Microsoft Internet Explorer vulnerabilities

CVE-2011-2383 [MEDIUM] CWE-20 CVE-2011-2383: Microsoft Internet Explorer 9 and earlier does not properly restrict cross-zone drag-and-drop action Microsoft Internet Explorer 9 and earlier does not properly restrict cross-zone drag-and-drop actions, which allows user-assisted remote attackers to read cookie files via vectors involving an IFRAME element with a SRC attribute containing an http: URL that redirects to a file: URL, as demonstrated by a Facebook game, related to a "cookiejacking" issue

CVE-2000-0982 [HIGH] CVE-2000-0982: Internet Explorer before 5.5 forwards cached user credentials for a secure web site to insecure page Internet Explorer before 5.5 forwards cached user credentials for a secure web site to insecure pages on the same web site, which could allow remote attackers to obtain the credentials by monitoring connections to the web server, aka the "Cached Web Credentials" vulnerability.

CVE-2002-0242 [HIGH] CVE-2002-0242: Cross-site scripting vulnerability in Internet Explorer 6 earlier allows remote attackers to execute Cross-site scripting vulnerability in Internet Explorer 6 earlier allows remote attackers to execute arbitrary script via an Extended HTML Form, whose output from the remote server is not properly cleansed.

CVE-2015-2421 [MEDIUM] CWE-200 CVE-2015-2421: Microsoft Internet Explorer 6 through 11 allows remote attackers to bypass the ASLR protection mecha Microsoft Internet Explorer 6 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass."

CVE-2014-6368 [MEDIUM] CWE-20 CVE-2014-6368: Microsoft Internet Explorer 11 allows remote attackers to bypass the ASLR protection mechanism via a Microsoft Internet Explorer 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability."

CVE-2002-0832 [HIGH] CVE-2002-0832: Internet Explorer 5, 5.6, and 6 allows remote attackers to bypass cookie privacy settings and store Internet Explorer 5, 5.6, and 6 allows remote attackers to bypass cookie privacy settings and store information across browser sessions via the userData (storeuserData) feature.

CVE-1999-0490 [HIGH] CVE-1999-0490: MSHTML.DLL in Internet Explorer 5.0 allows a remote attacker to learn information about a local user MSHTML.DLL in Internet Explorer 5.0 allows a remote attacker to learn information about a local user's files via an IMG SRC tag.

CVE-2007-3481 [MEDIUM] CWE-119 CVE-2007-3481: Cross-domain vulnerability in Microsoft Internet Explorer 6 and 7 allows remote attackers to bypass Cross-domain vulnerability in Microsoft Internet Explorer 6 and 7 allows remote attackers to bypass the Same Origin Policy and access restricted information from other domains via JavaScript that overwrites the document variable and statically sets the document.domain attribute. NOTE: this issue has been disputed by other researchers, citing a variable

CVE-2000-0160 [HIGH] CVE-2000-0160: The Microsoft Active Setup ActiveX component in Internet Explorer 4.x and 5.x allows a remote attack The Microsoft Active Setup ActiveX component in Internet Explorer 4.x and 5.x allows a remote attacker to install software components without prompting the user by stating that the software's manufacturer is Microsoft.

CVE-2015-1627 [MEDIUM] CWE-264 CVE-2015-1627: Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted we Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."

CVE-2015-0054 [MEDIUM] CWE-264 CVE-2015-0054: Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted we Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."

CVE-2019-1192 [MEDIUM] CWE-863 CVE-2019-1192: A security feature bypass vulnerability exists when Microsoft browsers improperly handle requests of A security feature bypass vulnerability exists when Microsoft browsers improperly handle requests of different origins. The vulnerability allows Microsoft browsers to bypass Same-Origin Policy (SOP) restrictions, and to allow requests that should otherwise be ignored. An attacker who successfully exploited the vulnerability could force the browser to

CVE-2015-0051 [MEDIUM] CWE-264 CVE-2015-0051: Microsoft Internet Explorer 8 allows remote attackers to bypass the ASLR protection mechanism via a Microsoft Internet Explorer 8 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability."

CVE-2015-2414 [MEDIUM] CWE-200 CVE-2015-2414: Microsoft Internet Explorer 8 through 11 allows remote attackers to obtain sensitive browsing-histor Microsoft Internet Explorer 8 through 11 allows remote attackers to obtain sensitive browsing-history information via vectors related to image caching, aka "Internet Explorer Information Disclosure Vulnerability."

CVE-2004-1331 [LOW] CVE-2004-1331: The execCommand method in Microsoft Internet Explorer 6.0 SP2 allows remote attackers to bypass the The execCommand method in Microsoft Internet Explorer 6.0 SP2 allows remote attackers to bypass the "File Download - Security Warning" dialog and save arbitrary files with arbitrary extensions via the SaveAs command.

CVE-2016-7284 [MEDIUM] CWE-200 CVE-2016-7284: Microsoft Internet Explorer 10 and 11 allows remote attackers to obtain sensitive information from p Microsoft Internet Explorer 10 and 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability."

CVE-2002-0722 [HIGH] CVE-2002-0722: Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to misrepresent the source of Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to misrepresent the source of a file in the File Download dialogue box to trick users into thinking that the file type is safe to download, aka "File Origin Spoofing."

CVE-2017-0033 [MEDIUM] CVE-2017-0033: Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to spoof web content via a Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to spoof web content via a crafted web site, aka "Microsoft Browser Spoofing Vulnerability." This vulnerability is different from those described in CVE-2017-0012 and CVE-2017-0069.

CVE-2017-0012 [MEDIUM] CWE-20 CVE-2017-0012: Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to spoof web content via a Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to spoof web content via a crafted web site, aka "Microsoft Browser Spoofing Vulnerability." This vulnerability is different from those described in CVE-2017-0033 and CVE-2017-0069.

CVE-2014-6346 [MEDIUM] CWE-200 CVE-2014-6346: Microsoft Internet Explorer 8 through 11 allows remote attackers to read content from a different (1 Microsoft Internet Explorer 8 through 11 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site, aka "Internet Explorer Cross-domain Information Disclosure Vulnerability."