CVE-2007-5456

CVE-2007-5456 describes a vulnerability in Microsoft Internet Explorer 7 and earlier where an attacker can bypass the File Download - Security Warning dialog and cause a download of arbitrary files by appending a '?' and a non-.exe filename after the .exe filename. The connected advisories and NV...

CVE-2008-4788

Microsoft Internet Explorer 6 is affected by CVE-2008-4788 due to a flaw in how the address bar renders URLs with high-bit characters. The vulnerability occurs when IE omits high-bit URL-encoded characters in the address bar, enabling remote attackers to spoof the address bar by using a domain na...

CVE-2009-1530

CVE-2009-1530 corresponds to a use-after-free memory corruption in Microsoft Internet Explorer 7. The vulnerability affects IE7 on Windows XP SP2/SP3, Server 2003 SP2, Vista (Gold, SP1, SP2), and Server 2008 SP2, and is triggered by repeatedly adding HTML document nodes and invoking event handler...

CVE-2010-3348

Microsoft Internet Explorer 6–8 is affected by a Cross‑Domain Information Disclosure vulnerability (CVE-2010-3348) where cached content could be rendered as HTML, allowing access to content from a different domain or zone via script. The issue stems from IE not preventing rendering of cached cont...

CVE-2011-1346

CVE-2011-1346 : In Microsoft Internet Explorer 8 on Windows 7, an uninitialized variable information leak in IE (when creating a new Option element) can disclose memory layout, potentially defeating ASLR and aiding remote code execution as part of the Pwn2Own 2011 chain. Exploitation requires vis...

CVE-2012-4775

Microsoft Internet Explorer 9 is affected by CVE-2012-4775 (CTreeNode Use After Free Vulnerability). The issue is a use-after-free in IE’s memory handling when accessing objects that were not properly initialized or already deleted (CTreeNode/CTreePos/CTreeNode-related code paths), leading to pot...

CVE-2013-3909

CVE-2013-3909 affects Microsoft Internet Explorer 6–8. An attacker can read content from a different domain/zone via crafted CSS token sequences, enabling remote information disclosure. The issue is addressed by Microsoft Security Bulletin MS13-088 and corresponding patches. The vulnerability sch...

CVE-2013-3915

CVE-2013-3915/3917 describe memory corruption and remote code execution in Microsoft Internet Explorer (IE) versions 6–11 triggered by a crafted web site. The two CVEs refer to an IE memory corruption issue with high impact (remote code execution/DoS) and are tied to MS13-088 (Cumulative Security...

CVE-2014-0304

Microsoft Internet Explorer 11 is affected by CVE-2014-0304 (Memory Corruption). The vulnerability allows remote code execution or denial of service via a crafted web page due to memory object access. Mitigation provided by the vendor through MS14-012 (Cumulative Security Update for Internet Expl...

CVE-2014-0309

CVE-2014-0309 affects Microsoft Internet Explorer 8–10. The vulnerability enables remote code execution or memory corruption when a user views a crafted web page, exploitable via IE’s memory handling components (MSHTML/IE engine). Public details in the connected docs confirm the root cause as mem...

CVE-2014-1774

Affected software: Microsoft Internet Explorer 9. The vulnerability is a memory corruption flaw in IE9 that can be triggered by a crafted web site, enabling remote code execution or a denial of service. This CVE is part of a set (CVE-2014-1774, -1788, -2754) describing memory corruption vulnerabi...

CVE-2014-1779

CVE-2014-1779 describes a memory corruption vulnerability in Microsoft Internet Explorer (IE6–IE11) that is triggered by a crafted web page. The connected document provides technical context: the issue is identified as a Use-After-Free (UAF) in the browser’s memory management, with exploitation d...

CVE-2014-2794

CVE-2014-2794 affects Microsoft Internet Explorer 6 and 7. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. Public exploits exist. Remediation: apply updates (e.g., MS14-037) and other Microsoft security guidance; monito...

CVE-2014-4082

CVE-2014-4082 is a Microsoft Internet Explorer memory-corruption vulnerability affecting IE versions 6 through 10. The issue allows remote attackers to execute arbitrary code or cause a denial of service by convincing a user to visit a crafted web page, via a remote memory-corruption condition in...

CVE-2015-1708

Microsoft Internet Explorer 8 and 9 are affected by CVE-2015-1708, a memory corruption vulnerability that enables remote code execution or memory-related denial of service when a user visits a crafted webpage. The issue is addressed by the MS15-043 security update (KB 3049563) and related advisor...

CVE-2015-6047

CVE-2015-6047 affects Microsoft Internet Explorer 8–11 via the broker EditWith feature, enabling remote attackers to bypass AppContainer and escalate privileges (Low to Medium Integrity) by a crafted DelegateExecute launch. The vulnerability is discussed across multiple sources as part of the MS1...

CVE-2015-6147

Microsoft Internet Explorer 8 and 9 are affected by CVE-2015-6147, a memory corruption vulnerability triggered by visiting a crafted web site. The CNVD entries describe memory corruption when IE fails to properly access objects in memory, potentially allowing remote code execution or memory corru...

