053) updates address this and is explicitly stated as a variation of CVE-2003-1027. Affected software includes IE 5.01 through 6 SP1 (and rel...

CVE-2006-0057

CVE-2006-0057 describes a vulnerability in Microsoft Internet Explorer 5.01, 5.5, and 6 where remote attackers can bypass the Kill Bit protection for dangerous ActiveX controls through crafted HTML, exposing the browser to previously mitigated risks. The issue is tied to a failure in enforcing th...

CVE-2006-1016

CVE-2006-1016 concerns a buffer overflow in the Internet Explorer 6.0 isComponentInstalled method. Affected on Windows 2000 before SP4 or Windows XP before SP1, it allows a remote attacker to execute arbitrary code via JavaScript that calls IsComponentInstalled with a long first argument. Public ...

CVE-2006-1191

Cross-D Domain Information Disclosure vulnerability (CVE-2006-1191) affects IE 5.01–6 and could allow an attacker to read cookies or data from another domain if a user visits a malicious page or opens a malicious email. Exploitation requires user action (visiting a site) and scripting across doma...

CVE-2006-1992

CVE-2006-1992 refers to a memory corruption issue in Internet Explorer triggered by nested HTML OBJECT tags in mshtml.dll (IE 6.x). The vulnerability allowed denial of service via invalid pointer dereferences; Microsoft notes that code execution was theorized but non-exploitable. Related advisori...

CVE-2007-0219

CVE-2007-0219 affects Microsoft Internet Explorer 5.01/6/7 via COM objects instantiated as ActiveX controls. The vulnerability arises when IE tries to instantiate COM objects (not intended for IE) such as those in Imjpcksid.dll, Htmlmm.ocx, and Blnmgrps.dll, leading to remote code execution. Open...

CVE-2007-0943

Concretely, CVE-2007-0943 affects Internet Explorer 5.01 and 6 SP1, where parsing malformed CSS strings can trigger memory corruption via out-of-bounds pointers, allowing remote code execution. The incident is associated with an IE CSS parsing memory corruption vulnerability; remediation is MS07-...

CVE-2007-1091

Summary (based on provided documents): CVE-2007-1091 is a vulnerability in Internet Explorer 7 that allows remote attackers to spoof the address bar and prevent users from leaving a site via onUnload Javascript handlers, enabling phishing-like attacks. The vulnerability is discussed alongside rel...

CVE-2008-0077

CVE-2008-0077 is a memory-corruption vulnerability in Microsoft Internet Explorer 6 SP1/6 SP2 and IE7 triggered when malformed values are assigned to certain properties, notably the by property of an animateMotion SVG element. The underlying issue is a use-after-free that can cause arbitrary code...

CVE-2008-1086

The CVE-2008-1086 issue concerns the hxvz.dll ActiveX control (HxTocCtrl) used by Microsoft Help 2.5 and exposed in Internet Explorer on Windows XP SP2, Server 2003 SP1/SP2, Vista SP1, and Server 2008. The vulnerability is a memory corruption flaw triggered by malformed arguments to the ActiveX c...

CVE-2008-3173

Microsoft Internet Explorer is affected by CVE-2008-3173, where web sites can set cookies for domains with a public suffix containing more than one dot, enabling session fixation and potential HTTP session hijacking. The issue is tied to an insufficient fix for CVE-2004-0866, suggesting a remedia...

CVE-2008-4258

CVE-2008-4258 describes a remote code execution vulnerability in Microsoft Internet Explorer 5.01 SP4 and IE6 SP1 caused by improper parameter validation during navigation method calls, leading to memory corruption when processing crafted HTML. Connected advisories (MS08-073) group this with rela...

CVE-2010-1117

CVE-2010-1117 is a heap-based buffer overflow in Internet Explorer 8 on Windows 7 that enables remote attackers to discover the base address of a Windows DLL, via unknown vectors, demonstrated during Pwn2Own at CanSecWest 2010. The description notes potential additional impact but does not provid...

CVE-2010-1991

The entries describe a Denial of Service in Microsoft Internet Explorer (versions 6.0.2900.2180, 7, 8.0.7600.16385) triggered when an HTML document contains an IFRAME with a mailto: URL in SRC. In such cases, the browser can launch the mail application repeatedly, causing excessive application la...

CVE-2011-1266

CVE-2011-1266 affects Microsoft Internet Explorer 6–8 via a vulnerability in vgx.dll handling of VML imagedata during DOM parsing, causing memory access to freed/uninitialized objects and enabling remote code execution. The issue is described as a VML memory corruption vulnerability, with the aff...

CVE-2011-1345

CVE-2011-1345 is a memory-corruption vulnerability in Microsoft Internet Explorer (IE 6–8) caused by a use-after-free in the CObjectElement::OnPropertyChange path. An attacker can achieve remote code execution by tricking a user into visiting a crafted page; this exploit was demonstrated during P...

CVE-2012-0168

CVE-2012-0168 affects Microsoft Internet Explorer 6–9 and is described as a Print feature remote code execution flaw. A crafted HTML document during the “Print table of links” operation could allow a user-assisted attacker to execute arbitrary code in the context of the logged-in user. Public det...

CVE-2013-0018

CVE-2013-0018 is a use-after-free vulnerability in Microsoft Internet Explorer (IE6–IE9) tied to the SetCapture handling. A remote attacker could execute arbitrary code by persuading a user to visit a crafted page, which triggers access to a freed object and enables code execution in the context ...

CVE-2013-3161

CVE-2013-3161 affects Microsoft Internet Explorer 9 and 10. The vulnerability allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. The provided documents do not specify the underlying root cause or a published fix/remediation f...

CVE-2014-1764

CVE-2014-1764 affects Microsoft Internet Explorer 7–11. The issue is an object confusion vulnerability in the data exchanged between the broker and sandboxed processes, allowing a sandboxed process to execute code in the broker context and bypass IE Protected Mode. This can lead to remote code ex...