CVE-2002-0136

CVE-2002-0136 affects Microsoft Internet Explorer 5.5 on Windows 98. The vulnerability enables a remote web page to trigger a denial-of-service (hang) by sending extremely long values in form fields (INPUT/TEXTAREA) that can be auto-filled via JavaScript. The available sources describe the affect...

CVE-2002-0188

Affected software: Microsoft Internet Explorer 5.01 and 6.0. The vulnerability arises from incorrect handling of Content-Disposition and Content-Type header fields, causing the spoofed file type to be passed to the OS for handling instead of triggering an error. This can enable remote code execut...

CVE-2002-0242

The CVE-2002-0242 entry concerns Internet Explorer 6 and describes a cross-site scripting vulnerability where output from a remote server via an Extended HTML Form is not properly cleansed, allowing remote script execution. Affected component: Internet Explorer 6 (Extended HTML Form handling). Ro...

CVE-2002-2311

Microsoft Internet Explorer 6.0 (and possibly others) is affected by CVE-2002-2311. The issue arises when a webpage contains a onkeydown handler that checks event.ctrlKey or event.shiftKey; with those keys pressed, a remote attacker can upload arbitrary file contents. This is the underlying vulne...

CVE-2003-1505

Vulnerability summary (CVE-2003-1505): Microsoft Internet Explorer 6.0 is vulnerable to a remote denial of service (crash) by crafted HTML/CSS. Specifically, a page or HTML email containing a textarea inside a div whose scrollbar-base-color is modified via CSS and then moved can trigger the crash...

CVE-2006-2382

CVE-2006-2382 (HTML Decoding Memory Corruption Vulnerability) affects Microsoft Internet Explorer 5.01 SP4, 6 SP1 and earlier. It is a heap-based memory corruption flaw in decoding UTF-8 HTML, caused by a miscalculation of memory sizes when translating UTF-8 characters to Unicode, which could all...

CVE-2006-3640

CVE-2006-3640 is an Information Disclosure vulnerability in Microsoft Internet Explorer (IE 5.01 and 6) where a script can persist across navigations to reveal the window location in another domain/IE zone. The NVD description matches a Window Location Information Disclosure Vector, and the conne...

CVE-2006-3729

CVE-2006-3729 affects DataSourceControl in Internet Explorer 6 on Windows XP SP2 with Office installed. A large negative integer argument to getDataMemberName in OWC11.DataSourceControl.11 can cause an integer overflow and a null dereference, leading to a denial of service (crash). The NVD notes ...

CVE-2007-4227

Microsoft Windows Explorer (explorer.exe) is affected by CVE-2007-4227, a user-assisted DoS vulnerability triggered by processing a crafted image file (e.g., something.jpg). The connected documents also reference CVE-2007-3958 (GIF file) as related, indicating a similar DoS vector in explorer.exe...

CVE-2007-5456

CVE-2007-5456 describes a vulnerability in Microsoft Internet Explorer 7 and earlier where an attacker can bypass the File Download - Security Warning dialog and cause a download of arbitrary files by appending a '?' and a non-.exe filename after the .exe filename. The connected advisories and NV...

CVE-2008-3476

CVE-2008-3476 is a memory corruption vulnerability in Microsoft Internet Explorer (IE) that affects IE 5.01 SP4 and IE 6. It arises from improper handling of errors when accessing uninitialized memory in certain HTML object scenarios, enabling remote code execution via a crafted HTML page. The is...

CVE-2013-3149

CVE-2013-3149 corresponds to memory corruption in Internet Explorer 7 and 8 that can allow remote code execution or memory corruption via a crafted web page. The vulnerability is documented to affect IE7/IE8 on multiple Windows versions and was addressed by Microsoft in security bulletin MS13-055...

CVE-2014-1803

Mode C: CVE-2014-1803 is an Internet Explorer memory-corruption vulnerability (IE6–IE11) described in the connected doc as a Use-After-Free in heap-allocated objects, with a PoC referencing MS14-035. The myhack58 article details a UAF chain in mshtml, tracing the crash to a virtual function call ...

CVE-2014-2807

Affected software: Microsoft Internet Explorer 6–11. Vulnerability: memory corruption in the browser via a crafted web site (Internet Explorer Memory Corruption Vulnerability). Impact: remote code execution or denial of service; exploitation can lead to arbitrary code execution. Exploitation stat...

CVE-1999-1575

Technical details such as affected software versions, root cause, and exploitation are not publicly provided in the supplied documents. Monitor for updates from official sources for concrete fixes or mitigations.

CVE-2001-0919

CVE-2001-0919 affects Internet Explorer 5.50.4134.0100 on Windows ME. When the browser’s cookie prompt option is enabled, it does not warn the user if a cookie is set via Javascript, exposing potential privacy leakage. The provided metrics indicate a low to moderate base severity (CVSS v2: 5.1, M...

