Microsoft Internet Explorer vulnerabilities

CVE-2001-0919 [MEDIUM] CVE-2001-0919: Internet Explorer 5.50.4134.0100 on Windows ME with "Prompt to allow cookies to be stored on your ma Internet Explorer 5.50.4134.0100 on Windows ME with "Prompt to allow cookies to be stored on your machine" enabled does not warn a user when a cookie is set using Javascript.

CVE-2001-0807 [LOW] CVE-2001-0807: Internet Explorer 5.0, and possibly other versions, may allow remote attackers (malicious web pages) Internet Explorer 5.0, and possibly other versions, may allow remote attackers (malicious web pages) to read known text files from a client's hard drive via a SCRIPT tag with a SRC value that points to the text file.

CVE-2001-1497 [LOW] CVE-2001-1497: Microsoft Internet Explorer 4.0 through 6.0 could allow local users to differentiate between alphanu Microsoft Internet Explorer 4.0 through 6.0 could allow local users to differentiate between alphanumeric and non-alphanumeric characters used in a password by pressing certain control keys that jump between non-alphanumeric characters, which makes it easier to conduct a brute-force password guessing attack.

CVE-2000-0439 [LOW] CVE-2000-0439: Internet Explorer 4.0 and 5.0 allows a malicious web site to obtain client cookies from another doma Internet Explorer 4.0 and 5.0 allows a malicious web site to obtain client cookies from another domain by including that domain name and escaped characters in a URL, aka the "Unauthorized Cookie Access" vulnerability.

CVE-2005-2274 [LOW] CVE-2005-2274: Microsoft Internet Explorer 6.0 does not clearly associate a Javascript dialog box with the web page Microsoft Internet Explorer 6.0 does not clearly associate a Javascript dialog box with the web page that generated it, which allows remote attackers to spoof a dialog box from a trusted site and facilitates phishing attacks, aka the "Dialog Origin Spoofing Vulnerability."

CVE-2004-2219 [LOW] CVE-2004-2219: Microsoft Internet Explorer 6 allows remote attackers to spoof the address bar to facilitate phishin Microsoft Internet Explorer 6 allows remote attackers to spoof the address bar to facilitate phishing attacks via Javascript that uses an invalid URI, modifies the Location field, then uses history.back to navigate to the previous domain, aka NullyFake.

CVE-2004-2011 [LOW] CVE-2004-2011: msxml3.dll in Internet Explorer 6.0.2600.0 allows remote attackers to cause a denial of service (cra msxml3.dll in Internet Explorer 6.0.2600.0 allows remote attackers to cause a denial of service (crash) via a single & (ampersand) in a link, which triggers a parsing error, possibly due to missing portions of the URI.

CVE-1999-1367 [MEDIUM] CVE-1999-1367: Internet Explorer 5.0 does not properly reset the username/password cache for Web sites that do not Internet Explorer 5.0 does not properly reset the username/password cache for Web sites that do not use standard cache controls, which could allow users on the same system to access restricted web sites that were visited by other users.

CVE-2004-2476 [LOW] CVE-2004-2476: Microsoft Internet Explorer 6.0 allows remote attackers to cause a denial of service (infinite loop Microsoft Internet Explorer 6.0 allows remote attackers to cause a denial of service (infinite loop and crash) via an IFRAME with "?" as the file source.

CVE-1999-0827 [LOW] CVE-1999-0827: By default, Internet Explorer 5.0 and other versions enables the "Navigate sub-frames across differe By default, Internet Explorer 5.0 and other versions enables the "Navigate sub-frames across different domains" option, which allows frame spoofing.

CVE-2001-1450 [LOW] CVE-2001-1450: Microsoft Internet Explorer 5.0 through 6.0 allows attackers to cause a denial of service (browser c Microsoft Internet Explorer 5.0 through 6.0 allows attackers to cause a denial of service (browser crash) via a crafted FTP URL such as "/.#./".

CVE-2002-1670 [MEDIUM] CVE-2002-1670: Microsoft Windows XP Professional upgrade edition overwrites previously installed patches for Intern Microsoft Windows XP Professional upgrade edition overwrites previously installed patches for Internet Explorer 6.0, leaving Internet Explorer unpatched.

CVE-2008-2159 [LOW] CWE-200 CVE-2008-2159: Microsoft Internet Explorer 7 can save encrypted pages in the cache even when the DisableCachingOfSS Microsoft Internet Explorer 7 can save encrypted pages in the cache even when the DisableCachingOfSSLPages registry setting is enabled, which might allow local users to obtain sensitive information.

CVE-1999-1446 [LOW] CVE-1999-1446: Internet Explorer 3 records a history of all URL's that are visited by a user in DAT files located i Internet Explorer 3 records a history of all URL's that are visited by a user in DAT files located in the Temporary Internet Files and History folders, which are not cleared when the user selects the "Clear History" option, and are not visible when the user browses the folders because of tailored displays.