CVE-2001-0875

CVE-2001-0875 affects Internet Explorer 5.01/5.5/6.0 where the file-download dialog can misrepresent the filename, potentially enabling remote code execution. OpenVAS details indicate the July 2004 IE Cumulative Patch (MS05-020) mitigates this, but it is not applied on the remote host in one list...

CVE-2002-0027

Affected software: Internet Explorer 5.5 and 6.0. Vulnerability: Frame Domain Verification bypass via Document.open between frames from different domains; allows a remote attacker to read files and spoof the URL in the address bar. Impact: reads files on target and can impersonate sites; variant ...

CVE-2002-0722

Microsoft Internet Explorer versions 5.01, 5.5, and 6.0 are affected by CVE-2002-0722 due to a UI spoof flaw in the File Download dialogue that allows remote attackers to misrepresent a file’s origin and mislead users into trusting unsafe downloads. The vulnerability has a CVSS-based high impact ...

CVE-2002-1254

The vulnerability (CVE-2002-1254) affects Internet Explorer 5.5 and 6.0. Affected component: cross-domain verification via cached methods/objects. Root cause: security model bypass that allows remote attackers to access information on the local system or in other domains, and potentially execute ...

CVE-2002-2062

CVE-2002-2062 affects Internet Explorer 5.5/6.0 on Windows 2000 via the ftp.htt component when the user has “Enable folder view for FTP sites” and “Enable Web content in folders” enabled. The vulnerability is a cross-site scripting (XSS) issue where an attacker can inject arbitrary web script/HTM...

CVE-2004-0484

The CVE-2004-0484 entry concerns Microsoft Internet Explorer 6.0.2800, specifically the mshtml.dll component. A crafted HTML table containing a form that spans multiple td elements and references a CSS “float: left” class in a stylesheet link located after the table can trigger a null dereference...

CVE-2004-2307

CVE-2004-2307 affects Microsoft Internet Explorer 6.0.2600 on Windows XP. The vulnerability allows remote attackers to cause a denial of service (browser crash) by using a shell: URI with double backslashes (\) in an HTML tag (e.g., IFRAME or A). The connected documents confirm the attack vector ...

CVE-2005-2304

The CVE-2005-2304 entry concerns Microsoft MSN Messenger 9.0 and Internet Explorer 6.0, where processing an image with an ICC Profile that has a large Tag Count can cause a denial of service (crash). The vulnerability is rooted in image handling in these products, enabling a remote attacker to tr...

CVE-2006-0585

CVE-2006-0585 affects jscript.dll in Microsoft Internet Explorer 6.0 SP1 and earlier. A remote attacker can cause a denial of service (application crash) by embedding a Shockwave Flash object that contains ActionScript code calling VBScript, which then calls Javascript’s document.write, triggerin...

CVE-2006-3281

CVE-2006-3281 : A remote code execution flaw in Windows Explorer/Internet Explorer 6 related to handling of Drag & Drop with CLSID extensions (Folder GUID Code Execution). Root cause: improper handling of directories/CLSID extensions can lead to arbitrary code execution when a user visits a craft...

CVE-2006-3450

CVE-2006-3450 corresponds to a memory-corruption vulnerability in Microsoft Internet Explorer (IE6/IE5 SP4) involving HTML layout and certain layout-positioning combinations. The root cause is improper handling of CSS/class-related content (e.g., document.getElementByID usage) which could allow r...

CVE-2006-3472

Microsoft Internet Explorer 6.0 and 6.0 SP1 is affected by a vulnerability that allows remote attackers to cause a denial of service via an HTML page containing an A tag with a long title attribute. The connected documents specify the affected software and the basic exploit vector, but do not pro...

CVE-2006-3897

CVE-2006-3897 describes a stack overflow in Microsoft Internet Explorer 6 on Windows 2000 caused by creating an NMSA.ASFSourceMediaDescription.1 ActiveX object with an overly long dispValue property. This leads to a remote-denial-of-service condition (application crash). Connected documents confi...

CVE-2007-2938

The CVE-2007-2938 entry affects the BaseRunner ActiveX control in the Ademco ATNBaseLoader100 Module (ATNBaseLoader100.dll) version 5.4.0.6. It describes a buffer overflow condition that, when Internet Explorer 6 is used, allows remote attackers to execute arbitrary code via a long argument to th...

CVE-2007-3550

Microsoft Internet Explorer 6.0 and 7.0 are identified as affected. The vulnerability allows remote attackers to manipulate Zone settings by injecting certain metacharacters (e.g., wildcards) via JavaScript to fill Zones with arbitrary domains, leading to a denial of service through website suppr...

CVE-2007-5456

CVE-2007-5456 describes a vulnerability in Microsoft Internet Explorer 7 and earlier where an attacker can bypass the File Download - Security Warning dialog and cause a download of arbitrary files by appending a '?' and a non-.exe filename after the .exe filename. The connected advisories and NV...