CVE-2001-1219

The vulnerability affects Microsoft Internet Explorer 6.0 and earlier , where a malicious page can cause a denial‑of‑service by repeatedly refreshing the window via self.location, potentially crashing the client. The provided documents identify the basic behavior but do not specify vendor patches...

CVE-2002-0023

CVE-2002-0023 affects Internet Explorer 5.01, 5.5 and 6.0. The vulnerability arises in the GetObject function, where malformed requests can bypass some security checks, allowing remote attackers to read arbitrary files. The connected records confirm the affected products and the vulnerability cla...

CVE-2002-1187

CVE-2002-1187 describes a cross-site scripting (XSS) vulnerability in Internet Explorer 5.01 through 6.0. The issue allows remote attackers to read and execute files on the local system via web pages that use the or element and JavaScript, as demonstrated with the PrivacyPolicy.dlg resource. Th...

CVE-2002-1688

This CVE concerns Microsoft Internet Explorer versions 5.5–6.0, where the browser history feature can be abused to execute arbitrary JavaScript in the context of a user session. An attacker can inject JavaScript into the URL, which is executed when the user clicks Back, allowing remote script exe...

CVE-2003-0519

CVE-2003-0519 refers to certain versions of Internet Explorer 5 and 6 on Windows that can be remotely triggered to freeze (DoS) by accessing a URL pointing to the MS-DOS device name C:\aux (and possibly other devices). The available sources confirm a denial-of-service impact when a crafted URL is...

CVE-2006-3357

CVE-2006-3357 describes a heap overflow in the HTML Help ActiveX control (hhctrl.ocx) used by Internet Explorer 6. The vulnerability occurs when repeatedly setting the Image property of Internet.HHCtrl.1, which can lead to remote code execution or an application crash. Public advisories attribute...

CVE-2007-3111

CVE-2007-3111 describes a boundary/URL property handling error in the Provideo Camimage ISSCamControl.dll ActiveX control (version 1.0.1.5). The CPAI advisory states a remote attacker could lure a user to a crafted HTML page to trigger a buffer overflow, enabling remote code execution on Windows ...

CVE-2014-4082

CVE-2014-4082 is a Microsoft Internet Explorer memory-corruption vulnerability affecting IE versions 6 through 10. The issue allows remote attackers to execute arbitrary code or cause a denial of service by convincing a user to visit a crafted web page, via a remote memory-corruption condition in...

CVE-1999-1473

CVE-1999-1473 affects Internet Explorer 3.02 and 4.0, where during a page redirect the browser automatically resends authentication information to the redirected site. This issue can expose credentials to the second site, aligning with the description that it resends authentication data and the C...

CVE-2001-0904

CVE-2001-0904 concerns Internet Explorer versions 5.5 and 6, where the MS01-055 (Q312461) patch modifies the HTTP_USER_AGENT string to indicate that the patch is installed. This behavior can enable remote malicious websites to more easily identify vulnerable clients. The provided records describe...

CVE-2001-1450

CVE-2001-1450 affects Microsoft Internet Explorer 5.0–6.0. A crafted FTP URL such as "/.#./" can cause a denial of service (browser crash). Documents do not provide exploitation details or remediation/patch information.

CVE-2002-0025

Internet Explorer 5.01, 5.5 and 6.0 are affected. The vulnerability arises from improper handling of the Content-Type HTML header field, which allows remote attackers to influence which application is used to process a document. Affected component: Internet Explorer versions 5.01, 5.5, and 6.0; r...

CVE-2002-0976

Internet Explorer 4.0 and later is affected. The issue lets remote attackers read arbitrary files via a web page that uses the legacy XML Datasource applet (com.ms.xml.dso.XMLDSO.class) and manipulates the base URL to point to the local system, which is trusted by the applet. Impact is partial co...

CVE-2004-1922

CVE-2004-1922 affects Microsoft Internet Explorer 5.5 and 6.0. The vulnerability arises because memory is allocated based on the memory size written in a BMP file, not the BMP’s actual size. This can allow a remote attacker to cause a denial of service through a small BMP file that specifies a la...

CVE-2006-3513

The vulnerability CVE-2006-3513 affects Microsoft Internet Explorer 6 via the component danim.dll . It allows a remote attacker to trigger a denial of service (application crash) by accessing the Data property of a DirectAnimation DAUserData object before it is initialized, causing a NULL pointer...

CVE-2006-3915

CVE-2006-3915 affects Microsoft Internet Explorer 6 on Windows XP SP2. The vulnerability allows a remote actor to crash the browser by iterating over a native function (demonstrated with window.alert), triggering a null dereference and resulting in a denial of service. The provided sources docume...

CVE-2006-6310

Microsoft Internet Explorer 6.0 SP1 and earlier is affected by CVE-2006-6310. A remote attacker could cause a denial of service (crash) by providing an invalid src value ("?") in an HTML frame tag that is inside a frameset with a large rows attribute. Root cause: invalid src attribute in a frame ...

