1635 matches found
CVE-1999-1473
CVE-1999-1473 affects Internet Explorer 3.02 and 4.0, where during a page redirect the browser automatically resends authentication information to the redirected site. This issue can expose credentials to the second site, aligning with the description that it resends authentication data and the C...
CVE-2001-1219
The vulnerability affects Microsoft Internet Explorer 6.0 and earlier , where a malicious page can cause a denial‑of‑service by repeatedly refreshing the window via self.location, potentially crashing the client. The provided documents identify the basic behavior but do not specify vendor patches...
CVE-2001-1450
CVE-2001-1450 affects Microsoft Internet Explorer 5.0–6.0. A crafted FTP URL such as "/.#./" can cause a denial of service (browser crash). Documents do not provide exploitation details or remediation/patch information.
CVE-2002-0077
CVE-2002-0077 affects Microsoft Internet Explorer 5.01, 5.5 and 6.0. The vulnerability arises when objects invoked on HTML pages use CODEBASE/local object handling, causing the Local Computer zone to potentially execute local executables via certain objects (e.g., popup). This could allow remote ...
CVE-2002-0191
Microsoft Internet Explorer 5.01, 5.5 and 6.0 are affected by CVE-2002-0191, which allows remote attackers to view arbitrary files containing the "{" character via script using the cssText property of a stylesheet object (Local Information Disclosure through HTML Object). The vulnerability is des...
CVE-2002-0976
Internet Explorer 4.0 and later is affected. The issue lets remote attackers read arbitrary files via a web page that uses the legacy XML Datasource applet (com.ms.xml.dso.XMLDSO.class) and manipulates the base URL to point to the local system, which is trusted by the applet. Impact is partial co...
CVE-2002-1187
CVE-2002-1187 describes a cross-site scripting (XSS) vulnerability in Internet Explorer 5.01 through 6.0. The issue allows remote attackers to read and execute files on the local system via web pages that use the or element and JavaScript, as demonstrated with the PrivacyPolicy.dlg resource. Th...
CVE-2002-1671
Microsoft Internet Explorer versions 5.0, 5.01, and 5.5 are affected by a vulnerability in the clipboardData.getData method that enables remote attackers to monitor the contents of the clipboard. The issue is described across CVE-2002-1671 entries in NVD, CVE List, and related records, consistent...
CVE-2002-2031
Affected software: Internet Explorer 5.0, 5.0.1 and 5.5. Vulnerability details: When JavaScript execution is enabled, a script tag with a src attribute referencing a non-JavaScript file can be used to determine the existence of arbitrary files, by leveraging the onError event handler to observe r...
CVE-2003-0519
CVE-2003-0519 refers to certain versions of Internet Explorer 5 and 6 on Windows that can be remotely triggered to freeze (DoS) by accessing a URL pointing to the MS-DOS device name C:\aux (and possibly other devices). The available sources confirm a denial-of-service impact when a crafted URL is...
CVE-2005-2830
CVE-2005-2830 is an information-disclosure vulnerability in Microsoft Internet Explorer 5.01/5.5/6 when using an HTTPS proxy that requires Basic Authentication, causing URLs to be sent in cleartext. The issue is documented in the HTTPS Proxy Vulnerability (CAN-2005-2830) and is addressed by Micro...
CVE-2006-3357
CVE-2006-3357 describes a heap overflow in the HTML Help ActiveX control (hhctrl.ocx) used by Internet Explorer 6. The vulnerability occurs when repeatedly setting the Image property of Internet.HHCtrl.1, which can lead to remote code execution or an application crash. Public advisories attribute...
CVE-2006-3513
The vulnerability CVE-2006-3513 affects Microsoft Internet Explorer 6 via the component danim.dll . It allows a remote attacker to trigger a denial of service (application crash) by accessing the Data property of a DirectAnimation DAUserData object before it is initialized, causing a NULL pointer...
CVE-2006-3639
CVE-2006-3639 describes an information disclosure and remote code execution vulnerability in Microsoft Internet Explorer (IE) 5.01 and IE6 related to how a source element is handled during redirects across domains. Exploitation could allow an attacker to read data from a Web page in another IE do...
CVE-2006-3915
CVE-2006-3915 affects Microsoft Internet Explorer 6 on Windows XP SP2. The vulnerability allows a remote actor to crash the browser by iterating over a native function (demonstrated with window.alert), triggering a null dereference and resulting in a denial of service. The provided sources docume...
CVE-2006-4687
CVE-2006-4687 describes a remote code execution vulnerability in Microsoft Internet Explorer (versions 5.01–6) triggered by crafted HTML layout using DIV tags and CSS float properties, causing memory corruption. Several connected sources (ZDI-06-041, CERT/NVD, and the MS06-067 bulletin) corrobora...