CVE-2011-1346

CVE-2011-1346 : In Microsoft Internet Explorer 8 on Windows 7, an uninitialized variable information leak in IE (when creating a new Option element) can disclose memory layout, potentially defeating ASLR and aiding remote code execution as part of the Pwn2Own 2011 chain. Exploitation requires vis...

CVE-2011-1964

CVE-2011-1964 corresponds to a memory corruption vulnerability in Microsoft Internet Explorer 6–9 related to STYLE object handling, allowing remote code execution when visiting a crafted page. Connected sources confirm the affected product (IE), nature (STYLE object memory corruption), and the ve...

CVE-2013-3186

CVE-2013-3186 affects Microsoft Internet Explorer 7–10 on multiple Windows editions. The root cause is improper implementation of the Integrity Access Level (Process Integrity Level) protection in Protected Mode, allowing remote attackers to elevate privileges from a low-IL process to medium IL. ...

CVE-2013-3201

Microsoft Internet Explorer 9–10 memory corruption vulnerability (CVE-2013-3201/3203/3206/3207/3209) can allow remote code execution or memory corruption via a crafted web site. Seebug entries for CVE-2013-3201/3207 describe exploitation across IE versions 6–10 with remote code execution in the c...

CVE-2013-3874

CVE-2013-3874 affects Microsoft Internet Explorer 9. The vulnerability is a memory corruption flaw triggered by processing crafted web content, allowing remote attackers to execute arbitrary code or cause a denial of service. The issue is documented as part of MS13-080 and is addressed by the cum...

CVE-2013-3914

CVE-2013-3914 affects Microsoft Internet Explorer 9–11. Description confirms memory corruption that enables remote code execution or memory corruption Denial of Service via a crafted site. Root cause: memory corruption in IE’s handling of certain objects/files, leading to code execution in the co...

CVE-2013-5046

Technical details about CVE-2013-5046 (affected products, root cause, impact, fixes) are not publicly disclosed in the provided Connected Documents. Please monitor for updates from official advisories.

CVE-2014-0309

CVE-2014-0309 affects Microsoft Internet Explorer 8–10. The vulnerability enables remote code execution or memory corruption when a user views a crafted web page, exploitable via IE’s memory handling components (MSHTML/IE engine). Public details in the connected docs confirm the root cause as mem...

CVE-2014-1774

Affected software: Microsoft Internet Explorer 9. The vulnerability is a memory corruption flaw in IE9 that can be triggered by a crafted web site, enabling remote code execution or a denial of service. This CVE is part of a set (CVE-2014-1774, -1788, -2754) describing memory corruption vulnerabi...

CVE-2014-1779

CVE-2014-1779 describes a memory corruption vulnerability in Microsoft Internet Explorer (IE6–IE11) that is triggered by a crafted web page. The connected document provides technical context: the issue is identified as a Use-After-Free (UAF) in the browser’s memory management, with exploitation d...

CVE-2014-2794

CVE-2014-2794 affects Microsoft Internet Explorer 6 and 7. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. Public exploits exist. Remediation: apply updates (e.g., MS14-037) and other Microsoft security guidance; monito...

CVE-2015-1708

Microsoft Internet Explorer 8 and 9 are affected by CVE-2015-1708, a memory corruption vulnerability that enables remote code execution or memory-related denial of service when a user visits a crafted webpage. The issue is addressed by the MS15-043 security update (KB 3049563) and related advisor...

CVE-2015-1710

CVE-2015-1710 affects Microsoft Internet Explorer versions 6–11. The connected sources describe a memory corruption vulnerability exploitable via a crafted web page, enabling remote code execution or a denial of service. The CVE is explicitly distinguished from CVE-2015-1694. The available docume...

CVE-2015-2484

Microsoft Internet Explorer 10/11 contains a Tampering Vulnerability (CVE-2015-2484) caused by an incorrect file-system flag during certain accesses, enabling a remote attacker to delete arbitrary files via crafted web content. Public details indicate exploitation via user-assisted access to mali...

CVE-2016-0069

CVE-2016-0069 corresponds to Internet Explorer cross-domain policy bypass (Same Origin Policy bypass) affecting IE 9–11. Connected sources indicate the flaw enables information disclosure via cross-domain policy bypass, with MS16-009 addressing the issue. The vulnerability is described as an elev...

CVE-2016-3276

CVE-2016-3276 affects Microsoft Internet Explorer 11 and Microsoft Edge. A remote attacker can trigger a content-spoofing attack by sending or hosting a specially crafted URL, potentially convincing users to visit a malicious page after user interaction (clicking the URL). Exploitation scenarios ...

CVE-1999-0331

The provided documents identify CVE-1999-0331 as a buffer overflow vulnerability in Internet Explorer 4.0(1) . The description confirms a buffer overflow issue, but none of the connected documents supply a concrete fix version, remediation steps, affected subcomponents, exploit details, or in‑the...

