Microsoft Internet Explorer vulnerabilities

CVE-2009-3267 [MEDIUM] CVE-2009-3267: Microsoft Internet Explorer 6 through 6.0.2900.2180, and 7.0.6000.16711, allows remote attackers to Microsoft Internet Explorer 6 through 6.0.2900.2180, and 7.0.6000.16711, allows remote attackers to cause a denial of service (CPU consumption) via an automatically submitted form containing a KEYGEN element, a related issue to CVE-2009-1828.

CVE-2001-0874 [MEDIUM] CVE-2001-0874: Internet Explorer 5.5 and 6.0 allow remote attackers to read certain files via HTML that passes info Internet Explorer 5.5 and 6.0 allow remote attackers to read certain files via HTML that passes information from a frame in the client's domain to a frame in the web site's domain, a variant of the "Frame Domain Verification" vulnerability.

CVE-2003-1559 [MEDIUM] CWE-200 CVE-2003-1559: Microsoft Internet Explorer 5.22, and other 5 through 6 SP1 versions, sends Referer headers containi Microsoft Internet Explorer 5.22, and other 5 through 6 SP1 versions, sends Referer headers containing https:// URLs in requests for http:// URLs, which allows remote attackers to obtain potentially sensitive information by reading Referer log data.

CVE-2002-1188 [MEDIUM] CVE-2002-1188: Internet Explorer 5.01 through 6.0 allows remote attackers to identify the path to the Temporary Int Internet Explorer 5.01 through 6.0 allows remote attackers to identify the path to the Temporary Internet Files folder and obtain user information such as cookies via certain uses of the OBJECT tag, which are not subjected to the proper security checks, aka "Temporary Internet Files folders Name Reading."

CVE-2011-1713 [MEDIUM] CVE-2011-1713: Microsoft msxml.dll, as used in Internet Explorer 8 on Windows 7, allows remote attackers to obtain Microsoft msxml.dll, as used in Internet Explorer 8 on Windows 7, allows remote attackers to obtain potentially sensitive information about heap memory addresses via an XML document containing a call to the XSLT generate-id XPath function. NOTE: this might overlap CVE-2011-1202.

CVE-2006-5152 [MEDIUM] CVE-2006-5152: Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer allows remote attackers to i Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded URL that is returned in a large HTTP 404 error message without an explicit charset, a related issue to CVE-2006-0032.

CVE-2020-0706 [MEDIUM] CVE-2020-0706: An information disclosure vulnerability exists in the way that affected Microsoft browsers handle cr An information disclosure vulnerability exists in the way that affected Microsoft browsers handle cross-origin requests, aka 'Microsoft Browser Information Disclosure Vulnerability'.

CVE-2020-1432 [MEDIUM] CVE-2020-1432: An information disclosure vulnerability exists when Skype for Business is accessed via Internet Expl An information disclosure vulnerability exists when Skype for Business is accessed via Internet Explorer, aka 'Skype for Business via Internet Explorer Information Disclosure Vulnerability'.

CVE-2009-2954 [MEDIUM] CVE-2009-2954: Microsoft Internet Explorer 6.0.2900.2180 and earlier allows remote attackers to cause a denial of s Microsoft Internet Explorer 6.0.2900.2180 and earlier allows remote attackers to cause a denial of service (CPU consumption and application hang) via JavaScript code with a long string value for the hash property (aka location.hash), a related issue to CVE-2008-5715.

CVE-2002-2311 [MEDIUM] CWE-264 CVE-2002-2311: Microsoft Internet Explorer 6.0 and possibly others allows remote attackers to upload arbitrary file Microsoft Internet Explorer 6.0 and possibly others allows remote attackers to upload arbitrary file contents when users press a key corresponding to the JavaScript (1) event.ctrlKey or (2) event.shiftKey onkeydown event contained in a webpage. NOTE: it was reported that the vendor has disputed the severity of this issue.

CVE-2010-1489 [MEDIUM] CVE-2010-1489: The XSS Filter in Microsoft Internet Explorer 8 does not properly perform neutering for the SCRIPT t The XSS Filter in Microsoft Internet Explorer 8 does not properly perform neutering for the SCRIPT tag, which allows remote attackers to conduct cross-site scripting (XSS) attacks against web sites that have no inherent XSS vulnerabilities, a different issue than CVE-2009-4074.

CVE-2008-5554 [MEDIUM] CWE-79 CVE-2008-5554: The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 does not properly handle some HTTP headers The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 does not properly handle some HTTP headers that appear after a CRLF sequence in a URI, which allows remote attackers to bypass the XSS protection mechanism and conduct XSS or redirection attacks, as demonstrated by the (1) Location and (2) Set-Cookie HTTP headers. NOTE: the vendor has reportedly s

CVE-2010-3327 [MEDIUM] CWE-200 CVE-2010-3327: The implementation of HTML content creation in Microsoft Internet Explorer 6 through 8 does not remo The implementation of HTML content creation in Microsoft Internet Explorer 6 through 8 does not remove the Anchor element during pasting and editing, which might allow remote attackers to obtain sensitive deleted information by visiting a web page, aka "Anchor Element Information Disclosure Vulnerability."

CVE-2008-4381 [MEDIUM] CWE-399 CVE-2008-4381: Microsoft Internet Explorer 7 allows remote attackers to cause a denial of service (application cras Microsoft Internet Explorer 7 allows remote attackers to cause a denial of service (application crash) via Javascript that calls the alert function with a URL-encoded string of a large number of invalid characters.

CVE-2002-2435 [MEDIUM] CWE-200 CVE-2002-2435: The Cascading Style Sheets (CSS) implementation in Microsoft Internet Explorer 8.0 and earlier does The Cascading Style Sheets (CSS) implementation in Microsoft Internet Explorer 8.0 and earlier does not properly handle the :visited pseudo-class, which allows remote attackers to obtain sensitive information about visited web pages via a crafted HTML document, a related issue to CVE-2010-2264.

CVE-2005-4844 [HIGH] CVE-2005-4844: The CLSID_ApprenticeICW control allows remote attackers to cause a denial of service (Internet Explo The CLSID_ApprenticeICW control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of the class associated with the control's CLSID, which is not intended for use within Internet Explorer.

CVE-2012-0010 [MEDIUM] CWE-200 CVE-2012-0010: Microsoft Internet Explorer 6 through 9 does not properly perform copy-and-paste operations, which a Microsoft Internet Explorer 6 through 9 does not properly perform copy-and-paste operations, which allows user-assisted remote attackers to read content from a different (1) domain or (2) zone via a crafted web site, aka "Copy and Paste Information Disclosure Vulnerability."

CVE-2009-2536 [MEDIUM] CVE-2009-2536: Microsoft Internet Explorer 5 through 8 allows remote attackers to cause a denial of service (memory Microsoft Internet Explorer 5 through 8 allows remote attackers to cause a denial of service (memory consumption and application crash) via a large integer value for the length property of a Select object, a related issue to CVE-2009-1692.

CVE-1999-0469 [MEDIUM] CVE-1999-0469: Internet Explorer 5.0 allows window spoofing, allowing a remote attacker to spoof a legitimate web s Internet Explorer 5.0 allows window spoofing, allowing a remote attacker to spoof a legitimate web site and capture information from the client.

CVE-2006-2384 [MEDIUM] CWE-200 CVE-2006-2384: Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to conduct spoofi Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to conduct spoofing and phishing attacks by using a modal browser window in a way that preserves the original address bar and trusted UI of a trusted site, even after the browser has been navigated to a malicious site, aka the "Address Bar Spoofing Vulnerability."