CVE-2016-0106

CVE-2016-0106 concerns Microsoft Internet Explorer 11 memory corruption via a crafted web site, leading to remote code execution or memory corruption. Connected data confirms the same family affects IE11/Edge with similar impact; root cause is improper handling of memory objects in IE11. The vuln...

CVE-1999-0869

The vulnerability (CVE-1999-0869) affects Internet Explorer 3.x to 4.01. It allows a remote attacker to insert malicious content into a frame of another web site (frame spoofing). No remediation or exploitation details are provided in the connected documents.

CVE-1999-1370

The CVE-1999-1370 entry concerns the Internet Explorer 5.0 setup wizard (ie5setup.exe). The provided sources state that during unattended installation it disables the screen saver and the Task Scheduler Service, potentially allowing local access or disruption of security-critical program executio...

CVE-2000-0439

Vulnerability: Internet Explorer 4.0/5.0. Issue: malicious site can obtain cookies from another domain by embedding that domain name with escaped characters in a URL (Unauthorized Cookie Access). Root cause: cross-domain cookie access via crafted URL. Impact: potential leakage of cookies across d...

CVE-2000-0503

The CVE-2000-0503 entry concerns the IFRAME within the WebBrowser control of Internet Explorer 5.01. The issue allows a remote attacker to violate the cross-frame security policy via the NavigateComplete2 event. The description and connected records indicate the vulnerability is tied to the WebBr...

CVE-2001-0002

Affected software: Internet Explorer 5.5 and earlier.What’s vulnerable: how IE handles cached content in the Local Computer Zone and execution via .chm files, enabling remote code execution.Impact: remote attacker could run arbitrary code on the affected host.Remediation: apply the relevant cumul...

CVE-2001-0149

CVE-2001-0149 affects Windows Scripting Host in Internet Explorer 5.5 and earlier. The vulnerability allows remote attackers to read arbitrary files through the GetObject JavaScript function and the htmlfile ActiveX object. Affected product: Internet Explorer on Windows (older IE versions). Root ...

CVE-2001-0875

CVE-2001-0875 affects Internet Explorer 5.01/5.5/6.0 where the file-download dialog can misrepresent the filename, potentially enabling remote code execution. OpenVAS details indicate the July 2004 IE Cumulative Patch (MS05-020) mitigates this, but it is not applied on the remote host in one list...

CVE-2002-1714

CVE-2002-1714 affects Microsoft Internet Explorer 5.0 through 6.0. The issue arises when processing an object of type "text/html" where the DATA field identifies the HTML document containing the object, which may trigger infinite recursion and cause a denial of service (crash). NVD lists a CVSS v...

CVE-2004-2307

CVE-2004-2307 affects Microsoft Internet Explorer 6.0.2600 on Windows XP. The vulnerability allows remote attackers to cause a denial of service (browser crash) by using a shell: URI with double backslashes (\) in an HTML tag (e.g., IFRAME or A). The connected documents confirm the attack vector ...

CVE-2005-4810

Microsoft Internet Explorer 7.0 Beta3 and earlier is affected. The vulnerability arises when a remote attacker exploits an XMLHttpRequest response that contains a text/html Content-Type header, causing the browser to crash and leading to a denial of service. The documented impact is a crash; no o...

CVE-2006-0585

CVE-2006-0585 affects jscript.dll in Microsoft Internet Explorer 6.0 SP1 and earlier. A remote attacker can cause a denial of service (application crash) by embedding a Shockwave Flash object that contains ActionScript code calling VBScript, which then calls Javascript’s document.write, triggerin...

CVE-2006-2384

CVE-2006-2384 corresponds to Internet Explorer address bar spoofing: IE 5.01 SP4, 6 SP1 and earlier can display a trusted UI while navigating to a malicious site, enabling phishing-like spoofing. The vulnerability arises from a method that preserves the address bar/trust UI after navigation. Micr...

CVE-2006-3637

CVE-2006-3637 is an Internet Explorer remote code execution vulnerability in the HTML rendering path where certain layout combinations can corrupt memory. A crafted HTML file/page could allow a user-assisted remote attacker to execute arbitrary code with the caller’s privileges. Affected products...

CVE-2006-3897

CVE-2006-3897 describes a stack overflow in Microsoft Internet Explorer 6 on Windows 2000 caused by creating an NMSA.ASFSourceMediaDescription.1 ActiveX object with an overly long dispValue property. This leads to a remote-denial-of-service condition (application crash). Connected documents confi...

CVE-2007-2938

The CVE-2007-2938 entry affects the BaseRunner ActiveX control in the Ademco ATNBaseLoader100 Module (ATNBaseLoader100.dll) version 5.4.0.6. It describes a buffer overflow condition that, when Internet Explorer 6 is used, allows remote attackers to execute arbitrary code via a long argument to th...

