Microsoft Internet Explorer vulnerabilities

CVE-1999-0468 [HIGH] CWE-200 CVE-1999-0468: Internet Explorer 5.0 allows a remote server to read arbitrary files on the client's file system usi Internet Explorer 5.0 allows a remote server to read arbitrary files on the client's file system using the Microsoft Scriptlet Component.

CVE-2011-2382 [MEDIUM] CWE-20 CVE-2011-2382: Microsoft Internet Explorer 8 and earlier, and Internet Explorer 9 beta, does not properly restrict Microsoft Internet Explorer 8 and earlier, and Internet Explorer 9 beta, does not properly restrict cross-zone drag-and-drop actions, which allows user-assisted remote attackers to read cookie files via vectors involving an IFRAME element with a SRC attribute containing a file: URL, as demonstrated by a Facebook game, related to a "cookiejacking" issue.

CVE-2017-11848 [MEDIUM] CWE-200 CVE-2017-11848: Internet Explorer in Microsoft Microsoft Windows 7 SP1, Windows Server 2008 SP2, Windows 8.1 and Win Internet Explorer in Microsoft Microsoft Windows 7 SP1, Windows Server 2008 SP2, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to detect the navigation of the user leaving a maliciously crafted page, due to how page content

CVE-1999-1472 [MEDIUM] CVE-1999-1472: Internet Explorer 4.0 allows remote attackers to read arbitrary text and HTML files on the user's ma Internet Explorer 4.0 allows remote attackers to read arbitrary text and HTML files on the user's machine via a small IFRAME that uses Dynamic HTML (DHTML) to send the data to the attacker, aka the Freiburg text-viewing issue.

CVE-2020-1315 [MEDIUM] CVE-2020-1315: An information disclosure vulnerability exists when Internet Explorer improperly handles objects in An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory, aka 'Internet Explorer Information Disclosure Vulnerability'.

CVE-2011-1960 [MEDIUM] CWE-668 CVE-2011-1960: Microsoft Internet Explorer 6 through 9 does not properly implement JavaScript event handlers, which Microsoft Internet Explorer 6 through 9 does not properly implement JavaScript event handlers, which allows remote attackers to access content from a different (1) domain or (2) zone via unspecified script code, aka "Event Handlers Information Disclosure Vulnerability."

CVE-2010-1258 [MEDIUM] CWE-200 CVE-2010-1258: Microsoft Internet Explorer 6, 7, and 8 does not properly determine the origin of script code, which Microsoft Internet Explorer 6, 7, and 8 does not properly determine the origin of script code, which allows remote attackers to execute script in an unintended domain or security zone, and obtain sensitive information, via unspecified vectors, aka "Event Handler Cross-Domain Vulnerability."

CVE-2017-0154 [MEDIUM] CWE-74 CVE-2017-0154: Microsoft Internet Explorer 11 on Windows 10, 1511, and 1606 and Windows Server 2016 does not enforc Microsoft Internet Explorer 11 on Windows 10, 1511, and 1606 and Windows Server 2016 does not enforce cross-domain policies, allowing attackers to access information from one domain and inject it into another via a crafted application, aka, "Internet Explorer Elevation of Privilege Vulnerability."

CVE-2004-1376 [MEDIUM] CVE-2004-1376: Directory traversal vulnerability in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote ma Directory traversal vulnerability in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote malicious FTP servers to overwrite arbitrary files via .. (dot dot) sequences in filenames returned from a LIST command.

CVE-2016-0077 [MEDIUM] CWE-19 CVE-2016-0077: Microsoft Internet Explorer 9 through 11 and Microsoft Edge misparse HTTP responses, which allows re Microsoft Internet Explorer 9 through 11 and Microsoft Edge misparse HTTP responses, which allows remote attackers to spoof web sites via a crafted URL, aka "Microsoft Browser Spoofing Vulnerability."

CVE-2010-3243 [MEDIUM] CWE-79 CVE-2010-3243: Cross-site scripting (XSS) vulnerability in the toStaticHTML function in Microsoft Internet Explorer Cross-site scripting (XSS) vulnerability in the toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in Microsoft Windows SharePoint Services 3.0 SP2 and Office SharePoint Server 2007 SP2, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "HTML Sanitization Vulnerability."

CVE-2017-8736 [MEDIUM] CWE-200 CVE-2017-8736: Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, and Microsoft Edge and Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allow an attacker to obtain specific information used in the parent domain, due to Microsoft browser parent domain verif

CVE-2010-1127 [MEDIUM] CVE-2010-1127: Microsoft Internet Explorer 6 and 7 does not initialize certain data structures during execution of Microsoft Internet Explorer 6 and 7 does not initialize certain data structures during execution of the createElement method, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted JavaScript code, as demonstrated by setting the (1) outerHTML or (2) value property of an object returned by createE

CVE-2001-0724 [HIGH] CVE-2001-0724: Internet Explorer 5.5 allows remote attackers to bypass security restrictions via malformed URLs tha Internet Explorer 5.5 allows remote attackers to bypass security restrictions via malformed URLs that contain dotless IP addresses, which causes Internet Explorer to process the page in the Intranet Zone, which may have fewer security restrictions, aka the "Zone Spoofing Vulnerability variant" of CVE-2001-0664.

CVE-2013-1450 [MEDIUM] CWE-16 CVE-2013-1450: Microsoft Internet Explorer 8 and 9, when the Proxy Settings configuration has the same Proxy addres Microsoft Internet Explorer 8 and 9, when the Proxy Settings configuration has the same Proxy address and Port values in the HTTP and Secure rows, does not properly reuse TCP sessions to the proxy server, which allows remote attackers to obtain sensitive information intended for a specific host via a crafted HTML document that triggers many HTTPS reque

CVE-2001-0712 [HIGH] CVE-2001-0712: The rendering engine in Internet Explorer determines the MIME type independently of the type that is The rendering engine in Internet Explorer determines the MIME type independently of the type that is specified by the server, which allows remote servers to automatically execute script which is placed in a file whose MIME type does not normally support scripting, such as text (.txt), JPEG (.jpg), etc.

CVE-2007-3164 [MEDIUM] CVE-2007-3164: Microsoft Internet Explorer 7, when prompting for HTTP Basic Authentication for an IDN web site, use Microsoft Internet Explorer 7, when prompting for HTTP Basic Authentication for an IDN web site, uses ACE labels for the domain name in the status bar, but uses internationalized labels for this name in the authentication dialog, which might allow remote attackers to perform phishing attacks if the user misinterprets confusable characters in the international

CVE-2002-0077 [HIGH] CVE-2002-0077: Microsoft Internet Explorer 5.01, 5.5 and 6.0 treats objects invoked on an HTML page with the codeba Microsoft Internet Explorer 5.01, 5.5 and 6.0 treats objects invoked on an HTML page with the codebase property as part of Local Computer zone, which allows remote attackers to invoke executables present on the local system through objects such as the popup object, aka the "Local Executable Invocation via Object tag" vulnerability.

CVE-2011-1992 [MEDIUM] CWE-79 CVE-2011-1992: The XSS Filter in Microsoft Internet Explorer 8 allows remote attackers to read content from a diffe The XSS Filter in Microsoft Internet Explorer 8 allows remote attackers to read content from a different (1) domain or (2) zone via a "trial and error" attack, aka "XSS Filter Information Disclosure Vulnerability."

CVE-2009-2057 [MEDIUM] CWE-287 CVE-2009-2057: Microsoft Internet Explorer before 8 uses the HTTP Host header to determine the context of a documen Microsoft Internet Explorer before 8 uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack.