Microsoft Internet Explorer vulnerabilities

CVE-2004-0719 [HIGH] CVE-2004-0719: Internet Explorer for Mac 5.2.3, Internet Explorer 6 on Windows XP, and possibly other versions, doe Internet Explorer for Mac 5.2.3, Internet Explorer 6 on Windows XP, and possibly other versions, does not properly prevent a frame in one domain from injecting content into a frame that belongs to another domain, which facilitates web site spoofing and other attacks, aka the frame injection vulnerability.

CVE-2002-0500 [MEDIUM] CVE-2002-0500: Internet Explorer 5.0 through 6.0 allows remote attackers to determine the existence of files on the Internet Explorer 5.0 through 6.0 allows remote attackers to determine the existence of files on the client via an IMG tag with a dynsrc property that references the target file, which sets certain elements of the image object such as file size.

CVE-2002-0815 [HIGH] CVE-2002-0815: The Javascript "Same Origin Policy" (SOP), as implemented in (1) Netscape, (2) Mozilla, and (3) Inte The Javascript "Same Origin Policy" (SOP), as implemented in (1) Netscape, (2) Mozilla, and (3) Internet Explorer, allows a remote web server to access HTTP and SOAP/XML content from restricted sites by mapping the malicious server's parent DNS domain name to the restricted site, loading a page from the restricted site into one frame, and passing the informatio

CVE-2018-8452 [MEDIUM] CWE-200 CVE-2018-8452: An information disclosure vulnerability exists when the scripting engine does not properly handle ob An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft browsers, aka "Scripting Engine Information Disclosure Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge.

CVE-2013-3192 [MEDIUM] CWE-79 CVE-2013-3192: Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 6 through 10 allows remote a Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to inject arbitrary web script or HTML via crafted character sequences with EUC-JP encoding, aka "EUC-JP Character Encoding Vulnerability."

CVE-2005-4841 [HIGH] CVE-2005-4841: The Outlook Progress Ctl control allows remote attackers to cause a denial of service (Internet Expl The Outlook Progress Ctl control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of the class associated with the control's CLSID, which is not intended for use within Internet Explorer.

CVE-2005-4842 [HIGH] CVE-2005-4842: The System Monitor Source Properties control allows remote attackers to cause a denial of service (I The System Monitor Source Properties control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of the class associated with the control's CLSID, which is not intended for use within Internet Explorer.

CVE-2017-0231 [MEDIUM] CWE-20 CVE-2017-0231: A spoofing vulnerability exists when Microsoft browsers render SmartScreen Filter, aka "Microsoft Br A spoofing vulnerability exists when Microsoft browsers render SmartScreen Filter, aka "Microsoft Browser Spoofing Vulnerability."

CVE-2000-0201 [MEDIUM] CVE-2000-0201: The window.showHelp() method in Internet Explorer 5.x does not restrict HTML help files (.chm) to be The window.showHelp() method in Internet Explorer 5.x does not restrict HTML help files (.chm) to be executed from the local host, which allows remote attackers to execute arbitrary commands via Microsoft Networking.

CVE-2011-1258 [MEDIUM] CWE-668 CVE-2011-1258: Microsoft Internet Explorer 6 through 8 does not properly restrict web script, which allows user-ass Microsoft Internet Explorer 6 through 8 does not properly restrict web script, which allows user-assisted remote attackers to obtain sensitive information from a different (1) domain or (2) zone via vectors involving a drag-and-drop operation, aka "Drag and Drop Information Disclosure Vulnerability."

CVE-1999-0870 [LOW] CVE-1999-0870: Internet Explorer 4.01 allows remote attackers to read arbitrary files by pasting a file name into t Internet Explorer 4.01 allows remote attackers to read arbitrary files by pasting a file name into the file upload control, aka untrusted scripted paste.

CVE-1999-0917 [MEDIUM] CVE-1999-0917: The Preloader ActiveX control used by Internet Explorer allows remote attackers to read arbitrary fi The Preloader ActiveX control used by Internet Explorer allows remote attackers to read arbitrary files.

CVE-2002-2125 [MEDIUM] CVE-2002-2125: Internet Explorer 6.0 does not warn users when an expired certificate authority (CA) certificate is Internet Explorer 6.0 does not warn users when an expired certificate authority (CA) certificate is submitted to the user and a newer CA certificate is in the user's local repository, which could allow remote attackers to decrypt web sessions via a man-in-the-middle (MITM) attack.

CVE-2010-3342 [MEDIUM] CWE-200 CVE-2010-3342: Microsoft Internet Explorer 6, 7, and 8 does not prevent rendering of cached content as HTML, which Microsoft Internet Explorer 6, 7, and 8 does not prevent rendering of cached content as HTML, which allows remote attackers to access content from a different (1) domain or (2) zone via unspecified script code, aka "Cross-Domain Information Disclosure Vulnerability," a different vulnerability than CVE-2010-3348.

CVE-2010-3348 [MEDIUM] CVE-2010-3348: Microsoft Internet Explorer 6, 7, and 8 does not prevent rendering of cached content as HTML, which Microsoft Internet Explorer 6, 7, and 8 does not prevent rendering of cached content as HTML, which allows remote attackers to access content from a different (1) domain or (2) zone via unspecified script code, aka "Cross-Domain Information Disclosure Vulnerability," a different vulnerability than CVE-2010-3342.

CVE-1999-0354 [HIGH] CVE-1999-0354: Internet Explorer 4.x or 5.x with Word 97 allows arbitrary execution of Visual Basic programs to the Internet Explorer 4.x or 5.x with Word 97 allows arbitrary execution of Visual Basic programs to the IE client through the Word 97 template, which doesn't warn the user that the template contains executable content. Also applies to Outlook when the client views a malicious email message.

CVE-2005-0500 [MEDIUM] CVE-2005-0500: Internet Explorer 6.0 on Windows XP SP2 allows remote attackers to spoof the domain name of a URL in Internet Explorer 6.0 on Windows XP SP2 allows remote attackers to spoof the domain name of a URL in a titlebar for a script-initiated popup window, which could facilitate phishing attacks.

CVE-2006-3657 [MEDIUM] CVE-2006-3657: Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (stack overflow e Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (stack overflow exception) via a DXImageTransform.Microsoft.Gradient ActiveX object with a long (1) StartColorStr or (2) EndColorStr property.

CVE-2001-0723 [MEDIUM] CVE-2001-0723: Internet Explorer 5.5 and 6.0 allows remote attackers to read and modify user cookies via Javascript Internet Explorer 5.5 and 6.0 allows remote attackers to read and modify user cookies via Javascript, aka the "Second Cookie Handling Vulnerability."

CVE-2008-4127 [MEDIUM] CWE-399 CVE-2008-4127: Mshtml.dll in Microsoft Internet Explorer 7 Gold 7.0.5730 and 8 Beta 8.0.6001 on Windows XP SP2 allo Mshtml.dll in Microsoft Internet Explorer 7 Gold 7.0.5730 and 8 Beta 8.0.6001 on Windows XP SP2 allows remote attackers to cause a denial of service (failure of subsequent image rendering) via a crafted PNG file, related to an infinite loop in the CDwnTaskExec::ThreadExec function.