CVE-1999-1094

The vulnerability CVE-1999-1094 affects Internet Explorer 4.01 and earlier. A buffer overflow can be triggered by a long URL using the mk: protocol, enabling a remote attacker to execute arbitrary commands. According to the NVD entry, the attack vector is network, with low complexity and no authe...

CVE-1999-1367

CVE-1999-1367 affects Internet Explorer 5.0. The issue is that the browser does not properly reset the username/password cache for sites that lack standard cache controls, allowing another user on the same system to access restricted sites visited by a prior user. Impact is partial confidentialit...

CVE-2000-0439

Vulnerability: Internet Explorer 4.0/5.0. Issue: malicious site can obtain cookies from another domain by embedding that domain name with escaped characters in a URL (Unauthorized Cookie Access). Root cause: cross-domain cookie access via crafted URL. Impact: potential leakage of cookies across d...

CVE-2001-0089

CVE-2001-0089 affects Internet Explorer 5.0–5.5. The vulnerability allows a remote attacker to read arbitrary files from the client through an HTML form using an INPUT TYPE element, known as the “File Upload via Form” issue. The provided documents do not specify payloads, affected configurations ...

CVE-2001-0090

The CVE-2001-0090 issue affects Internet Explorer 5.5 where the Print Templates feature can execute arbitrary ActiveX controls via custom print templates without user prompts. Root cause is that print templates are allowed to run ActiveX controls, creating remote code execution risk for the user ...

CVE-2001-0807

The provided records indicate CVE-2001-0807 affects Internet Explorer 5.0 (and possibly other versions). The vulnerability allows a remote attacker from a malicious web page to read known text files from a client’s hard drive by using a SCRIPT tag with a SRC attribute that points to the local tex...

CVE-2001-1497

Microsoft Internet Explorer 4.0–6.0 has a local-privilege issue where an attacker can differentiate alphanumeric from non-alphanumeric password characters by using certain control-key navigation, potentially aiding brute-force guessing. The issue affects IE versions 4.0 through 6.0; CVSSv2 base s...

CVE-2002-0500

The CVE-2002-0500 entry describes a vulnerability in Internet Explorer 5.0–6.0 where a remote attacker can determine the existence of local files on a client by abusing an IMG tag with a dynsrc attribute that references the target file, causing the image object to reveal information such as file ...

CVE-2002-1705

CVE-2002-1705 concerns Microsoft Internet Explorer 5.5 through 6.0, where a remote attacker could cause a denial of service (crash) by supplying a Cascading Style Sheet that uses the p{cssText} element declared with a bold font weight. Affected product family is Internet Explorer; the root cause ...

CVE-2004-1155

The CVE-2004-1155 entry describes a window-injection flaw in multiple browsers where a malicious site can replace content in a popup window opened from a trusted site by referencing the popup’s known name across domains. Connected advisories (CPAI-2004-205) explain that the vulnerability arises f...

CVE-2005-0954

CVE-2005-0954 affects Windows 2000 SP1, specifically Windows Explorer and Internet Explorer, where a malformed Windows Metafile (WMF) can be used by a remote attacker to consume CPU and cause a denial of service. The vulnerability is described as enabling a remote DoS via WMF parsing, with the NV...

CVE-2005-4842

The CVE-2005-4842 entry describes a vulnerability in the System Monitor Source Properties control that can cause a denial-of-service (Internet Explorer crash) when a remote attacker creates a COM object of the control’s CLSID, which IE does not intend to use. Multiple sources (NVD, CVE list, Red ...

CVE-2006-2056

CVE-2006-2056 affects Internet Explorer 6 on Windows XP SP2. The vuln is an argument-injection flaw where an attacker can influence command line arguments passed to a launched mail client via double-quote characters in a mailto: handler, demonstrated by starting Outlook with an arbitrary attachme...

CVE-2006-3898

CVE-2006-3898 affects Microsoft Internet Explorer 6.0 on Windows XP SP2 via the Internet.HHCtrl.1 ActiveX object. According to the connected advisory CPAI-2006-104, the flaw is a heap overflow in hhctrl.ocx that can be triggered by a user visiting a crafted page, causing the browser to crash (den...

CVE-2006-5581

CVE-2006-5581 concerns Microsoft Internet Explorer 6, where parsing certain DHTML script function calls leads to memory corruption via incorrectly created elements. Exploitation requires the user to view a malicious page, enabling remote code execution on vulnerable IE 6 clients. The vulnerabilit...

CVE-2008-1442

CVE-2008-1442 concerns a heap-based buffer overflow in the substringData method of Internet Explorer 6 and 7, allowing remote code execution via crafted web pages (HTML Objects Memory Corruption). The connected MSKB (MS08-031) confirms multiple affected IE versions on Windows XP/2003 family and d...

CVE-2011-1251

CVE-2011-1251 refers to a memory handling flaw in Microsoft Internet Explorer 8 (DOM Manipulation Memory Corruption). The vulnerability arises when IE processes DOM objects that are uninitialized or already deleted, enabling remote code execution if a user views a malicious page. Public details a...