CVE-2015-2445

CVE-2015-2445 is an ASLR bypass vulnerability in Microsoft Internet Explorer (IE10 is explicitly noted; IE7–11 are affected per MS15-079/MSKB entries). The issue allows bypass of Address Space Layout Randomization and, in conjunction with other vulnerabilities, could lead to remote code execution...

CVE-2015-2500

Microsoft Internet Explorer 7 and 8 are affected by CVE-2015-2500 via a crafted web page that triggers memory corruption, enabling remote code execution or a denial of service. The issue is addressed by the MS15-094 cumulative security update for Internet Explorer (covering IE 7–11 per multiple a...

CVE-2015-6074

Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2015-6074) affects IE 7–11. A crafted web site can trigger memory corruption, enabling remote code execution or a denial of service. Connected CNVD entries confirm this class of vulnerability but do not provide product-specific expl...

CVE-2015-6079

CVE-2015-6079 concerns Microsoft Internet Explorer 11 memory corruption vulnerability that enables remote code execution or denial of service via a crafted web site. The connected CNVD/NVD entries describe a memory corruption flaw in IE11 (and related components) leading to arbitrary code executi...

CVE-2015-6148

Summary of vulnerability (CVE-2015-6148) : Microsoft Internet Explorer versions 9–11 and Microsoft Edge are affected by a memory corruption vulnerability that can be exploited when a user visits a crafted website, enabling remote code execution or, per affected context, a denial of service. The i...

CVE-2016-0104

CVE-2016-0104 affects Microsoft Internet Explorer 10. It is a remote memory-corruption vulnerability triggered by visiting a crafted webpage, caused by improper memory object handling that can lead to arbitrary code execution or memory corruption. Public exploits exist for this vulnerability (as ...

CVE-2016-3292

CVE-2016-3292 is the Internet Explorer Elevation of Privilege vulnerability. The connected MS advisories (MS16-104, KB3185319, and related MSRC entries) confirm that Internet Explorer on affected Windows versions mishandles zone and integrity settings, enabling sandbox bypass via a crafted webpag...

CVE-1999-0917

The CVE-1999-0917 issue concerns the Preloader ActiveX control used by Internet Explorer. The vulnerability allows remote attackers to read arbitrary files via this ActiveX component. The affected target is the Preloader ActiveX control in IE, with a potential impact to confidentiality (partial) ...

CVE-1999-1453

The CVE-1999-1453 issue concerns Internet Explorer 4 where a remote attacker can read the contents of a user’s clipboard through the Internet WebBrowser ActiveX object. The description indicates an impact on clipboard confidentiality via a WebBrowser ActiveX component, triggered by visiting a mal...

CVE-2000-0266

The CVE-2000-0266 entry describes a vulnerability in Internet Explorer 5.01 where a malicious applet can bypass the cross-frame security policy by interacting with the Java JSObject to modify DOM properties, allowing an IFRAME to load an arbitrary JavaScript URL. This reveals a client-side cross-...

CVE-2001-0322

CVE-2001-0322 concerns MSHTML.DLL HTML parser in Internet Explorer 4.0 and newer, where a script that creates and deletes an object tied to the browser window object can trigger a denial of service (application crash). The vulnerability is described as remote, with impact limited to availability ...

CVE-2001-0664

Summary (CVE-2001-0664 / CVE-2001-0724): Internet Explorer 5.01 and 5.5 are vulnerable to a zone-spoofing flaw where dotless IP addresses in URLs cause the page to be treated as Intranet Zone, bypassing some security restrictions. This can enable execution of scripts/ActiveX that would otherwise ...

CVE-2001-0667

CVE-2001-0667 affects Internet Explorer 6 and earlier when used with the Telnet client in Services for Unix (SFU) 2.0. The vulnerability allows remote attackers to spawn Telnet with a log-file option on the command line, enabling writing arbitrary code into an executable file that is later execut...

CVE-2002-1217

The CVE-2002-1217 entry describes a Cross-Frame scripting vulnerability in the WebBrowser control as used by Internet Explorer 5.5 and 6.0. The issue arises when script accesses the Document property, bypassing / domain restrictions, enabling remote attackers to execute arbitrary code, read arbit...

CVE-2003-1328

The CVE concerns Microsoft Internet Explorer 5.01, 5.5, and 6.0, where the showHelp() function supports certain pluggable protocols that can bypass the cross‑domain security model and allow remote code execution. The OpenVAS entries reference the affected patches (MS03-004 and MS05-020) and indic...

CVE-2005-4089

CVE-2005-4089 is a cross-domain information disclosure vulnerability in Internet Explorer, triggered by parsing a CSS file via the @import directive. The flaw allows an attacker to read data from another IE security zone or domain when a user visits a specially crafted page or opens a crafted lin...

