Microsoft Internet Explorer vulnerabilities

CVE-2006-2056 [MEDIUM] CWE-88 CVE-2006-2056: Argument injection vulnerability in Internet Explorer 6 for Windows XP SP2 allows user-assisted remo Argument injection vulnerability in Internet Explorer 6 for Windows XP SP2 allows user-assisted remote attackers to modify command line arguments to an invoked mail client via " (double quote) characters in a mailto: scheme handler, as demonstrated by launching Microsoft Outlook with an arbitrary filename as an attachment. NOTE: it is not clear whether

CVE-2015-1661 [MEDIUM] CWE-264 CVE-2015-1661: Microsoft Internet Explorer 6 through 11 allows remote attackers to bypass the ASLR protection mecha Microsoft Internet Explorer 6 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability."

CVE-2010-5071 [MEDIUM] CWE-264 CVE-2010-5071: The JavaScript implementation in Microsoft Internet Explorer 8.0 and earlier does not properly restr The JavaScript implementation in Microsoft Internet Explorer 8.0 and earlier does not properly restrict the set of values contained in the object returned by the getComputedStyle method, which allows remote attackers to obtain sensitive information about visited web pages by calling this method.

CVE-2009-5159 [MEDIUM] CWE-79 CVE-2009-5159: Invision Power Board (aka IPB or IP.Board) 2.x through 3.0.4, when Internet Explorer 5 is used, allo Invision Power Board (aka IPB or IP.Board) 2.x through 3.0.4, when Internet Explorer 5 is used, allows XSS via a .txt attachment.

CVE-1999-0488 [HIGH] CVE-1999-0488: Internet Explorer 4.0 and 5.0 allows a remote attacker to execute security scripts in a different se Internet Explorer 4.0 and 5.0 allows a remote attacker to execute security scripts in a different security context using malicious URLs, a variant of the "cross frame" vulnerability.

CVE-2007-1091 [MEDIUM] CVE-2007-1091: Microsoft Internet Explorer 7 allows remote attackers to prevent users from leaving a site, spoof th Microsoft Internet Explorer 7 allows remote attackers to prevent users from leaving a site, spoof the address bar, and conduct phishing and other attacks via onUnload Javascript handlers.

CVE-2018-8470 [MEDIUM] CWE-79 CVE-2018-8470: A security feature bypass vulnerability exists in Internet Explorer due to how scripts are handled t A security feature bypass vulnerability exists in Internet Explorer due to how scripts are handled that allows a universal cross-site scripting (UXSS) condition, aka "Internet Explorer Security Feature Bypass Vulnerability." This affects Internet Explorer 11.

CVE-2015-2445 [MEDIUM] CWE-200 CVE-2015-2445: Microsoft Internet Explorer 10 allows remote attackers to bypass the ASLR protection mechanism via a Microsoft Internet Explorer 10 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "ASLR Bypass."

CVE-1999-0802 [HIGH] CWE-119 CVE-1999-0802: Buffer overflow in Internet Explorer 5 allows remote attackers to execute commands via a malformed F Buffer overflow in Internet Explorer 5 allows remote attackers to execute commands via a malformed Favorites icon.

CVE-2015-2402 [MEDIUM] CWE-264 CVE-2015-2402: Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted we Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."

CVE-2012-1873 [MEDIUM] CWE-200 CVE-2012-1873: Microsoft Internet Explorer 7 through 9 does not properly create and initialize string data, which a Microsoft Internet Explorer 7 through 9 does not properly create and initialize string data, which allows remote attackers to obtain sensitive information from process memory via a crafted HTML document, aka "Null Byte Information Disclosure Vulnerability."

CVE-1999-0280 [HIGH] CVE-1999-0280: Remote command execution in Microsoft Internet Explorer using .lnk and .url files. Remote command execution in Microsoft Internet Explorer using .lnk and .url files.

CVE-2000-0662 [MEDIUM] CVE-2000-0662: Internet Explorer 5.x and Microsoft Outlook allows remote attackers to read arbitrary files by redir Internet Explorer 5.x and Microsoft Outlook allows remote attackers to read arbitrary files by redirecting the contents of an IFRAME using the DHTML Edit Control (DHTMLED).

CVE-2012-1872 [MEDIUM] CWE-79 CVE-2012-1872: Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 6 through 9 allows remote at Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 6 through 9 allows remote attackers to inject arbitrary web script or HTML via crafted character sequences with EUC-JP encoding, aka "EUC-JP Character Encoding Vulnerability."

CVE-2013-1297 [MEDIUM] CWE-200 CVE-2013-1297: Microsoft Internet Explorer 6 through 8 does not properly restrict data access by VBScript, which al Microsoft Internet Explorer 6 through 8 does not properly restrict data access by VBScript, which allows remote attackers to perform cross-domain reading of JSON files via a crafted web site, aka "JSON Array Information Disclosure Vulnerability."

CVE-2014-6349 [MEDIUM] CWE-264 CVE-2014-6349: Microsoft Internet Explorer 10 and 11 allows remote attackers to gain privileges via a crafted web s Microsoft Internet Explorer 10 and 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability," a different vulnerability than CVE-2014-6350.

CVE-2015-0055 [MEDIUM] CWE-264 CVE-2015-0055: Microsoft Internet Explorer 10 and 11 allows remote attackers to gain privileges via a crafted web s Microsoft Internet Explorer 10 and 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."

CVE-2015-6157 [MEDIUM] CWE-200 CVE-2015-6157: Microsoft Internet Explorer 11 allows remote attackers to obtain sensitive information from process Microsoft Internet Explorer 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability."

CVE-2013-0015 [MEDIUM] CWE-200 CVE-2013-0015: Microsoft Internet Explorer 6 through 9 does not properly perform auto-selection of the Shift JIS en Microsoft Internet Explorer 6 through 9 does not properly perform auto-selection of the Shift JIS encoding, which allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site that triggers cross-domain scrolling events, aka "Shift JIS Character Encoding Vulnerability."

CVE-2013-3909 [MEDIUM] CWE-200 CVE-2013-3909: Microsoft Internet Explorer 6 through 8 allows remote attackers to read content from a different (1) Microsoft Internet Explorer 6 through 8 allows remote attackers to read content from a different (1) domain or (2) zone via crafted characters in Cascading Style Sheets (CSS) token sequences, aka "Internet Explorer Information Disclosure Vulnerability."