CVE-2014-1816
published 2014-06-11CVE-2014-1816: Microsoft XML Core Services (aka MSXML) 3.0 and 6.0 does not properly restrict the information transmitted by Internet Explorer during a download action, which…
PriorityP425medium4.3CVSS 2.0
AVNACMAuNCPINAN
EPSS
14.36%
96.2th percentile
Microsoft XML Core Services (aka MSXML) 3.0 and 6.0 does not properly restrict the information transmitted by Internet Explorer during a download action, which allows remote attackers to discover (1) full pathnames on the client system and (2) local usernames embedded in these pathnames via a crafted web site, aka "MSXML Entity URI Vulnerability."
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | xml_core_services | — | — |
| microsoft | xml_core_services | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Talos
Microsoft Update Tuesday June 2014: Internet Explorer, Internet Explorer, Internet Explorer
blogs_talos·2014-06-10·CVSS 5.1
[MEDIUM] Microsoft Update Tuesday June 2014: Internet Explorer, Internet Explorer, Internet Explorer
## Microsoft Update Tuesday June 2014: Internet Explorer, Internet Explorer, Internet Explorer
Once again it’s time for Microsoft’s Update Tuesday and this time it’s almost all about Internet Explorer. We had a bit of a lull in the past months with respect to IE vulnerabilities, especially due to the out-of-band patch that Microsoft released last month, which delayed some of the regularly scheduled fixes. However, this month more than makes up for it: we have a total of seven advisories this month, fixing 66 vulnerabilities, 59 of which are in IE.
There are two advisories that are marked as critical:
The first critical bulletin is MS14-035 and is the IE bulletin that covers 59 total vulnerabilities. Of these 59 vulnerabilities, two are information disclosure issues: CVE-2014-1777 and CV
Talos
Microsoft Update Tuesday June 2014: Internet Explorer, Internet Explorer, Internet Explorer
blogs_talos·2014-06-10·CVSS 5.1
[MEDIUM] Microsoft Update Tuesday June 2014: Internet Explorer, Internet Explorer, Internet Explorer
Once again it’s time for Microsoft’s Update Tuesday and this time it’s almost all about Internet Explorer. We had a bit of a lull in the past months with respect to IE vulnerabilities, especially due to the out-of-band patch that Microsoft released last month, which delayed some of the regularly scheduled fixes. However, this month more than makes up for it: we have a total of seven advisories this month, fixing 66 vulnerabilities, 59 of which are in IE.
There are two advisories that are marked as critical:
The first critical bulletin is MS14-035 and is the IE bulletin that covers 59 total vulnerabilities. Of these 59 vulnerabilities, two are information disclosure issues: CVE-2014-1777 and CVE-2014-1771. The last vulnerability was publicly known and is a TLS renegotiation vulnerability
http://blogs.technet.com/b/srd/archive/2014/06/10/assessing-risk-for-the-june-2014-security-updates.aspxhttp://secunia.com/advisories/58538http://www.securityfocus.com/bid/67895https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-033http://blogs.technet.com/b/srd/archive/2014/06/10/assessing-risk-for-the-june-2014-security-updates.aspxhttp://secunia.com/advisories/58538http://www.securityfocus.com/bid/67895https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-033
2014-06-11
Published