Microsoft Internet Explorer vulnerabilities

CVE-2008-5552 [MEDIUM] CWE-79 CVE-2008-5552: The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 allows remote attackers to bypass the XSS p The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 allows remote attackers to bypass the XSS protection mechanism and conduct XSS attacks via a CRLF sequence in conjunction with a crafted Content-Type header, as demonstrated by a header with a utf-7 charset value. NOTE: the vendor has reportedly stated that the XSS Filter intentionally does not a

CVE-2006-3200 [MEDIUM] CVE-2006-3200: Unspecified versions of Internet Explorer allow remote attackers to cause a denial of service (crash Unspecified versions of Internet Explorer allow remote attackers to cause a denial of service (crash) via an IFRAME with a src tag containing a "File://" URI followed by an 8-bit character. NOTE: some third parties were unable to verify this issue.

CVE-2008-5556 [MEDIUM] CWE-79 CVE-2008-5556: The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 does not recognize attack patterns designed The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 does not recognize attack patterns designed to operate against web pages that are encoded with utf-7, which allows remote attackers to bypass the XSS protection mechanism and conduct XSS attacks by injecting crafted utf-7 content. NOTE: the vendor reportedly disputes this issue, stating "Behaviou

CVE-2006-0585 [MEDIUM] CVE-2006-0585: jscript.dll in Microsoft Internet Explorer 6.0 SP1 and earlier allows remote attackers to cause a de jscript.dll in Microsoft Internet Explorer 6.0 SP1 and earlier allows remote attackers to cause a denial of service (application crash) via a Shockwave Flash object that contains ActionScript code that calls VBScript, which in turn calls the Javascript document.write function, which triggers a null dereference.

CVE-2018-8315 [MEDIUM] CWE-200 CVE-2018-8315: An information disclosure vulnerability exists when the browser scripting engine improperly handle o An information disclosure vulnerability exists when the browser scripting engine improperly handle object types, aka "Microsoft Scripting Engine Information Disclosure Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge, Internet Explorer 10.

CVE-2002-0101 [MEDIUM] CVE-2002-0101: Microsoft Internet Explorer 6.0 and earlier allows local users to cause a denial of service via an i Microsoft Internet Explorer 6.0 and earlier allows local users to cause a denial of service via an infinite loop for modeless dialogs showModelessDialog, which causes CPU usage while the focus for the dialog is not released.

CVE-2003-0519 [MEDIUM] CVE-2003-0519: Certain versions of Internet Explorer 5 and 6, in certain Windows environments, allow remote attacke Certain versions of Internet Explorer 5 and 6, in certain Windows environments, allow remote attackers to cause a denial of service (freeze) via a URL to C:\aux (MS-DOS device name) and possibly other devices.

CVE-2000-0266 [LOW] CVE-2000-0266: Internet Explorer 5.01 allows remote attackers to bypass the cross frame security policy via a malic Internet Explorer 5.01 allows remote attackers to bypass the cross frame security policy via a malicious applet that interacts with the Java JSObject to modify the DOM properties to set the IFRAME to an arbitrary Javascript URL.

CVE-2005-0954 [MEDIUM] CVE-2005-0954: Windows Explorer and Internet Explorer in Windows 2000 SP1 allows remote attackers to cause a denial Windows Explorer and Internet Explorer in Windows 2000 SP1 allows remote attackers to cause a denial of service (CPU consumption) via a malformed Windows Metafile (WMF) file.

CVE-2016-7199 [LOW] CWE-200 CVE-2016-7199: Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to bypass the Sam Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to bypass the Same Origin Policy and obtain sensitive window-state information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability."

CVE-2006-3545 [MEDIUM] CVE-2006-3545: Microsoft Internet Explorer 7.0 Beta allows remote attackers to cause a denial of service (applicati Microsoft Internet Explorer 7.0 Beta allows remote attackers to cause a denial of service (application crash) via a web page with multiple empty APPLET start tags. NOTE: a third party has disputed this issue, stating that the crash does not occur with Microsoft Internet Explorer 7.0 Beta3

CVE-2000-0162 [MEDIUM] CVE-2000-0162: The Microsoft virtual machine (VM) in Internet Explorer 4.x and 5.x allows a remote attacker to read The Microsoft virtual machine (VM) in Internet Explorer 4.x and 5.x allows a remote attacker to read files via a malicious Java applet that escapes the Java sandbox, aka the "VM File Reading" vulnerability.

CVE-2010-2119 [MEDIUM] CWE-399 CVE-2010-2119: Microsoft Internet Explorer 6.0.2900.2180 allows remote attackers to cause a denial of service (reso Microsoft Internet Explorer 6.0.2900.2180 allows remote attackers to cause a denial of service (resource consumption) via JavaScript code containing an infinite loop that creates IFRAME elements for invalid nntp:// URIs.

CVE-1999-1473 [MEDIUM] CVE-1999-1473: When a Web site redirects the browser to another site, Internet Explorer 3.02 and 4.0 automatically When a Web site redirects the browser to another site, Internet Explorer 3.02 and 4.0 automatically resends authentication information to the second site, aka the "Page Redirect Issue."

CVE-2016-7227 [LOW] CWE-200 CVE-2016-7227: The scripting engines in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote at The scripting engines in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to determine the existence of local files via unspecified vectors, aka "Microsoft Browser Information Disclosure Vulnerability."

CVE-2006-3658 [MEDIUM] CVE-2006-3658: Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (crash) by access Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (crash) by accessing the object references of a FolderItem ActiveX object, which triggers a null dereference in the security check.

CVE-2004-0979 [MEDIUM] CVE-2004-0979: Internet Explorer on Windows XP does not properly modify the "Drag and Drop or copy and paste files" Internet Explorer on Windows XP does not properly modify the "Drag and Drop or copy and paste files" setting when the user sets it to "Disable" or "Prompt," which may enable security-sensitive operations that are inconsistent with the user's intended configuration.

CVE-2007-4848 [MEDIUM] CVE-2007-4848: Microsoft Internet Explorer 4.0 through 7 allows remote attackers to determine the existence of loca Microsoft Internet Explorer 4.0 through 7 allows remote attackers to determine the existence of local files that have associated images via a res:// URI in the src property of a JavaScript Image object, as demonstrated by the URI for a bitmap image resource within a (1) .exe or (2) .dll file.

CVE-2001-0332 [MEDIUM] CVE-2001-0332: Internet Explorer 5.5 and earlier does not properly verify the domain of a frame within a browser wi Internet Explorer 5.5 and earlier does not properly verify the domain of a frame within a browser window, which allows remote web site operators to read certain files on the client by sending information from a local frame to a frame in a different domain using MSScriptControl.ScriptControl and GetObject, aka a variant of the "Frame Domain Verification" vulne

CVE-2002-1564 [MEDIUM] CVE-2002-1564: Internet Explorer 5.5 and 6.0 allows remote attackers to steal potentially sensitive information fro Internet Explorer 5.5 and 6.0 allows remote attackers to steal potentially sensitive information from cookies via a cookie that contains script which is executed when a page is loaded, aka the "Script within Cookies Reading Cookies" vulnerability.