Microsoft Internet Explorer vulnerabilities

CVE-2005-0054 [MEDIUM] CVE-2005-0054: Internet Explorer 5.01, 5.5, and 6 allows remote attackers to spoof a less restrictive security zone Internet Explorer 5.01, 5.5, and 6 allows remote attackers to spoof a less restrictive security zone and execute arbitrary code via an HTML page containing URLs that contain hostnames that have been double hex encoded, which are decoded twice to generate a malicious hostname, aka the "URL Decoding Zone Spoofing Vulnerability."

CVE-2004-1173 [HIGH] CVE-2004-1173: Internet Explorer 6 allows remote attackers to bypass the popup blocker via the document object mode Internet Explorer 6 allows remote attackers to bypass the popup blocker via the document object model (DOM) methods in the DHTML Dynamic HTML (DHTML) Editing Component (DEC) and Javascript that calls showModalDialog.

CVE-2004-0843 [MEDIUM] CVE-2004-0843: Internet Explorer 5.5 and 6 does not properly handle plug-in navigation, which allows remote attacke Internet Explorer 5.5 and 6 does not properly handle plug-in navigation, which allows remote attackers to alter displayed address bars and thereby spoof web pages, facilitating phishing attacks, aka the "Plug-in Navigation Address Bar Spoofing Vulnerability."

CVE-2019-0920 [MEDIUM] CWE-787 CVE-2019-0920: A remote code execution vulnerability exists in the way the scripting engine handles objects in memo A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as

CVE-2005-4089 [HIGH] CWE-264 CVE-2005-4089: Microsoft Internet Explorer allows remote attackers to bypass cross-domain security restrictions and Microsoft Internet Explorer allows remote attackers to bypass cross-domain security restrictions and obtain sensitive information by using the @import directive to download files from other domains that are not valid Cascading Style Sheets (CSS) files, as demonstrated using Google Desktop, aka "CSSXSS" and "CSS Cross-Domain Information Disclosure Vulner

CVE-2012-0012 [MEDIUM] CWE-665 CVE-2012-0012: Microsoft Internet Explorer 9 does not properly handle the creation and initialization of string obj Microsoft Internet Explorer 9 does not properly handle the creation and initialization of string objects, which allows remote attackers to read data from arbitrary process-memory locations via a crafted web site, aka "Null Byte Information Disclosure Vulnerability."

CVE-2015-2449 [MEDIUM] CWE-200 CVE-2015-2449: Microsoft Internet Explorer 7 through 11 and Edge allow remote attackers to bypass the ASLR protecti Microsoft Internet Explorer 7 through 11 and Edge allow remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "ASLR Bypass."

CVE-2015-6052 [MEDIUM] CWE-200 CVE-2015-6052: The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Expl The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, allow remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "VBScript and JScript ASLR Bypass."

CVE-2019-0921 [MEDIUM] CVE-2019-0921: An spoofing vulnerability exists when Internet Explorer improperly handles URLs, aka 'Internet Explo An spoofing vulnerability exists when Internet Explorer improperly handles URLs, aka 'Internet Explorer Spoofing Vulnerability'.

CVE-2003-1028 [MEDIUM] CVE-2003-1028: The download function of Internet Explorer 6 SP1 allows remote attackers to obtain the cache directo The download function of Internet Explorer 6 SP1 allows remote attackers to obtain the cache directory name via an HTTP response with an invalid ContentType and a .htm file, which could allow remote attackers to bypass security mechanisms that rely on random names, as demonstrated by threadid10008.

CVE-2014-6339 [MEDIUM] CWE-264 CVE-2014-6339: Microsoft Internet Explorer 8 and 9 allows remote attackers to bypass the ASLR protection mechanism Microsoft Internet Explorer 8 and 9 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability."

CVE-2003-0115 [HIGH] CVE-2003-0115: Microsoft Internet Explorer 5.01, 5.5 and 6.0 does not properly check parameters that are passed dur Microsoft Internet Explorer 5.01, 5.5 and 6.0 does not properly check parameters that are passed during third party rendering, which could allow remote attackers to execute arbitrary web script, aka the "Third Party Plugin Rendering" vulnerability, a different vulnerability than CVE-2003-0233.

CVE-2011-1244 [MEDIUM] CWE-1021 CVE-2011-1244: Microsoft Internet Explorer 6, 7, and 8 does not enforce intended domain restrictions on content acc Microsoft Internet Explorer 6, 7, and 8 does not enforce intended domain restrictions on content access, which allows remote attackers to obtain sensitive information or conduct clickjacking attacks via a crafted web site, aka "Frame Tag Information Disclosure Vulnerability."

CVE-2007-2292 [MEDIUM] CWE-20 CVE-2007-2292: CRLF injection vulnerability in the Digest Authentication support for Mozilla Firefox before 2.0.0.8 CRLF injection vulnerability in the Digest Authentication support for Mozilla Firefox before 2.0.0.8 and SeaMonkey before 1.1.5 allows remote attackers to conduct HTTP request splitting attacks via LF (%0a) bytes in the username attribute.

CVE-2007-4356 [CRITICAL] CVE-2007-4356: Microsoft Internet Explorer 6 and 7 embeds FTP credentials in HTML files that are retrieved during a Microsoft Internet Explorer 6 and 7 embeds FTP credentials in HTML files that are retrieved during an FTP session, which allows context-dependent attackers to obtain sensitive information by reading the HTML source, as demonstrated by a (1) .htm, (2) .html, or (3) .mht file.

CVE-2002-0052 [MEDIUM] CVE-2002-0052: Internet Explorer 6.0 and earlier does not properly handle VBScript in certain domain security check Internet Explorer 6.0 and earlier does not properly handle VBScript in certain domain security checks, which allows remote attackers to read arbitrary files.

CVE-2014-0293 [MEDIUM] CWE-200 CVE-2014-0293: Microsoft Internet Explorer 9 through 11 allows remote attackers to read content from a different (1 Microsoft Internet Explorer 9 through 11 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site, aka "Internet Explorer Cross-domain Information Disclosure Vulnerability."

CVE-2016-0059 [MEDIUM] CWE-200 CVE-2016-0059: The Hyperlink Object Library in Microsoft Internet Explorer 9 through 11 allows remote attackers to The Hyperlink Object Library in Microsoft Internet Explorer 9 through 11 allows remote attackers to obtain sensitive information from process memory via a crafted URL in a (1) e-mail message or (2) Office document, aka "Internet Explorer Information Disclosure Vulnerability."

CVE-2002-1185 [MEDIUM] CVE-2002-1185: Internet Explorer 5.01 through 6.0 does not properly check certain parameters of a PNG file when ope Internet Explorer 5.01 through 6.0 does not properly check certain parameters of a PNG file when opening it, which allows remote attackers to cause a denial of service (crash) by triggering a heap-based buffer overflow using invalid length codes during decompression, aka "Malformed PNG Image File Failure."

CVE-2015-1685 [MEDIUM] CWE-264 CVE-2015-1685: Microsoft Internet Explorer 11 allows remote attackers to bypass the ASLR protection mechanism via a Microsoft Internet Explorer 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass."