Microsoft Internet Explorer vulnerabilities

CVE-2009-0369 [MEDIUM] CVE-2009-0369: Microsoft Internet Explorer 7 allows remote attackers to trick a user into visiting an arbitrary URL Microsoft Internet Explorer 7 allows remote attackers to trick a user into visiting an arbitrary URL via an onclick action that moves a crafted element to the current mouse position, related to a "Clickjacking" vulnerability.

CVE-2002-2031 [MEDIUM] CVE-2002-2031: Internet Explorer 5.0, 5.0.1 and 5.5 with JavaScript execution enabled allows remote attackers to de Internet Explorer 5.0, 5.0.1 and 5.5 with JavaScript execution enabled allows remote attackers to determine the existence of arbitrary files via a script tag with a src parameter that references a non-JavaScript file, then using the onError event handler to monitor the results.

CVE-2003-0447 [MEDIUM] CVE-2003-0447: The Custom HTTP Errors capability in Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to The Custom HTTP Errors capability in Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to execute script in the Local Zone via an argument to shdocvw.dll that causes a "javascript:" link to be generated.

CVE-2002-1187 [MEDIUM] CVE-2002-1187: Cross-site scripting vulnerability (XSS) in Internet Explorer 5.01 through 6.0 allows remote attacke Cross-site scripting vulnerability (XSS) in Internet Explorer 5.01 through 6.0 allows remote attackers to read and execute files on the local system via web pages using the or element and javascript, aka "Frames Cross Site Scripting," as demonstrated using the PrivacyPolicy.dlg resource.

CVE-1999-0487 [LOW] CVE-1999-0487: The DHTML Edit ActiveX control in Internet Explorer allows remote attackers to read arbitrary files. The DHTML Edit ActiveX control in Internet Explorer allows remote attackers to read arbitrary files.

CVE-2007-5158 [MEDIUM] CVE-2007-5158: The focus handling for the onkeydown event in Microsoft Internet Explorer 6.0 allows remote attacker The focus handling for the onkeydown event in Microsoft Internet Explorer 6.0 allows remote attackers to change field focus and copy keystrokes via a certain use of a JavaScript htmlFor attribute, as demonstrated by changing focus from a textarea to a file upload field, a related issue to CVE-2007-3511.

CVE-2003-1025 [MEDIUM] CWE-20 CVE-2003-1025: Internet Explorer 5.01 through 6 SP1 allows remote attackers to spoof the domain of a URL via a "%01 Internet Explorer 5.01 through 6 SP1 allows remote attackers to spoof the domain of a URL via a "%01" character before an @ sign in the user@domain portion of the URL, which hides the rest of the URL, including the real site, in the address bar, aka the "Improper URL Canonicalization Vulnerability."

CVE-2017-8651 [HIGH] CWE-119 CVE-2017-8651: Internet Explorer in Microsoft Windows Server 2008 SP2 and Windows Server 2012 allows an attacker to Internet Explorer in Microsoft Windows Server 2008 SP2 and Windows Server 2012 allows an attacker to execute arbitrary code in the context of the current user due to Internet Explorer improperly accessing objects in memory, aka "Internet Explorer Memory Corruption Vulnerability".

CVE-2007-3903 [MEDIUM] CVE-2007-3903: Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code via uninitiali Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code via uninitialized or deleted objects used in repeated calls to the (1) cloneNode or (2) nodeValue JavaScript function, a different issue than CVE-2007-3902 and CVE-2007-5344, a variant of "Uninitialized Memory Corruption Vulnerability."

CVE-2015-2484 [MEDIUM] CWE-264 CVE-2015-2484: Microsoft Internet Explorer 10 and 11 uses an incorrect flag during certain filesystem accesses, whi Microsoft Internet Explorer 10 and 11 uses an incorrect flag during certain filesystem accesses, which allows remote attackers to delete arbitrary files via unspecified vectors, aka "Tampering Vulnerability."