CVE-2007-3075

CVE-2007-3075: Directory traversal vulnerability in Microsoft Internet Explorer allows remote attackers to read arbitrary files via directory traversal sequences in a URI with a certain scheme (e.g., encoded backslash). The connected documents confirm the vulnerability description but do not spec...

CVE-2007-5355

The CVE describes a design/logic issue in Microsoft WPAD for Internet Explorer 6/7 where, if a primary DNS suffix has three or more components, unqualified wpad queries can resolve to a host in a deeper second-level domain outside the configured DNS zone, enabling potential MITM by remote WPAD se...

CVE-2013-3914

CVE-2013-3914 affects Microsoft Internet Explorer 9–11. Description confirms memory corruption that enables remote code execution or memory corruption Denial of Service via a crafted site. Root cause: memory corruption in IE’s handling of certain objects/files, leading to code execution in the co...

CVE-2014-2755

CVE-2014-2755 concerns Microsoft Internet Explorer 11 memory corruption via a crafted web site. The Connected document for CVE-2014-1785 indicates this family of vulnerabilities (Internet Explorer Memory Corruption) has been exploited (Exploits listed on Exploit-DB) and is associated with IE11. T...

CVE-2014-2807

Affected software: Microsoft Internet Explorer 6–11. Vulnerability: memory corruption in the browser via a crafted web site (Internet Explorer Memory Corruption Vulnerability). Impact: remote code execution or denial of service; exploitation can lead to arbitrary code execution. Exploitation stat...

CVE-2015-6141

Microsoft Internet Explorer 9 is affected by CVE-2015-6141, a memory corruption vulnerability exploitable via a crafted web site that can lead to remote code execution or denial of service. The available documents identify the affected product (Internet Explorer 9) and the attack vector (crafted ...

CVE-2016-0069

CVE-2016-0069 corresponds to Internet Explorer cross-domain policy bypass (Same Origin Policy bypass) affecting IE 9–11. Connected sources indicate the flaw enables information disclosure via cross-domain policy bypass, with MS16-009 addressing the issue. The vulnerability is described as an elev...

CVE-2016-3210

CVE-2016-3210 is the Scripting Engine Memory Corruption Vulnerability affecting Microsoft Internet Explorer 11 JScript and VBScript engines. Public sources (NVD/MS16-063) describe remote code execution or memory corruption via a crafted webpage, allowing an attacker to execute arbitrary code in t...

CVE-1999-0331

The provided documents identify CVE-1999-0331 as a buffer overflow vulnerability in Internet Explorer 4.0(1) . The description confirms a buffer overflow issue, but none of the connected documents supply a concrete fix version, remediation steps, affected subcomponents, exploit details, or in‑the...

CVE-2000-0596

Summary: The CVE-2000-0596 issue involves Internet Explorer (IE 5.x/IE 5.01) opening Microsoft Access database/project files via HTML OBJECT tags without warning, enabling remote code execution via embedded VBA/macro. Affected components: IE’s handling of OBJECT tags referencing Access file types...

CVE-2001-0643

Affected software: Internet Explorer 5.5. Issue: CLSID not displayed when it appears at the end of a file name, enabling spoofing of file type and potentially deceiving users into executing a dangerous program. Impact: user may run unintended or unsafe code due to misleading file type indication....

CVE-2002-0136

CVE-2002-0136 affects Microsoft Internet Explorer 5.5 on Windows 98. The vulnerability enables a remote web page to trigger a denial-of-service (hang) by sending extremely long values in form fields (INPUT/TEXTAREA) that can be auto-filled via JavaScript. The available sources describe the affect...

CVE-2002-0242

The CVE-2002-0242 entry concerns Internet Explorer 6 and describes a cross-site scripting vulnerability where output from a remote server via an Extended HTML Form is not properly cleansed, allowing remote script execution. Affected component: Internet Explorer 6 (Extended HTML Form handling). Ro...

CVE-2002-0722

Microsoft Internet Explorer versions 5.01, 5.5, and 6.0 are affected by CVE-2002-0722 due to a UI spoof flaw in the File Download dialogue that allows remote attackers to misrepresent a file’s origin and mislead users into trusting unsafe downloads. The vulnerability has a CVSS-based high impact ...

CVE-2002-1188

CVE-2002-1188 affects Microsoft Internet Explorer 5.01–6.0. The vulnerability arises from uses of the OBJECT tag that are not subjected to proper security checks, enabling remote attackers to disclose information by identifying the path to the Temporary Internet Files folder and accessing user da...

CVE-2002-2311

Microsoft Internet Explorer 6.0 (and possibly others) is affected by CVE-2002-2311. The issue arises when a webpage contains a onkeydown handler that checks event.ctrlKey or event.shiftKey; with those keys pressed, a remote attacker can upload arbitrary file contents. This is the underlying vulne...

CVE-2003-0838

CVE-2003-0838 concerns Internet Explorer where an attacker can bypass zone restrictions and cause arbitrary code execution by creating a popup window and inserting ActiveX object code with a data tag that IE may treat as HTML/Javascript but execute as an HTA application. The vulnerability is rela...