Microsoft Internet Explorer vulnerabilities

CVE-2013-5046 [MEDIUM] CWE-20 CVE-2013-5046: Microsoft Internet Explorer 7 through 11 allows local users to bypass the Protected Mode protection Microsoft Internet Explorer 7 through 11 allows local users to bypass the Protected Mode protection mechanism, and consequently gain privileges, by leveraging the ability to execute sandboxed code, aka "Internet Explorer Elevation of Privilege Vulnerability."

CVE-2018-0987 [MEDIUM] CVE-2018-0987: An information disclosure vulnerability exists when the scripting engine does not properly handle ob An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Internet Explorer, aka "Scripting Engine Information Disclosure Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10. This CVE ID is unique from CVE-2018-0981, CVE-2018-0989, CVE-2018-1000.

CVE-2018-0847 [MEDIUM] CWE-787 CVE-2018-0847: Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allow information disclosure, due to how Internet Explorer handles objects in memory, aka "Internet Explorer Information Disclosure Vulnerability".

CVE-2018-0932 [MEDIUM] CWE-200 CVE-2018-0932: Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Microsoft Edge and Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows information disclosure, due to how Microsoft browsers handle objects in me

CVE-2017-8733 [MEDIUM] CVE-2017-8733: Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Wi Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to trick a user into believing that the user was visiting a legitimate website, due to the way that Internet Explorer handles specific HTML c

CVE-2001-0339 [HIGH] CVE-2001-0339: Internet Explorer 5.5 and earlier allows remote attackers to display a URL in the address bar that i Internet Explorer 5.5 and earlier allows remote attackers to display a URL in the address bar that is different than the URL that is actually being displayed, which could be used in web site spoofing attacks, aka the "Web page spoofing vulnerability."

CVE-2010-0494 [MEDIUM] CWE-200 CVE-2010-0494: Cross-domain vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 allows user-assisted re Cross-domain vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 allows user-assisted remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted HTML document in a situation where the client user drags one browser window across another browser window, aka "HTML Element Cross-Domain Vulner

CVE-2009-2576 [MEDIUM] CVE-2009-2576: Microsoft Internet Explorer 6.0.2900.2180 and earlier allows remote attackers to cause a denial of s Microsoft Internet Explorer 6.0.2900.2180 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via a long Unicode string argument to the write method, a related issue to CVE-2009-2479. NOTE: it was later reported that 7.0.6000.16473 and earlier are also affected.

CVE-2002-1186 [MEDIUM] CVE-2002-1186: Internet Explorer 5.01 through 6.0 does not properly perform security checks on certain encoded char Internet Explorer 5.01 through 6.0 does not properly perform security checks on certain encoded characters within a URL, which allows a remote attacker to steal potentially sensitive information from a user by redirecting the user to another site that has that information, aka "Encoded Characters Information Disclosure."

CVE-1999-1093 [MEDIUM] CVE-1999-1093: Buffer overflow in the Window.External function in the JScript Scripting Engine in Internet Explorer Buffer overflow in the Window.External function in the JScript Scripting Engine in Internet Explorer 4.01 SP1 and earlier allows remote attackers to execute arbitrary commands via a malicious web page.

CVE-2015-6046 [MEDIUM] CWE-200 CVE-2015-6046: Microsoft Internet Explorer 9 through 11 allows remote attackers to obtain sensitive information fro Microsoft Internet Explorer 9 through 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability."

CVE-1999-0537 [HIGH] CVE-1999-0537: A configuration in a web browser such as Internet Explorer or Netscape Navigator allows execution of A configuration in a web browser such as Internet Explorer or Netscape Navigator allows execution of active content such as ActiveX, Java, Javascript, etc.

CVE-1999-0876 [CRITICAL] CWE-119 CVE-1999-0876: Buffer overflow in Internet Explorer 4.0 via EMBED tag. Buffer overflow in Internet Explorer 4.0 via EMBED tag.

CVE-2005-3240 [MEDIUM] CWE-362 CVE-2005-3240: Race condition in Microsoft Internet Explorer allows user-assisted attackers to overwrite arbitrary Race condition in Microsoft Internet Explorer allows user-assisted attackers to overwrite arbitrary files and possibly execute code by tricking a user into performing a drag-and-drop action from certain objects, such as file objects within a folder view, then predicting the drag action, and re-focusing to a malicious window.

CVE-2015-6144 [MEDIUM] CWE-79 CVE-2015-6144: Microsoft Internet Explorer 8 through 11 and Microsoft Edge mishandle HTML attributes in HTTP respon Microsoft Internet Explorer 8 through 11 and Microsoft Edge mishandle HTML attributes in HTTP responses, which allows remote attackers to bypass a cross-site scripting (XSS) protection mechanism via unspecified vectors, aka "Microsoft Browser XSS Filter Bypass Vulnerability."

CVE-2002-0269 [HIGH] CVE-2002-0269: Internet Explorer 5.x and 6 interprets an object as an HTML document even when its MIME Content-Type Internet Explorer 5.x and 6 interprets an object as an HTML document even when its MIME Content-Type is text/plain, which could allow remote attackers to execute arbitrary script in documents that the user does not expect, possibly through web applications that use a text/plain type to prevent cross-site scripting attacks.

CVE-2011-1962 [MEDIUM] CWE-20 CVE-2011-1962: Microsoft Internet Explorer 6 through 9 does not properly handle unspecified character sequences, wh Microsoft Internet Explorer 6 through 9 does not properly handle unspecified character sequences, which allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site that triggers "inactive filtering," aka "Shift JIS Character Encoding Vulnerability."

CVE-2015-6138 [MEDIUM] CWE-79 CVE-2015-6138: Microsoft Internet Explorer 8 through 11 mishandles HTML attributes in HTTP responses, which allows Microsoft Internet Explorer 8 through 11 mishandles HTML attributes in HTTP responses, which allows remote attackers to bypass a cross-site scripting (XSS) protection mechanism via unspecified vectors, aka "Internet Explorer XSS Filter Bypass Vulnerability."

CVE-2009-2069 [MEDIUM] CWE-287 CVE-2009-2069: Microsoft Internet Explorer before 8 displays a cached certificate for a (1) 4xx or (2) 5xx CONNECT Microsoft Internet Explorer before 8 displays a cached certificate for a (1) 4xx or (2) 5xx CONNECT response page returned by a proxy server, which allows man-in-the-middle attackers to spoof an arbitrary https site by letting a browser obtain a valid certificate from this site during one request, and then sending the browser a crafted 502 response pag

CVE-2008-1545 [MEDIUM] CWE-20 CVE-2008-1545: The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 7 does not r The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 7 does not restrict the dangerous Transfer-Encoding HTTP request header, which allows remote attackers to conduct HTTP request splitting and HTTP request smuggling attacks via a POST containing a "Transfer-Encoding: chunked" header and a request body with an incorre