CVE-2014-4099

CVE-2014-4099 in Microsoft Internet Explorer (IE) 9–11 is linked to a remote code execution vulnerability arising from out-of-bounds indexing of CCanvasRadialGradient objects in IE. The flaw enables an attacker to run arbitrary code when a user visits a crafted page or file, with the attack requi...

CVE-2015-1703

CVE-2015-1703 affects Microsoft Internet Explorer 6–11. A remote attacker can escalate privileges by directing a user to a crafted web page, with the underlying issue classified as an elevation of privilege vulnerability. The CVE is noted as distinct from CVE-2015-1704 in public records. Connecte...

CVE-2015-6144

CVE-2015-6144 corresponds to a Microsoft Internet Explorer/Edge XSS Filter Bypass vulnerability. The connected sources confirm IE versions 8–11 and Edge are affected by mishandling HTML attributes in HTTP responses, enabling a remote attacker to bypass the built-in XSS protection via unspecified ...

CVE-1999-0858

CVE-1999-0858 affects Internet Explorer 5. The issue allows a remote attacker to modify the IE client’s proxy configuration by pointing a malicious Web Proxy Auto-Discovery (WPAD) server at the client, potentially changing how the browser routes traffic. The root cause is WPAD-based proxy configu...

CVE-1999-1575

Technical details such as affected software versions, root cause, and exploitation are not publicly provided in the supplied documents. Monitor for updates from official sources for concrete fixes or mitigations.

CVE-2000-0464

CVE-2000-0464 affects Internet Explorer 4.x and 5.x, with a buffer overflow in the ActiveX parameter parsing capability (the “Malformed Component Attribute” vulnerability). The available documents describe remote code execution as the impact but do not provide concrete patch/version details or re...

CVE-2001-0246

CVE-2001-0246 affects Internet Explorer 5.5 and earlier. The vulnerability arises from improper verification of the domain of a frame within a browser window, enabling remote web site operators to read certain files on the client by sending information from a local frame to a frame in a different...

CVE-2001-0332

Internet Explorer 5.5 and earlier are vulnerable to a Frame Domain Verification flaw where an attacker can read local files by abusing frame domain checks via MSScriptControl.ScriptControl and GetObject. Affected product: IE up to version 5.5 and earlier. Root cause: improper domain verification ...

CVE-2002-0023

CVE-2002-0023 affects Internet Explorer 5.01, 5.5 and 6.0. The vulnerability arises in the GetObject function, where malformed requests can bypass some security checks, allowing remote attackers to read arbitrary files. The connected records confirm the affected products and the vulnerability cla...

CVE-2002-1187

CVE-2002-1187 describes a cross-site scripting (XSS) vulnerability in Internet Explorer 5.01 through 6.0. The issue allows remote attackers to read and execute files on the local system via web pages that use the or element and JavaScript, as demonstrated with the PrivacyPolicy.dlg resource. Th...

CVE-2002-1671

Microsoft Internet Explorer versions 5.0, 5.01, and 5.5 are affected by a vulnerability in the clipboardData.getData method that enables remote attackers to monitor the contents of the clipboard. The issue is described across CVE-2002-1671 entries in NVD, CVE List, and related records, consistent...

CVE-2002-2031

Affected software: Internet Explorer 5.0, 5.0.1 and 5.5. Vulnerability details: When JavaScript execution is enabled, a script tag with a src attribute referencing a non-JavaScript file can be used to determine the existence of arbitrary files, by leveraging the onError event handler to observe r...

CVE-2006-3357

CVE-2006-3357 describes a heap overflow in the HTML Help ActiveX control (hhctrl.ocx) used by Internet Explorer 6. The vulnerability occurs when repeatedly setting the Image property of Internet.HHCtrl.1, which can lead to remote code execution or an application crash. Public advisories attribute...

CVE-2006-3512

CVE-2006-3512 affects Internet Explorer 6 on Windows XP. The vulnerability arises when the Enabled property of a DXTFilter ActiveX object is set to true, leading to a null dereference and a remote denial of service. The issue is documented in multiple sources (e.g., NVD) with a CVSS base score of...

CVE-2006-3639

CVE-2006-3639 describes an information disclosure and remote code execution vulnerability in Microsoft Internet Explorer (IE) 5.01 and IE6 related to how a source element is handled during redirects across domains. Exploitation could allow an attacker to read data from a Web page in another IE do...

CVE-2006-7066

CVE-2006-7066 affects Microsoft Internet Explorer 6 on Windows XP SP2. The vulnerability allows remote denial of service (crash) by creating an object inside an iframe, deleting the frame via location.href = about:blank, then accessing a property of the object in the deleted frame, triggering a N...

CVE-2007-3111

CVE-2007-3111 describes a boundary/URL property handling error in the Provideo Camimage ISSCamControl.dll ActiveX control (version 1.0.1.5). The CPAI advisory states a remote attacker could lure a user to a crafted HTML page to trigger a buffer overflow, enabling remote code execution on Windows ...