CVE-2005-4827

CVE-2005-4827 affects Internet Explorer 6.0 (and possibly other versions). It describes a bypass of the same-origin policy by calling open on an XMLHttpRequest object (Microsoft.XMLHTTP) with a method name containing tab, newline, or carriage return characters, a pattern some proxies convert to s...

CVE-2006-3657

Microsoft Internet Explorer 6 contains a vulnerability in the DXImageTransform.Microsoft.Gradient ActiveX object. A long StartColorStr or EndColorStr property can trigger a remote denial of service via a stack overflow. Affected: IE6; vulnerability impact is to crash/partial availability. The doc...

CVE-2007-3576

Microsoft Internet Explorer 6 is affected by a vulnerability where web scripts can be executed from URIs using arbitrary scheme names that end with the sequence “script.” This uses the vbscript: handler for seven to nine character scheme names and the javascript: handler for ten or more character...

CVE-2007-3930

The CVE-2007-3930 entry concerns a XSS vulnerability in DokuWiki’s spellchecker backend. Affects DokuWiki spellcheck.php (lib/exe/spellcheck.php) where the spell_utf8test path triggers HTML document identification and script execution by Internet Explorer when validating UTF-8 messages, even if t...

CVE-2007-3958

The CVE-2007-3958 entry concerns Microsoft Windows Explorer (explorer.exe) and a denial of service triggered by processing a crafted GIF file (Art.gif). The connected NVD entry confirms the vulnerability is user-assisted and affects GIF parsing, leading to a denial of service. The description doe...

CVE-2007-4848

CVE-2007-4848 affects Microsoft Internet Explorer 4.0–7. The issue allows remote attackers to determine whether local files have associated images by using a res:// URI in the src property of a JavaScript Image object, demonstrated with bitmap data inside a (1) .exe or (2) .dll file. The connecte...

CVE-2008-0076

Summary of CVE-2008-0076 (HTML Rendering Memory Corruption in Internet Explorer) : A remote code execution vulnerability in Microsoft Internet Explorer versions 5.01, 6 SP1/SP2, and 7 due to how IE renders HTML with certain layout combinations. An attacker could craft a page that, when viewed, ex...

CVE-2008-2256

CVE-2008-2256 is an uninitialized memory corruption vulnerability in Microsoft Internet Explorer 5.01, 6, and 7. The issue arises when IE handles objects that were not correctly initialized or that have been deleted, enabling remote code execution and a crash. Multiple connected sources confirm t...

CVE-2008-3475

CVE-2008-3475 affects Microsoft Internet Explorer 6. The vulnerability arises from improper handling of componentFromPoint on XML objects that are uninitialized or deleted, enabling an attacker to execute arbitrary code via a crafted HTML page. Impact includes remote code execution with the attac...

CVE-2010-1127

CVE-2010-1127 affects Microsoft Internet Explorer 6 and 7. The vulnerability arises when executing the createElement method, where certain data structures are not initialized, enabling a remote attacker to cause a denial of service via crafted JavaScript. Specifically, setting the (1) outerHTML o...

CVE-2010-1258

CVE-2010-1258 arises from Internet Explorer 6–8 failing to determine the origin of script code, enabling a remote attacker to run script in a different domain/zone and potentially access user data. The primary entry is through crafted web content that exploits cross-domain context (Event Handler ...

CVE-2011-0347

This CVE (CVE-2011-0347) corresponds to a high-severity vulnerability in Microsoft Internet Explorer on Windows XP, involving an incorrect GUI display triggered via DOM-related vectors (cross_fuzz). The OpenVAS entries group this under a Windows Shell/IE flaw (MS11-006) with a CVSS v2 base score ...

CVE-2011-1960

CVE-2011-1960 corresponds to an Information Disclosure vulnerability in Microsoft Internet Explorer 6–9 due to improper handling of JavaScript event handlers, allowing cross-domain/zone access via crafted pages. MS11-057 (Cumulative Security Update for Internet Explorer, 2559049) is the indicated...

CVE-2012-1538

Microsoft Internet Explorer 9 is affected by CVE-2012-1538 (CFormElement use-after-free). The vulnerability allows remote code execution when a crafted web site triggers use-after-free of an object that has been freed, enabling code execution in the context of the user. The CVSS shows network att...

CVE-2014-2785

CVE-2014-2785 affects Microsoft Internet Explorer (notably IE7) where a crafted webpage can trigger remote code execution or memory corruption. Public exploitation activity is noted, and multiple sources attribute a memory‑corruption vulnerability enabling attacker code execution via specially cr...

CVE-2014-4101

Consolidated from the connected advisories, Microsoft Internet Explorer 11 contains multiple memory‑corruption and use‑after‑free flaws that allow remote code execution when a user visits a crafted page. ZDI advisories detail issues such as: uninitialized CAttrValue handling, Tree::SComputedStyle...

CVE-2015-6072

Technical details for CVE-2015-6072 are not publicly available in the provided documents. The connected sources discuss memory corruption vulnerabilities in Internet Explorer/Edge in general but do not specify this CVE's affected versions or fixes. Monitor for updates.