CVE-2006-7066
CVE-2006-7066 affects Microsoft Internet Explorer 6 on Windows XP SP2. The vulnerability allows remote denial of service (crash) by creating an object inside an iframe, deleting the frame via location.href = about:blank, then accessing a property of the object in the deleted frame, triggering a N...
CVE-2007-3406
CVE-2007-3406 affects Microsoft Internet Explorer 6 on Windows XP SP2. It describes multiple absolute path traversal vulnerabilities allowing remote access to arbitrary local files via the file: URI or related attributes/tags (src in bgsound, input, EMBED, img, script; data in object; value in pa...
CVE-2007-4356
Microsoft Internet Explorer 6 and 7 embeds FTP credentials in HTML files that are retrieved during an FTP session, allowing context-dependent attackers to obtain sensitive information by reading the HTML source. The vulnerability is demonstrated in (1) .htm, (2) .html, or (3) .mht files. The prov...
CVE-2008-0090
The CVE-2008-0090 issue affects DivX Player 6.6.0 through the ActiveX control npUpload.dll. The vulnerability is triggered in the SetPassword method by a long argument, leading to a denial of service (Internet Explorer 7 crash). The connected documents consistently describe this DoS scenario with...
CVE-2012-1882
CVE-2012-1882 affects Microsoft Internet Explorer 6–9. The vulnerability arises because IE does not block cross-domain scrolling events, allowing a crafted web site to read content from a different domain or zone (information disclosure). The OpenVAS/Nessus references associate this CVE with MS12...
CVE-2013-3118
CVE-2013-3120 is a memory corruption vulnerability in Microsoft Internet Explorer 10 (MSHTML) related to the CEditAdorner::Detach use-after-free path. Exploitation is achievable through a crafted web page and can lead to remote code execution or a denial of service. An exploit exists (Exploit-DB ...
CVE-2013-3141
CVE-2013-3141 affects Microsoft Internet Explorer 8 and 9. The vulnerability => remote attackers can trigger memory corruption via a crafted web site, enabling arbitrary code execution or a denial of service. The issue is distinct from CVE-2013-3110. Affected products: IE 8/9; root cause descr...
CVE-2013-5051
CVE-2013-5051 affects Microsoft Internet Explorer 10 and 11, allowing a remote attacker to execute arbitrary code or cause a memory corruption-based DoS by visiting a crafted web page. The vulnerability stems from an error in how Internet Explorer accesses an object in memory, enabling remote cod...
CVE-2014-1803
Mode C: CVE-2014-1803 is an Internet Explorer memory-corruption vulnerability (IE6–IE11) described in the connected doc as a Use-After-Free in heap-allocated objects, with a PoC referencing MS14-035. The myhack58 article details a UAF chain in mshtml, tracing the crash to a virtual function call ...
CVE-2014-2767
CVE-2014-2767 is an Internet Explorer memory-corruption vulnerability that affects IE 6–11 (per connected sources). A crafted web site can trigger memory corruption, enabling remote code execution or causing a Denial of Service. Public exploits exist. Microsoft addressed the issue in MS14-035; re...
CVE-2014-4093
CVE-2014-4093 affects Microsoft Internet Explorer 10. Description: memory corruption vulnerability in IE10 that can allow remote attackers to execute arbitrary code or cause a denial of service when a user visits a crafted web site (distinct from CVE-2014-4084). Connected sources reiterate IE10 m...
CVE-2015-6144
CVE-2015-6144 corresponds to a Microsoft Internet Explorer/Edge XSS Filter Bypass vulnerability. The connected sources confirm IE versions 8–11 and Edge are affected by mishandling HTML attributes in HTTP responses, enabling a remote attacker to bypass the built-in XSS protection via unspecified ...
CVE-2015-6145
Microsoft Internet Explorer 7 and 8 are affected by CVE-2015-6145 (memory corruption) via a crafted web site, potentially enabling remote code execution or DoS. This CVE is distinct from CVE-2015-6146. CNVD entries corroborate memory corruption in IE7/IE8. Microsoft addressed this family with MS1...
CVE-2000-0156
Technical details (affected products, vulnerable components, and exploit information) are not provided in the supplied documents. Monitor for updates.
CVE-2000-0464
CVE-2000-0464 affects Internet Explorer 4.x and 5.x, with a buffer overflow in the ActiveX parameter parsing capability (the “Malformed Component Attribute” vulnerability). The available documents describe remote code execution as the impact but do not provide concrete patch/version details or re...
CVE-2001-0724
CVE-2001-0724 relates to Internet Explorer 5.5 (and related IE versions) where malformed URLs containing dotless IP addresses can cause the browser to treat a page as if it were in the Intranet Zone, bypassing some security restrictions (zone spoofing). The vulnerability is the use of numeric IP ...