CVE-2008-0090

The CVE-2008-0090 issue affects DivX Player 6.6.0 through the ActiveX control npUpload.dll. The vulnerability is triggered in the SetPassword method by a long argument, leading to a denial of service (Internet Explorer 7 crash). The connected documents consistently describe this DoS scenario with...

CVE-2008-3476

CVE-2008-3476 is a memory corruption vulnerability in Microsoft Internet Explorer (IE) that affects IE 5.01 SP4 and IE 6. It arises from improper handling of errors when accessing uninitialized memory in certain HTML object scenarios, enabling remote code execution via a crafted HTML page. The is...

CVE-2012-1539

CVE-2012-1539 is a use-after-free vulnerability in Microsoft Internet Explorer 9 (CTreePos/CTreeNode) that could allow remote code execution via a crafted web page. Technical details across connected sources indicate memory corruption from accessing objects that were not properly initialized or a...

CVE-1999-1473

CVE-1999-1473 affects Internet Explorer 3.02 and 4.0, where during a page redirect the browser automatically resends authentication information to the redirected site. This issue can expose credentials to the second site, aligning with the description that it resends authentication data and the C...

CVE-2001-0724

CVE-2001-0724 relates to Internet Explorer 5.5 (and related IE versions) where malformed URLs containing dotless IP addresses can cause the browser to treat a page as if it were in the Intranet Zone, bypassing some security restrictions (zone spoofing). The vulnerability is the use of numeric IP ...

CVE-2001-0904

CVE-2001-0904 concerns Internet Explorer versions 5.5 and 6, where the MS01-055 (Q312461) patch modifies the HTTP_USER_AGENT string to indicate that the patch is installed. This behavior can enable remote malicious websites to more easily identify vulnerable clients. The provided records describe...

CVE-2002-0976

Internet Explorer 4.0 and later is affected. The issue lets remote attackers read arbitrary files via a web page that uses the legacy XML Datasource applet (com.ms.xml.dso.XMLDSO.class) and manipulates the base URL to point to the local system, which is trusted by the applet. Impact is partial co...

CVE-2002-1688

This CVE concerns Microsoft Internet Explorer versions 5.5–6.0, where the browser history feature can be abused to execute arbitrary JavaScript in the context of a user session. An attacker can inject JavaScript into the URL, which is executed when the user clicks Back, allowing remote script exe...

CVE-2003-0519

CVE-2003-0519 refers to certain versions of Internet Explorer 5 and 6 on Windows that can be remotely triggered to freeze (DoS) by accessing a URL pointing to the MS-DOS device name C:\aux (and possibly other devices). The available sources confirm a denial-of-service impact when a crafted URL is...

CVE-2003-1505

Vulnerability summary (CVE-2003-1505): Microsoft Internet Explorer 6.0 is vulnerable to a remote denial of service (crash) by crafted HTML/CSS. Specifically, a page or HTML email containing a textarea inside a div whose scrollbar-base-color is modified via CSS and then moved can trigger the crash...

CVE-2005-2830

CVE-2005-2830 is an information-disclosure vulnerability in Microsoft Internet Explorer 5.01/5.5/6 when using an HTTPS proxy that requires Basic Authentication, causing URLs to be sent in cleartext. The issue is documented in the HTTPS Proxy Vulnerability (CAN-2005-2830) and is addressed by Micro...

CVE-2006-3427

CVE-2006-3427 affects Microsoft Internet Explorer 6. The issue arises when declaring the sourceURL attribute on an uninitialized DirectAnimation.StructuredGraphicsControl ActiveX Object, causing a null dereference and a denial of service (crash). Documents do not provide patch/version details or ...

CVE-2006-3513

The vulnerability CVE-2006-3513 affects Microsoft Internet Explorer 6 via the component danim.dll . It allows a remote attacker to trigger a denial of service (application crash) by accessing the Data property of a DirectAnimation DAUserData object before it is initialized, causing a NULL pointer...

CVE-2006-3915

CVE-2006-3915 affects Microsoft Internet Explorer 6 on Windows XP SP2. The vulnerability allows a remote actor to crash the browser by iterating over a native function (demonstrated with window.alert), triggering a null dereference and resulting in a denial of service. The provided sources docume...

CVE-2006-4687

CVE-2006-4687 describes a remote code execution vulnerability in Microsoft Internet Explorer (versions 5.01–6) triggered by crafted HTML layout using DIV tags and CSS float properties, causing memory corruption. Several connected sources (ZDI-06-041, CERT/NVD, and the MS06-067 bulletin) corrobora...

CVE-2006-6310

Microsoft Internet Explorer 6.0 SP1 and earlier is affected by CVE-2006-6310. A remote attacker could cause a denial of service (crash) by providing an invalid src value ("?") in an HTML frame tag that is inside a frameset with a large rows attribute. Root cause: invalid src attribute in a frame ...