CVE-1999-0967

CVE-1999-0967 describes a buffer overflow in the HTML library used by Internet Explorer, Outlook Express, and Windows Explorer via the res: local resource protocol. The connected PT-1997-1176 entry reiterates a buffer overflow in the HTML library with affected software and recommends updating to ...

CVE-1999-1093

The CVE-1999-1093 entry describes a buffer overflow in the Window.External function of the JScript Scripting Engine in Internet Explorer 4.01 SP1 and earlier . The flaw allows remote attackers to execute arbitrary commands via a malicious web page . Connected sources confirm the affected componen...

CVE-1999-1472

This CVE (CVE-1999-1472) affects Internet Explorer 4.0. The vulnerability allows a remote attacker to read arbitrary text and HTML files on the user’s machine by delivering a small IFRAME that uses Dynamic HTML (DHTML) to exfiltrate data (the Freiburg text-viewing issue). The connected records co...

CVE-2000-0400

The CVE-2000-0400 entry refers to the Microsoft Active Movie ActiveX Control in Internet Explorer 5, where the issue stems from shared code handling the Internet cache and file downloads (not the Active Movie control itself). Affected component is msdxm.ocx (ClassID {05589FA1-C356-11CE-BF01-00AA0...

CVE-2002-0027

Affected software: Internet Explorer 5.5 and 6.0. Vulnerability: Frame Domain Verification bypass via Document.open between frames from different domains; allows a remote attacker to read files and spoof the URL in the address bar. Impact: reads files on target and can impersonate sites; variant ...

CVE-2002-1254

The vulnerability (CVE-2002-1254) affects Internet Explorer 5.5 and 6.0. Affected component: cross-domain verification via cached methods/objects. Root cause: security model bypass that allows remote attackers to access information on the local system or in other domains, and potentially execute ...

CVE-2002-1670

CVE-2002-1670 concerns Microsoft Windows XP Professional upgrade edition where applying an upgrade overwrites already installed Internet Explorer 6.0 patches, resulting in Internet Explorer being left unpatched. The connected sources reiterate this description without adding concrete exploit deta...

CVE-2005-2274

The connected sources confirm CVE-2005-2274 affects Microsoft Internet Explorer 6.0 and describes a dialog-origin spoofing vulnerability where a JavaScript dialog box may not be clearly tied to the page that generated it, enabling an attacker to impersonate a trusted site and facilitate phishing....

CVE-2007-3164

Technical details (affected product/version, root cause, impact or fixes) are not publicly detailed in the provided documents. Monitor for updates on CVE-2007-3164.

CVE-2008-4260

CVE-2008-4260 : An uninitialized memory corruption vulnerability in Microsoft Internet Explorer 7 occurs when IE accesses an object that has been deleted. Exploitation via a specially crafted HTML page could allow remote code execution with the caller’s privileges. The issue is part of a set of I...

CVE-2010-3342

CVE-2010-3342 affects Microsoft Internet Explorer 6–8, where the browser may render cached HTML content that comes from a different domain/zone via script, enabling cross-domain information disclosure. The issue is documented alongside CVE-2010-3348 (another cross-domain disclosure) and is mitiga...

CVE-2011-4689

CVE-2011-4689 affects Microsoft Internet Explorer 6–9 and is a timing-based information-disclosure vulnerability in which SOP/Same Origin Policy timing data can be captured during IFRAME loading. Several connected sources (Red Hat advisory, NVD entry, and OpenVAS/SEebug records) describe that rem...

CVE-2013-3126

CVE-2013-3126 corresponds to a memory handling vulnerability in Microsoft Internet Explorer (IE) 9/10 when script debugging is enabled, enabling remote code execution via a crafted web page. The issue stems from improper handling of memory objects during script processing, allowing an attacker to...

CVE-2013-3140

This CVE (CVE-2013-3140) concerns a Use-After-Free in Microsoft Internet Explorer 9. The vulnerability is triggered by visiting a crafted webpage that accesses a deleted CMarkup object, enabling remote code execution. The issue is tied to IE9’s handling of CMarkup, and is documented as a high-sev...

CVE-2014-1763

CVE-2014-1763 is a use-after-free vulnerability in Microsoft Internet Explorer 9–11 exploited via CSS handling (notably CSS @import) that could allow remote code execution. ZDI-14-217 documents a CSS memory corruption flaw in IE10/IE11/IE9, demonstrated by VUPEN during Pwn2Own 2014, with remote e...

CVE-2014-1790

Microsoft Internet Explorer 10 is affected by CVE-2014-1790, a memory-corruption vulnerability that can be triggered by a crafted web site, enabling remote code execution or memory-corruption DoS. Root cause: memory corruption in IE10. Mitigation: apply MS14-035 Security Update for Internet Explo...

CVE-2014-2756

Technical details for CVE-2014-2756 are not publicly available in the provided documents. Monitor for updates.