CVSS: 9.3EPSS: 82%CPEs: 3EXPL: 0CVE-2012-2546
https://notcve.org/view.php?id=CVE-2012-2546
Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Event Listener Use After Free Vulnerability." Una vulnerabilidad de uso después de liberación en Microsoft Internet Explorer 9 permite a atacantes remotos ejecutar código de su elección a través de un sitio web diseñado para tal fin que provoca el acceso a un objeto eliminado. Se trata de un problema también conocido como "Vulnerabilidad de uso después de liberación de Event Listener". • http://www.securityfocus.com/bid/55645 http://www.securitytracker.com/id?1027555 http://www.us-cert.gov/cas/techalerts/TA12-255A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-063 https://exchange.xforce.ibmcloud.com/vulnerabilities/78757 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15652 • CWE-399: Resource Management Errors •
CVSS: 9.3EPSS: 85%CPEs: 50EXPL: 1CVE-2012-4969 – Microsoft Internet Explorer Use-After-Free Vulnerability
https://notcve.org/view.php?id=CVE-2012-4969
Use-after-free vulnerability in the CMshtmlEd::Exec function in mshtml.dll in Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code via a crafted web site, as exploited in the wild in September 2012. Vulnerabilidad de error en la gestión de recursos en la función CMshtmlEd::Exec en mshtml.dll en Microsoft Internet Explorer 6 a 9 permite a atacantes remotos ejecutar código arbitrario a través de un sitio web diseñado, como se ha explotado en septiembre de 2012. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the CCommand::Exec function. It is possible to free certain objects in a callback function called from the CCommand::Exec function. • https://www.exploit-db.com/exploits/21840 http://blog.vulnhunt.com/index.php/2012/09/17/ie-execcommand-fuction-use-after-free-vulnerability-0day_en http://dev.metasploit.com/redmine/projects/framework/repository/entry/modules/exploits/windows/browser/ie_execcommand_uaf.rb http://eromang.zataz.com/2012/09/16/zero-day-season-is-really-not-over-yet http://technet.microsoft.com/security/advisory/2757760 http://www.kb.cert.org/vuls/id/480095 http://www.securitytracker.com/id?1027538 http •
CVSS: 9.3EPSS: 89%CPEs: 5EXPL: 0CVE-2012-4781
https://notcve.org/view.php?id=CVE-2012-4781
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "InjectHTMLStream Use After Free Vulnerability." Vulnerabilidad de uso después de liberación en Microsoft Internet Explorer 6 hasta 10, permite a atacantes remotos ejecutar código arbitrario a través de un sitio web manipulado que desencadena el acceso a un objeto eliminado, también conocido como "InjectHTMLStream Use After Free Vulnerability." • http://www.us-cert.gov/cas/techalerts/TA12-346A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-077 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15731 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.3EPSS: 86%CPEs: 4EXPL: 0CVE-2012-2522
https://notcve.org/view.php?id=CVE-2012-2522
Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a malformed virtual function table after this table's deletion, aka "Virtual Function Table Corruption Remote Code Execution Vulnerability." Microsoft Internet Explorer v6 y v9 no trata correctamente los objetos en memoria, lo que permite a atacantes remotos ejecutar código arbitrario mediante el acceso a una función de tabla virtual malformada después de la eliminación de la tabla. • http://www.us-cert.gov/cas/techalerts/TA12-227A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-052 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15498 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.3EPSS: 85%CPEs: 4EXPL: 0CVE-2012-2523
https://notcve.org/view.php?id=CVE-2012-2523
Integer overflow in Microsoft Internet Explorer 8 and 9, JScript 5.8, and VBScript 5.8 on 64-bit platforms allows remote attackers to execute arbitrary code by leveraging an incorrect size calculation during object copying, aka "JavaScript Integer Overflow Remote Code Execution Vulnerability." Desbordamiento de entero en Microsoft Internet Explorer 8 y 9, JScript 5.8, y VBScript 5.8 sobre plataformas de 64-bit permite a atacantes remotos ejecutar código de su elección aprovechando un cálculo incorrecto de tamaño durante la copia de un objeto, también conocido como "JavaScript Integer Overflow Remote Code Execution Vulnerability." • http://www.us-cert.gov/cas/techalerts/TA12-227A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-052 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-056 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15790 • CWE-189: Numeric Errors •