CVE-2007-2161

CVE-2007-2161 affects Microsoft Internet Explorer 7. The vulnerability is triggered by JavaScript that matches a regular expression against a long string (demonstrated with /(.)*/), allowing a remote attacker to cause a denial of service (browser hang). The provided documents do not specify the a...

CVE-2007-4356

Microsoft Internet Explorer 6 and 7 embeds FTP credentials in HTML files that are retrieved during an FTP session, allowing context-dependent attackers to obtain sensitive information by reading the HTML source. The vulnerability is demonstrated in (1) .htm, (2) .html, or (3) .mht files. The prov...

CVE-2008-2159

Microsoft Internet Explorer 7 is affected by CVE-2008-2159: the browser can save encrypted pages in the cache even when the DisableCachingOfSSLPages registry setting is enabled. This underlying behavior may allow local users to access sensitive information cached from SSL pages. The description l...

CVE-2013-3118

CVE-2013-3120 is a memory corruption vulnerability in Microsoft Internet Explorer 10 (MSHTML) related to the CEditAdorner::Detach use-after-free path. Exploitation is achievable through a crafted web page and can lead to remote code execution or a denial of service. An exploit exists (Exploit-DB ...

CVE-2014-1803

Mode C: CVE-2014-1803 is an Internet Explorer memory-corruption vulnerability (IE6–IE11) described in the connected doc as a Use-After-Free in heap-allocated objects, with a PoC referencing MS14-035. The myhack58 article details a UAF chain in mshtml, tracing the crash to a virtual function call ...

CVE-2014-4093

CVE-2014-4093 affects Microsoft Internet Explorer 10. Description: memory corruption vulnerability in IE10 that can allow remote attackers to execute arbitrary code or cause a denial of service when a user visits a crafted web site (distinct from CVE-2014-4084). Connected sources reiterate IE10 m...

CVE-1999-1446

Technical details for CVE-1999-1446 are not publicly available in the provided documents. Monitor for updates.

CVE-2001-1219

The vulnerability affects Microsoft Internet Explorer 6.0 and earlier , where a malicious page can cause a denial‑of‑service by repeatedly refreshing the window via self.location, potentially crashing the client. The provided documents identify the basic behavior but do not specify vendor patches...

CVE-2002-0191

Microsoft Internet Explorer 5.01, 5.5 and 6.0 are affected by CVE-2002-0191, which allows remote attackers to view arbitrary files containing the "{" character via script using the cssText property of a stylesheet object (Local Information Disclosure through HTML Object). The vulnerability is des...

CVE-2005-4841

Technical details about CVE-2005-4841 are not publicly available in the provided documents. Monitor for updates from Red Hat, NVD, CVE listings, and related advisories.

CVE-2005-4843

The CVE-2005-4843 vulnerability affects the SmartConnect Class control. It allows remote attackers to cause an Internet Explorer crash by creating a COM object of the control’s CLSID that is not intended for use within Internet Explorer. The issue is described across multiple sources (Red Hat, CV...

CVE-2006-3545

Microsoft Internet Explorer 7.0 Beta is affected by CVE-2006-3545. The vulnerability arises when a web page contains multiple empty APPLET start tags, allowing a remote attacker to trigger a denial of service (application crash). The issue is reported in IE7.0 Beta, with a third party disputing t...

CVE-2006-3640

CVE-2006-3640 is an Information Disclosure vulnerability in Microsoft Internet Explorer (IE 5.01 and 6) where a script can persist across navigations to reveal the window location in another domain/IE zone. The NVD description matches a Window Location Information Disclosure Vector, and the conne...

CVE-2006-3658

Microsoft Internet Explorer 6 is affected by CVE-2006-3658. The flaw occurs when accessing the object references of a FolderItem ActiveX object, triggering a null dereference in the security check and enabling a remote attacker to cause a denial of service (crash). The connected sources do not pr...

CVE-2008-5551

Microsoft Internet Explorer 8.0 Beta 2 contains an anti-XSS filter bypass vulnerability (the XSS Filter) that allows XSS by injecting data at two positions in HTML documents (STYLE elements and the CSS expression property), described as a "double injection." The connected OpenVAS entry and relate...

CVE-2014-2767

CVE-2014-2767 is an Internet Explorer memory-corruption vulnerability that affects IE 6–11 (per connected sources). A crafted web site can trigger memory corruption, enabling remote code execution or causing a Denial of Service. Public exploits exist. Microsoft addressed the issue in MS14-035; re...

CVE-2015-6145

Microsoft Internet Explorer 7 and 8 are affected by CVE-2015-6145 (memory corruption) via a crafted web site, potentially enabling remote code execution or DoS. This CVE is distinct from CVE-2015-6146. CNVD entries corroborate memory corruption in IE7/IE8. Microsoft addressed this family with MS1...