CVE-2006-7066

CVE-2006-7066 affects Microsoft Internet Explorer 6 on Windows XP SP2. The vulnerability allows remote denial of service (crash) by creating an object inside an iframe, deleting the frame via location.href = about:blank, then accessing a property of the object in the deleted frame, triggering a N...

CVE-2007-2161

CVE-2007-2161 affects Microsoft Internet Explorer 7. The vulnerability is triggered by JavaScript that matches a regular expression against a long string (demonstrated with /(.)*/), allowing a remote attacker to cause a denial of service (browser hang). The provided documents do not specify the a...

CVE-2007-3406

CVE-2007-3406 affects Microsoft Internet Explorer 6 on Windows XP SP2. It describes multiple absolute path traversal vulnerabilities allowing remote access to arbitrary local files via the file: URI or related attributes/tags (src in bgsound, input, EMBED, img, script; data in object; value in pa...

CVE-2008-0090

The CVE-2008-0090 issue affects DivX Player 6.6.0 through the ActiveX control npUpload.dll. The vulnerability is triggered in the SetPassword method by a long argument, leading to a denial of service (Internet Explorer 7 crash). The connected documents consistently describe this DoS scenario with...

CVE-2008-1368

CVE-2008-1368 describes a CRLF injection vulnerability in Microsoft Internet Explorer 5 and 6. A remote attacker can supply an ftp:// URL containing a URL-encoded CRLF (%0D%0A) before the FTP command, causing the command to be injected into an authenticated FTP session established in the same bro...

CVE-2013-2552

The CVE-2013-2552 entry covers an unspecified vulnerability in Microsoft Internet Explorer 10 on Windows 8 that enables remote sandbox bypass by abusing access to a Medium integrity process, as demonstrated by VUPEN during Pwn2Own at CanSecWest 2013. Documents identify IE10/Windows 8 as affected ...

CVE-2014-2767

CVE-2014-2767 is an Internet Explorer memory-corruption vulnerability that affects IE 6–11 (per connected sources). A crafted web site can trigger memory corruption, enabling remote code execution or causing a Denial of Service. Public exploits exist. Microsoft addressed the issue in MS14-035; re...

CVE-2014-2771

CVE-2014-2771 affects Microsoft Internet Explorer 10 and 11 and is described as a use-after-free / memory-corruption vulnerability triggered by visiting a crafted web site (IE Memory Corruption Vulnerability). A connected analysis (TrendLabs) discusses the root cause as memory corruption via use-...

CVE-2014-4093

CVE-2014-4093 affects Microsoft Internet Explorer 10. Description: memory corruption vulnerability in IE10 that can allow remote attackers to execute arbitrary code or cause a denial of service when a user visits a crafted web site (distinct from CVE-2014-4084). Connected sources reiterate IE10 m...

CVE-1999-0858

CVE-1999-0858 affects Internet Explorer 5. The issue allows a remote attacker to modify the IE client’s proxy configuration by pointing a malicious Web Proxy Auto-Discovery (WPAD) server at the client, potentially changing how the browser routes traffic. The root cause is WPAD-based proxy configu...

CVE-1999-1446

Technical details for CVE-1999-1446 are not publicly available in the provided documents. Monitor for updates.

CVE-2000-0156

Technical details (affected products, vulnerable components, and exploit information) are not provided in the supplied documents. Monitor for updates.

CVE-2001-0722

The CVE concerns Internet Explorer versions 5.5 and 6.0, where a vulnerability allows remote attackers to read and modify the user’s cookies via Javascript executed in an about: URL. Affected software is Internet Explorer 5.5/6.0; the root cause and mechanics are described as the ability to acces...

CVE-2001-1539

CVE-2001-1539 describes a stack consumption vulnerability in Internet Explorer involving the JavaScript setTimeout function. It allows remote attackers to cause a denial of service (crash) via setTimeout. The CVE notes that the vendor could not reproduce the problem. Connected records (CVE and NV...

CVE-2002-0691

CVE-2002-0691 affects Microsoft Internet Explorer 5.01 and 5.5, enabling remote attackers to execute scripts in the Local Computer zone via a URL referencing a local HTML resource file (Cross-Site Scripting in Local HTML Resource, CAN-2002-0189). CERT and CVE records describe vulnerable local res...

CVE-2005-2830

CVE-2005-2830 is an information-disclosure vulnerability in Microsoft Internet Explorer 5.01/5.5/6 when using an HTTPS proxy that requires Basic Authentication, causing URLs to be sent in cleartext. The issue is documented in the HTTPS Proxy Vulnerability (CAN-2005-2830) and is addressed by Micro...

CVE-2005-4843

The CVE-2005-4843 vulnerability affects the SmartConnect Class control. It allows remote attackers to cause an Internet Explorer crash by creating a COM object of the control’s CLSID that is not intended for use within Internet Explorer. The issue is described across multiple sources (Red Hat, CV...