CVE-1999-1446
published 1997-08-05CVE-1999-1446: Internet Explorer 3 records a history of all URL's that are visited by a user in DAT files located in the Temporary Internet Files and History folders, which…
PriorityP46low2.1CVSS 2.0
AVLACLAuNCPINAN
EPSS
2.03%
78.8th percentile
Internet Explorer 3 records a history of all URL's that are visited by a user in DAT files located in the Temporary Internet Files and History folders, which are not cleared when the user selects the "Clear History" option, and are not visible when the user browses the folders because of tailored displays.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | internet_explorer | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Microsoft Internet Explorer 3.0 Clear History information disclosure
vuldb·2026-04-17·CVSS 2.1
CVE-1999-1446 [LOW] Microsoft Internet Explorer 3.0 Clear History information disclosure
A vulnerability was found in Microsoft Internet Explorer 3.0 and classified as problematic. This vulnerability affects unknown code of the component Clear History Handler. The manipulation results in information disclosure.
This vulnerability is reported as CVE-1999-1446. The attack requires a local approach. No exploit exists.
It is suggested to upgrade the affected component.
GHSA
GHSA-xvpw-j9f9-fw7v: Internet Explorer 3 records a history of all URL's that are visited by a user in DAT files located in the Temporary Internet Files and History folders
ghsa_unreviewed·2022-04-30
CVE-1999-1446 [LOW] GHSA-xvpw-j9f9-fw7v: Internet Explorer 3 records a history of all URL's that are visited by a user in DAT files located in the Temporary Internet Files and History folders
Internet Explorer 3 records a history of all URL's that are visited by a user in DAT files located in the Temporary Internet Files and History folders, which are not cleared when the user selects the "Clear History" option, and are not visible when the user browses the folders because of tailored displays.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
CWE
UI Discrepancy for Security Feature
mitre_cwe·CVSS 2.1
[LOW] CWE-446 UI Discrepancy for Security Feature
CWE-446: UI Discrepancy for Security Feature
The user interface does not correctly enable or configure a security feature, but the interface provides feedback that causes the user to believe that the feature is in a secure state.
When the user interface does not properly reflect what the user asks of it, then it can lead the user into a false sense of security. For example, the user might check a box to enable a security option to enable encrypted communications, but the product does not actually enable the encryption. Alternately, the user might provide a "restrict ALL" access control rule, but the product only implements "restrict SOME".
Modes of Introduction:
Phase: Architecture and Design
Phase: Implementation
Common Consequences:
Scope: Other. Impact: Varies by Context.
Observed
CWE
Incorrect Provision of Specified Functionality
mitre_cwe·CVSS 2.1
[LOW] CWE-684 Incorrect Provision of Specified Functionality
CWE-684: Incorrect Provision of Specified Functionality
The code does not function according to its published specifications, potentially leading to incorrect usage.
When providing functionality to an external party, it is important that the product behaves in accordance with the details specified. When requirements of nuances are not documented, the functionality may produce unintended behaviors for the caller, possibly leading to an exploitable state.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Other. Impact: Quality Degradation.
Potential Mitigations:
[Implementation] Ensure that your code strictly conforms to specifications.
Examples:
In the following snippet from a doPost() servlet method, the server returns "200 OK" (default) even if an error occurs
1997-08-05
Published