CVSS: 5.0EPSS: 66%CPEs: 2EXPL: 0CVE-2006-3640
https://notcve.org/view.php?id=CVE-2006-3640
Microsoft Internet Explorer 5.01 and 6 allows certain script to persist across navigations between pages, which allows remote attackers to obtain the window location of visited web pages in other domains or zones, aka "Window Location Information Disclosure Vulnerability." Microsoft Internet Explorer 5.01 y 6 permite a ciertas secuencias de comandos persistir a través de navegaciones entre páginas, lo cual permite a un atacante remoto obtener la localización de ventana de páginas web visitadas en otros dominios o zonas, tambien conocido como "Vulnerabilidad de acceso de la información de localización de ventana". • http://secunia.com/advisories/21396 http://securitytracker.com/id?1016663 http://www.osvdb.org/27850 http://www.securityfocus.com/bid/19339 http://www.vupen.com/english/advisories/2006/3212 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-042 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A171 •
CVSS: 6.0EPSS: 1%CPEs: 2EXPL: 0CVE-2006-3643
https://notcve.org/view.php?id=CVE-2006-3643
Cross-site scripting (XSS) vulnerability in Internet Explorer 5.01 and 6 in Microsoft Windows 2000 SP4 permits access to local "HTML-embedded resource files" in the Microsoft Management Console (MMC) library, which allows remote authenticated users to execute arbitrary commands, aka "MMC Redirect Cross-Site Scripting Vulnerability." Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Internet Explorer 5.01 y 6 en Microsoft Windows 2000 SP4 permite acceso a "ficheros de recursos HTML-embedded" locales en la biblioteca de Consola de Administración de Microsoft (MMC), que permite a atacantes remotos autenticados ejecutar comandos de su elección, también conocido como "Vulnerabilidad de redirección de secuencias de comandos en sitios cruzados de MMC" • http://secunia.com/advisories/21401 http://securitytracker.com/id?1016655 http://www.kb.cert.org/vuls/id/927548 http://www.securityfocus.com/bid/19417 http://www.us-cert.gov/cas/techalerts/TA06-220A.html http://www.vupen.com/english/advisories/2006/3213 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-044 https://exchange.xforce.ibmcloud.com/vulnerabilities/28005 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A638 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.1EPSS: 94%CPEs: 2EXPL: 1CVE-2006-3637 – Microsoft Internet Explorer 5.0.1 - Frameset Memory Corruption
https://notcve.org/view.php?id=CVE-2006-3637
Microsoft Internet Explorer 5.01 SP4 and 6 does not properly handle various HTML layout component combinations, which allows user-assisted remote attackers to execute arbitrary code via a crafted HTML file that leads to memory corruption, aka "HTML Rendering Memory Corruption Vulnerability." Microsoft Internet Explorer 5.01 SP4 y 6 no maneja adecuadamente diversas combinaciones de componentes en diseños HTML, lo cual permite a atacantes remotos con la intervención del usuario ejecutar código de su elección mediante un archivo HTML manipulado que lleva a una corrupción de memoria, también conocido como "Vulnerabilidad de Corrupción de Memoria en Renderizado HTML" • https://www.exploit-db.com/exploits/27971 http://secunia.com/advisories/21396 http://securitytracker.com/id?1016663 http://www.kb.cert.org/vuls/id/340060 http://www.osvdb.org/27853 http://www.us-cert.gov/cas/techalerts/TA06-220A.html http://www.vupen.com/english/advisories/2006/3212 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-042 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A502 •
CVSS: 7.5EPSS: 88%CPEs: 8EXPL: 0CVE-2006-3638
https://notcve.org/view.php?id=CVE-2006-3638
Microsoft Internet Explorer 5.01 and 6 does not properly handle uninitialized COM objects, which allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code, as demonstrated by the Nth function in the DirectAnimation.DATuple ActiveX control, aka "COM Object Instantiation Memory Corruption Vulnerability." Microsoft Internet Explorer 5.01 y 6 no maneja adecuadamente objetos COM no inicializados, lo cual permite a atacantes remotos provocar una denegación de servicio (corrupción de memoria) y posiblemente ejecutar código de su elección, como ha sido demostrado por la función Nth en el control ActiveX DirectAnimation.DATuple, también conocido como "Vulnerabilidad de Corrupción de Memoria en la Instanciación de Objetos COM". • http://secunia.com/advisories/21396 http://securitytracker.com/id?1016663 http://www.kb.cert.org/vuls/id/959049 http://www.osvdb.org/27852 http://www.securityfocus.com/archive/1/442728/100/0/threaded http://www.securityfocus.com/bid/19340 http://www.tippingpoint.com/security/advisories/TSRT-06-09.html http://www.us-cert.gov/cas/techalerts/TA06-220A.html http://www.vupen.com/english/advisories/2006/3212 https://docs.microsoft.com/en-us/security-updates/securitybulletin • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 88%CPEs: 2EXPL: 0CVE-2006-3450 – Microsoft Internet Explorer CSS Class Ordering Memory Corruption Vulnerability
https://notcve.org/view.php?id=CVE-2006-3450
Microsoft Internet Explorer 6 allows remote attackers to execute arbitrary code by using the document.getElementByID Javascript function to access crafted Cascading Style Sheet (CSS) elements, and possibly other unspecified vectors involving certain layout positioning combinations in an HTML file. Microsoft Internet Explorer 6 permite a atacantes remotos ejecutar código de su elección usando la función Javascript document.getElementByID para acceder a elementos de Hojas de Estilo en Cascada (CSS) manipulados, y posiblemente otros vectores no especificados relacionados con determinadas combinaciones de posicionamiento en el diseño de un archivo HTML. This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page. The specific vulnerability exists due to improper handling of CSS class values. Accessing a specially crafted CSS element via document.getElementByID causes a memory corruption eventually leading to code execution. • http://secunia.com/advisories/21396 http://securitytracker.com/id?1016663 http://www.kb.cert.org/vuls/id/119180 http://www.osvdb.org/27855 http://www.securityfocus.com/archive/1/442579/100/0/threaded http://www.securityfocus.com/bid/19312 http://www.us-cert.gov/cas/techalerts/TA06-220A.html http://www.vupen.com/english/advisories/2006/3212 http://www.zerodayinitiative.com/advisories/ZDI-06-027.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/20 • CWE-20: Improper Input Validation •