Microsoft Internet Explorer vulnerabilities

CVE-2015-1686 [MEDIUM] CWE-200 CVE-2015-1686: The Microsoft (1) VBScript 5.6 through 5.8 and (2) JScript 5.6 through 5.8 engines, as used in Inter The Microsoft (1) VBScript 5.6 through 5.8 and (2) JScript 5.6 through 5.8 engines, as used in Internet Explorer 8 through 11 and other products, allow remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "VBScript and JScript ASLR Bypass."

CVE-2018-1000 [MEDIUM] CVE-2018-1000: An information disclosure vulnerability exists in the way that the scripting engine handles objects An information disclosure vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Information Disclosure Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10. This CVE ID is unique from CVE-2018-0981, CVE-2018-0987, CVE-2018-0989.

CVE-2016-3261 [MEDIUM] CWE-200 CVE-2016-3261: Microsoft Internet Explorer 11 allows remote attackers to obtain sensitive information via a crafted Microsoft Internet Explorer 11 allows remote attackers to obtain sensitive information via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability."

CVE-2019-0761 [MEDIUM] CWE-863 CVE-2019-0761: A security feature bypass vulnerability exists when Internet Explorer fails to validate the correct A security feature bypass vulnerability exists when Internet Explorer fails to validate the correct Security Zone of requests for specific URLs, aka 'Internet Explorer Security Feature Bypass Vulnerability'. This CVE ID is unique from CVE-2019-0768.

CVE-2009-4073 [MEDIUM] CWE-200 CVE-2009-4073: The printing functionality in Microsoft Internet Explorer 8 allows remote attackers to discover a lo The printing functionality in Microsoft Internet Explorer 8 allows remote attackers to discover a local pathname, and possibly a local username, by reading the dc:title element of a PDF document that was generated from a local web page.

CVE-2018-0981 [MEDIUM] CWE-787 CVE-2018-0981: An information disclosure vulnerability exists in the way that the scripting engine handles objects An information disclosure vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Information Disclosure Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10. This CVE ID is unique from CVE-2018-0987, CVE-2018-0989, CVE-2018-1000.

CVE-2015-2483 [MEDIUM] CWE-200 CVE-2015-2483: Microsoft Internet Explorer 10 and 11 allows remote attackers to obtain sensitive information from p Microsoft Internet Explorer 10 and 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Information Disclosure Vulnerability."

CVE-2007-5355 [MEDIUM] CVE-2007-5355: The Web Proxy Auto-Discovery (WPAD) feature in Microsoft Internet Explorer 6 and 7, when a primary D The Web Proxy Auto-Discovery (WPAD) feature in Microsoft Internet Explorer 6 and 7, when a primary DNS suffix with three or more components is configured, resolves an unqualified wpad hostname in a second-level domain outside this configured DNS domain, which allows remote WPAD servers to conduct man-in-the-middle (MITM) attacks.

CVE-2015-6161 [MEDIUM] CWE-200 CVE-2015-6161: Microsoft Internet Explorer 7 through 11 and Microsoft Edge allow remote attackers to bypass the ASL Microsoft Internet Explorer 7 through 11 and Microsoft Edge allow remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Microsoft Browser ASLR Bypass."

CVE-2003-1048 [HIGH] CWE-415 CVE-2003-1048: Double free vulnerability in mshtml.dll for certain versions of Internet Explorer 6.x allows remote Double free vulnerability in mshtml.dll for certain versions of Internet Explorer 6.x allows remote attackers to cause a denial of service (application crash) via a malformed GIF image.

CVE-2014-6328 [MEDIUM] CWE-20 CVE-2014-6328: Microsoft Internet Explorer 8 through 11 allows remote attackers to bypass the XSS filter via a craf Microsoft Internet Explorer 8 through 11 allows remote attackers to bypass the XSS filter via a crafted attribute of an element in an HTML document, aka "Internet Explorer XSS Filter Bypass Vulnerability," a different vulnerability than CVE-2014-6365.

CVE-2016-3273 [MEDIUM] CWE-200 CVE-2016-3273: The XSS Filter in Microsoft Internet Explorer 9 through 11 and Microsoft Edge does not properly rest The XSS Filter in Microsoft Internet Explorer 9 through 11 and Microsoft Edge does not properly restrict JavaScript code, which allows remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability."

CVE-2016-3391 [MEDIUM] CWE-200 CVE-2016-3391: Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow context-dependent attackers to discov Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow context-dependent attackers to discover credentials by leveraging access to a memory dump, aka "Microsoft Browser Information Disclosure Vulnerability."

CVE-2010-1257 [MEDIUM] CWE-79 CVE-2010-1257: Cross-site scripting (XSS) vulnerability in the toStaticHTML API, as used in Microsoft Office InfoPa Cross-site scripting (XSS) vulnerability in the toStaticHTML API, as used in Microsoft Office InfoPath 2003 SP3, 2007 SP1, and 2007 SP2; Office SharePoint Server 2007 SP1 and SP2; SharePoint Services 3.0 SP1 and SP2; and Internet Explorer 8 allows remote attackers to inject arbitrary web script or HTML via vectors related to sanitization.

CVE-2015-1684 [MEDIUM] CWE-200 CVE-2015-1684: VBScript.dll in the Microsoft VBScript 5.6 through 5.8 engine, as used in Internet Explorer 8 throug VBScript.dll in the Microsoft VBScript 5.6 through 5.8 engine, as used in Internet Explorer 8 through 11 and other products, allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "VBScript ASLR Bypass."

CVE-2000-0464 [HIGH] CVE-2000-0464: Internet Explorer 4.x and 5.x allows remote attackers to execute arbitrary commands via a buffer ove Internet Explorer 4.x and 5.x allows remote attackers to execute arbitrary commands via a buffer overflow in the ActiveX parameter parsing capability, aka the "Malformed Component Attribute" vulnerability.

CVE-2002-0027 [HIGH] CVE-2002-0027: Internet Explorer 5.5 and 6.0 allows remote attackers to read certain files and spoof the URL in the Internet Explorer 5.5 and 6.0 allows remote attackers to read certain files and spoof the URL in the address bar by using the Document.open function to pass information between two frames from different domains, a new variant of the "Frame Domain Verification" vulnerability described in MS:MS01-058/CAN-2001-0874.

CVE-2006-5884 [HIGH] CVE-2006-5884: Multiple unspecified vulnerabilities in DirectAnimation ActiveX controls for Microsoft Internet Expl Multiple unspecified vulnerabilities in DirectAnimation ActiveX controls for Microsoft Internet Explorer 5.01 through 6 have unknown impact and remote attack vectors, possibly related to (1) Danim.dll and (2) Lmrt.dll, a different set of vulnerabilities than CVE-2006-4446 and CVE-2006-4777.

CVE-2016-3292 [MEDIUM] CWE-20 CVE-2016-3292: Microsoft Internet Explorer 10 and 11 mishandles integrity settings and zone settings, which allows Microsoft Internet Explorer 10 and 11 mishandles integrity settings and zone settings, which allows remote attackers to bypass a sandbox protection mechanism via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."

CVE-2004-1155 [HIGH] CVE-2004-1155: Internet Explorer 5.01 through 6 allows remote attackers to spoof arbitrary web sites by injecting c Internet Explorer 5.01 through 6 allows remote attackers to spoof arbitrary web sites by injecting content from one window into another window whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the "window injection" vulnerability. NOTE: later research shows that Internet Explorer 7 on Windows