CVE-2001-0904
CVE-2001-0904 concerns Internet Explorer versions 5.5 and 6, where the MS01-055 (Q312461) patch modifies the HTTP_USER_AGENT string to indicate that the patch is installed. This behavior can enable remote malicious websites to more easily identify vulnerable clients. The provided records describe...
CVE-2002-0461
CVE-2002-0461 affects Internet Explorer 5.01 through 6. A crafted web page using JavaScript that calls location.replace on itself can create a loop, leading to a denial of service via application crash. The connected sources confirm the affected product and the underlying cause (recursive locatio...
CVE-2002-2125
In the provided documents, CVE-2002-2125 affects Internet Explorer 6.0 . The vulnerability occurs when an expired certificate authority (CA) certificate is submitted to the user while a newer CA certificate already exists in the local store, and IE does not warn the user. This can allow remote at...
CVE-2003-0446
The CVE-2003-0446 entry concerns Cross-site Scripting (XSS) in Internet Explorer 5.5 and 6.0, potentially in a shared component used by other Microsoft products. The vulnerability arises when processing an XML file that contains a parse error, which allows remote attackers to inject arbitrary web...
CVE-2003-1505
Vulnerability summary (CVE-2003-1505): Microsoft Internet Explorer 6.0 is vulnerable to a remote denial of service (crash) by crafted HTML/CSS. Specifically, a page or HTML email containing a textarea inside a div whose scrollbar-base-color is modified via CSS and then moved can trigger the crash...
CVE-2004-0845
CVE-2004-0845 concerns Internet Explorer (IE) versions 5.01, 5.5, and 6. The vulnerability arises from improper caching of SSL content, allowing an attacker to obtain information or spoof content by redirecting a user to a malicious site with the same host name as the target, causing cached conte...
CVE-2006-3512
CVE-2006-3512 affects Internet Explorer 6 on Windows XP. The vulnerability arises when the Enabled property of a DXTFilter ActiveX object is set to true, leading to a null dereference and a remote denial of service. The issue is documented in multiple sources (e.g., NVD) with a CVSS base score of...
CVE-2006-3640
CVE-2006-3640 is an Information Disclosure vulnerability in Microsoft Internet Explorer (IE 5.01 and 6) where a script can persist across navigations to reveal the window location in another domain/IE zone. The NVD description matches a Window Location Information Disclosure Vector, and the conne...
CVE-2006-6310
Microsoft Internet Explorer 6.0 SP1 and earlier is affected by CVE-2006-6310. A remote attacker could cause a denial of service (crash) by providing an invalid src value ("?") in an HTML frame tag that is inside a frameset with a large rows attribute. Root cause: invalid src attribute in a frame ...
CVE-2008-1442
CVE-2008-1442 concerns a heap-based buffer overflow in the substringData method of Internet Explorer 6 and 7, allowing remote code execution via crafted web pages (HTML Objects Memory Corruption). The connected MSKB (MS08-031) confirms multiple affected IE versions on Windows XP/2003 family and d...
CVE-2008-4787
CVE-2008-4787 describes a visual truncation/address-bar spoofing issue in Microsoft Internet Explorer 6. The vulnerability occurs when a hostname contains many characters, which render as whitespace, enabling a page to appear at a different address than its actual content. The entry cites MSRC789...
CVE-2008-5551
Microsoft Internet Explorer 8.0 Beta 2 contains an anti-XSS filter bypass vulnerability (the XSS Filter) that allows XSS by injecting data at two positions in HTML documents (STYLE elements and the CSS expression property), described as a "double injection." The connected OpenVAS entry and relate...
CVE-2013-3149
CVE-2013-3149 corresponds to memory corruption in Internet Explorer 7 and 8 that can allow remote code execution or memory corruption via a crafted web page. The vulnerability is documented to affect IE7/IE8 on multiple Windows versions and was addressed by Microsoft in security bulletin MS13-055...
CVE-1999-0802
Summary: CVE-1999-0802 concerns a buffer overflow in Internet Explorer 5 that enables remote command execution via a malformed Favorites icon. The connected Red Hat and CVE records mirror the same description. The core detail is the vulnerability class (buffer overflow) in the browser component; ...
CVE-1999-0858
CVE-1999-0858 affects Internet Explorer 5. The issue allows a remote attacker to modify the IE client’s proxy configuration by pointing a malicious Web Proxy Auto-Discovery (WPAD) server at the client, potentially changing how the browser routes traffic. The root cause is WPAD-based proxy configu...
CVE-1999-1128
The CVE-1999-1128 entry describes Internet Explorer 3.01 on Windows 95 as vulnerable. A .isp file is automatically downloaded and executed from remote malicious sites without user prompts, allowing remote arbitrary command execution. The available documents do not specify a remediation or patch, ...