CVE-2006-1191 [MEDIUM] CVE-2006-1191: Microsoft Internet Explorer 5.01 through 6 does not always correctly identify the domain that is ass Microsoft Internet Explorer 5.01 through 6 does not always correctly identify the domain that is associated with a browser window, which allows remote attackers to obtain sensitive cross-domain information and spoof sites by running script after the user has navigated to another site.

CVE-2009-2764 [MEDIUM] CVE-2009-2764: Microsoft Internet Explorer 8.0.7100.0 on Windows 7 RC on the x64 platform allows remote attackers t Microsoft Internet Explorer 8.0.7100.0 on Windows 7 RC on the x64 platform allows remote attackers to cause a denial of service (application crash) via a certain DIV element in conjunction with SCRIPT elements that have empty contents and no reference to a valid external script location.

CVE-2005-4717 [MEDIUM] CVE-2005-4717: Microsoft Internet Explorer 6.0 on Windows NT 4.0 SP6a, Windows 2000 SP4, Windows XP SP1, Windows XP Microsoft Internet Explorer 6.0 on Windows NT 4.0 SP6a, Windows 2000 SP4, Windows XP SP1, Windows XP SP2, and Windows Server 2003 SP1 allows remote attackers to cause a denial of service (client crash) via a certain combination of a malformed HTML file and a CSS file that triggers a null dereference, probably related to rendering of a DIV element that contain

CVE-1999-1241 [CRITICAL] CVE-1999-1241: Internet Explorer, with a security setting below Medium, allows remote attackers to execute arbitrar Internet Explorer, with a security setting below Medium, allows remote attackers to execute arbitrary commands via a malicious web page that uses the FileSystemObject ActiveX object.

CVE-2007-5344 [MEDIUM] CVE-2007-5344: Microsoft Internet Explorer 5.01 through 7 allows remote attackers to execute arbitrary code via a c Microsoft Internet Explorer 5.01 through 7 allows remote attackers to execute arbitrary code via a crafted website using Javascript that creates, modifies, deletes, and accesses document objects using the tags property, which triggers heap corruption, related to uninitialized or deleted objects, a different issue than CVE-2007-3902 and CVE-2007-3903, and a va

CVE-2009-2655 [MEDIUM] CWE-20 CVE-2009-2655: mshtml.dll in Microsoft Internet Explorer 7 and 8 on Windows XP SP3 allows remote attackers to cause mshtml.dll in Microsoft Internet Explorer 7 and 8 on Windows XP SP3 allows remote attackers to cause a denial of service (application crash) by calling the JavaScript findText method with a crafted Unicode string in the first argument, and only one additional argument, as demonstrated by a second argument of -1.

CVE-2015-1748 [MEDIUM] CVE-2015-1748: Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted we Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-1743.

CVE-2008-1544 [HIGH] CWE-20 CVE-2008-1544: The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 5.01, 6, and The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 5.01, 6, and 7 does not block dangerous HTTP request headers when certain 8-bit character sequences are appended to a header name, which allows remote attackers to (1) conduct HTTP request splitting and HTTP request smuggling attacks via an incorrect Content-Length he

CVE-2006-3591 [MEDIUM] CVE-2006-3591: Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (application cras Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (application crash) by accessing the URL property of a TriEditDocument.TriEditDocument object before it has been initialized, which triggers a NULL pointer dereference.

CVE-2004-2383 [MEDIUM] CVE-2004-2383: Microsoft Internet Explorer 5.0 through 6.0 allows remote attackers to bypass cross-frame scripting Microsoft Internet Explorer 5.0 through 6.0 allows remote attackers to bypass cross-frame scripting restrictions and capture keyboard events from other domains via an HTML document with Javascript that is outside a frameset that includes the target domain, then forcing the frameset to maintain focus. NOTE: the discloser claimed that the vendor does not categor