CVSS: 7.5EPSS: 1%CPEs: 3EXPL: 0CVE-2013-2552
https://notcve.org/view.php?id=CVE-2013-2552
Unspecified vulnerability in Microsoft Internet Explorer 10 on Windows 8 allows remote attackers to bypass the sandbox protection mechanism by leveraging access to a Medium integrity process, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013. Vulnerabilidad sin especificar en Microsoft Internet Explorer 10 sobre Windows 8, permite a atacantes remotos evitar el mecanismo de protección "sandbox" aprovechando el acceso a los procesos de integridad "Medium", como se ha demostrador por VUPEN durante la competición de Pwn2Own en CanSecWest 2013. • http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157 http://twitter.com/VUPEN/statuses/309479075385327617 http://twitter.com/thezdi/statuses/309452625173176320 •
CVSS: 9.3EPSS: 96%CPEs: 29EXPL: 1CVE-2013-2551 – Microsoft Internet Explorer Use-After-Free Vulnerability
https://notcve.org/view.php?id=CVE-2013-2551
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than CVE-2013-1308 and CVE-2013-1309. Vulnerabilidad no especificada en Microsoft Internet Explorer 10 en Windows 8 permite a atacantes remotos ejecutar código de su elección a través de vectores desconocidos, como se mostró por VUPEN durante la competición Pwn2Own en CanSecWest 2013. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of VML data. The issue lies in the handling of an array when defined as an attribute of a subelement of a shape. • https://www.exploit-db.com/exploits/26175 http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157 http://twitter.com/VUPEN/statuses/309479075385327617 http://twitter.com/thezdi/statuses/309452625173176320 http://www.us-cert.gov/ncas/alerts/TA13-134A https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-037 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16317 • CWE-416: Use After Free •
CVSS: 9.3EPSS: 93%CPEs: 36EXPL: 1CVE-2013-0019 – Microsoft Internet Explorer COmWindowProxy Use-After-Free Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2013-0019
Use-after-free vulnerability in Microsoft Internet Explorer 7 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer COmWindowProxy Use After Free Vulnerability." Vulnerabilidad de uso después de liberación en Microsoft Internet Explorer 7 hasta 10 que permite a atacantes remotos ejecutar código arbitrario a través de un sitio web modificado que desencadena el acceso a un objeto eliminado, también conocido como "Internet Explorer COmWindowProxy Use After Free Vulnerability." This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of iframes. By manipulating an iframe using window.open an attacker can force a dangling pointer to be reused after it has been freed. • https://www.exploit-db.com/exploits/40879 http://blog.skylined.nl/20161202001.html http://www.us-cert.gov/cas/techalerts/TA13-043B.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-009 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16465 • CWE-399: Resource Management Errors •
CVSS: 9.3EPSS: 89%CPEs: 5EXPL: 0CVE-2013-0021
https://notcve.org/view.php?id=CVE-2013-0021
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer vtable Use After Free Vulnerability." Vulnerabilidad de uso después de liberación en Microsoft Internet Explorer 6 hasta 10 que permite a atacantes remotos ejecutar código arbitrario a través de un sitio web modificado que desencadena el acceso a un objeto eliminado, también conocido como "Internet Explorer vtable Use After Free Vulnerability." • http://www.us-cert.gov/cas/techalerts/TA13-043B.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-009 https://lists.apache.org/thread.html/r1c07a561426ec5579073046ad7f4207cdcef452bb3100abaf908e0cd%40%3Ccommits.santuario.apache.org%3E https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16483 • CWE-399: Resource Management Errors •
CVSS: 9.3EPSS: 84%CPEs: 14EXPL: 0CVE-2013-0023 – Microsoft Internet Explorer CDispNode Use-After-Free Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2013-0023
Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer CDispNode Use After Free Vulnerability." Vulnerabilidad de uso después de liberación en Microsoft Internet Explorer 9 y 10 que permite a atacantes remotos ejecutar código arbitrario a través de un sitio web modificado que desencadena el acceso a un objeto eliminado, también conocido como "Internet Explorer CDispNode Use After Free Vulnerability." This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific issue is due to the way Internet Explorer handles SVG objects. A use-after-free condition can be created when an SVG references a self-referent SVG. • http://www.us-cert.gov/cas/techalerts/TA13-043B.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-009 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16470 • CWE-399: Resource Management Errors •