CVE-2009-2576

CVE-2009-2576 refers to a Denial of Service in Microsoft Internet Explorer (IE) where a long Unicode string passed to the write method can consume CPU/memory. The OpenVAS entry OpenVAS:900400 explicitly links CVE-2009-2576 to IE Unicode String DoS and lists a base CVSS v2 score of 5.0 (AV:N/AC:L/...

CVE-2009-2057

Microsoft Internet Explorer prior to version 8 is described as vulnerable to an SSL-tampering style attack where the HTTP Host header is used to determine the document context in a 4xx or 5xx CONNECT response from a proxy. This allows a man-in-the-middle attacker to modify the CONNECT response an...

CVE-2007-3902

CVE-2007-3902 is a use-after-free/ memory corruption vulnerability in Microsoft Internet Explorer 5.01–7, caused by the CRecalcProperty function in mshtml.dll. Attackers could trigger arbitrary code execution by calling the setExpression method and then modifying an element’s outerHTML, leading t...

CVE-2011-2382

CVE-2011-2382 affects Microsoft Internet Explorer 8 and earlier, and IE9 beta, by failing to properly restrict cross-zone drag-and-drop actions. An attacker could entice a user to load a page containing an IFRAME with a file: URL to read cookies, effectively cookie hijacking. Vulnerable component...

CVE-2007-5344

CVE-2007-5344 affects Microsoft Internet Explorer 5.01–7 via mshtml.dll, where the CRecalcProperty/setExpression sequence enables remote arbitrary code execution through heap corruption of uninitialized/removed objects. Public sources in connected docs confirm a memory-corruption chain tied to se...

CVE-2009-2536

CVE-2009-2536: Microsoft Internet Explorer 5–8 remote DoS via a large length value on a Select element, causing memory consumption and application crash. Root cause is tied to the length property handling in a Select object (related CVE-2009-1692). The provided documents identify the issue and it...

CVE-2009-2069

CVE-2009-2069 refers to Microsoft Internet Explorer before 8. IE caches a certificate presented via a proxy’s 4xx/5xx CONNECT response, allowing a man-in-the-middle to spoof an arbitrary HTTPS site by first obtaining a valid certificate from the site and later serving a crafted 502 page. Impact: ...

CVE-2007-5347

CVE-2007-5347 is a DHTML Objects Memory Corruption vulnerability in Microsoft Internet Explorer (IE) affecting IE 5.01 through 7. An attacker could cause remote code execution by visiting a specially crafted page, via unexpected method calls to HTML objects. The issue is addressed by Microsoft Se...

CVE-2011-2383

CVE-2011-2383 affects Microsoft Internet Explorer 9 and earlier. The issue is an incomplete fix that allows cross-zone drag-and-drop via an IFRAME with an http: SRC that redirects to a file: URL, enabling a user-assisted read of cookies (cookiejacking). The vulnerability is documented with the ex...

CVE-2009-2064

The CVE-2009-2064 issue affects Microsoft Internet Explorer 8 (and possibly other versions). It describes a cross-context content loading flaw where an HTTPS page loads HTTP content because the top-level frame is HTTPS, allowing an MITM attacker to modify an HTTP page to include an HTTPS iframe t...

CVE-2009-4073

CVE-2009-4073 affects Microsoft Internet Explorer’s printing functionality when a local HTML page is printed to PDF. The issue exposes local filesystem information by allowing a PDF generated from a local page to include the dc:title element that can reveal the file path, and possibly the usernam...

CVE-2000-0160

The vulnerability CVE-2000-0160 affects the Microsoft Active Setup ActiveX component used by Internet Explorer 4.x–5.x. A remote attacker can install software components without user prompts by spoofing the software manufacturer's identity as Microsoft. Exploitation details or in-the-wild status ...

CVE-2007-3341

CVE-2007-3341 is described as an unspecified memory-address disclosure vulnerability in Internet Explorer’s FTP client (WinInet) that could be triggered through FTP reply parsing. Connected documents provide concrete context: multiple IE/WinInet FTP parsing vulnerabilities have been publicly desc...

CVE-2010-5071

Affected software: Microsoft Internet Explorer 8.0 and earlier. The vulnerability arises in JavaScript’s getComputedStyle, where the returned object’s value set is not properly restricted, enabling remote attackers to disclose sensitive information about visited pages. Consequence: information di...

CVE-2002-2435

Technical details for CVE-2002-2435 are not provided in the connected documents. Monitor for updates.

CVE-2003-1041

CVE-2003-1041 is a showHelp/HTML Help vulnerability in Internet Explorer 5.x/6.0 where a remote attacker could run arbitrary code via a crafted showHelp URL or a malicious HTML Help link. The underlying issue is improper validation/processing of CHM files, enabling remote code execution in the Lo...

CVE-2009-2954

The CVE-2009-2954 issue affects Microsoft Internet Explorer 6.0.2900.2180 and earlier, where long JavaScript strings for location.hash can trigger a denial-of-service (CPU consumption and application hang). The vulnerability is tied to the handling of the window.location.hash property in IE, lead...

CVE-2009-5159

Invision Power Board (IPB) 2.x–3.0.4 is affected by a cross-site scripting (XSS) vulnerability that can be triggered via a .txt attachment when using Internet Explorer 5. The issue is explicitly described as XSS, but the available documents do not provide deeper details on the root cause beyond t...

CVE-2000-0400

The CVE-2000-0400 entry refers to the Microsoft Active Movie ActiveX Control in Internet Explorer 5, where the issue stems from shared code handling the Internet cache and file downloads (not the Active Movie control itself). Affected component is msdxm.ocx (ClassID {05589FA1-C356-11CE-BF01-00AA0...

CVE-2007-4848

CVE-2007-4848 affects Microsoft Internet Explorer 4.0–7. The issue allows remote attackers to determine whether local files have associated images by using a res:// URI in the src property of a JavaScript Image object, demonstrated with bitmap data inside a (1) .exe or (2) .dll file. The connecte...

CVE-2000-0596

Summary: The CVE-2000-0596 issue involves Internet Explorer (IE 5.x/IE 5.01) opening Microsoft Access database/project files via HTML OBJECT tags without warning, enabling remote code execution via embedded VBA/macro. Affected components: IE’s handling of OBJECT tags referencing Access file types...

CVE-2008-4381

The CVE-2008-4381 entry describes a vulnerability in Microsoft Internet Explorer 7 where remote attackers can cause an application crash (DoS) by running Javascript that calls alert with a URL-encoded string containing a large number of invalid characters. The core issue is a DoS condition trigge...

CVE-2008-1368

CVE-2008-1368 describes a CRLF injection vulnerability in Microsoft Internet Explorer 5 and 6. A remote attacker can supply an ftp:// URL containing a URL-encoded CRLF (%0D%0A) before the FTP command, causing the command to be injected into an authenticated FTP session established in the same bro...