CVSS: 3.1EPSS: 7%CPEs: 1EXPL: 0CVE-2016-7204
https://notcve.org/view.php?id=CVE-2016-7204
Microsoft Edge allows remote attackers to access arbitrary "My Documents" files via a crafted web site, aka "Microsoft Edge Information Disclosure Vulnerability." Microsoft Edge permite a atacantes remotos acceder a archivos de "My Documents" arbitrarios a través de un sitio web manipulado, vulnerabilidad también conocida como "Microsoft Edge Information Disclosure Vulnerability". • http://www.securityfocus.com/bid/93970 http://www.securitytracker.com/id/1037245 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-129 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 1%CPEs: 1EXPL: 0CVE-2016-7209
https://notcve.org/view.php?id=CVE-2016-7209
Microsoft Edge allows remote attackers to spoof web content via a crafted web site, aka "Microsoft Edge Spoofing Vulnerability." Microsoft Edge permite a atacantes remotos suplantar contenido web a través de un sitio web manipulado, vulnerabilidad también conocida como "Microsoft Edge Spoofing Vulnerability". • http://www.securityfocus.com/bid/94049 http://www.securitytracker.com/id/1037245 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-129 • CWE-20: Improper Input Validation •
CVSS: 3.1EPSS: 6%CPEs: 4EXPL: 0CVE-2016-7227
https://notcve.org/view.php?id=CVE-2016-7227
The scripting engines in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to determine the existence of local files via unspecified vectors, aka "Microsoft Browser Information Disclosure Vulnerability." Los motores de secuencias de comandos en Microsoft Internet Explorer 9 hasta la versión 11 y Microsoft Edge permiten a atacantes remotos determinar la existencia de archivos locales a través de vectores no especificados, vulnerabilidad también conocida como "Microsoft Browser Information Disclosure Vulnerability". • http://www.securityfocus.com/bid/94065 http://www.securitytracker.com/id/1037245 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-129 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-142 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 3.1EPSS: 2%CPEs: 4EXPL: 0CVE-2016-7239
https://notcve.org/view.php?id=CVE-2016-7239
The RegEx class in the XSS filter in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allows remote attackers to conduct cross-site scripting (XSS) attacks and obtain sensitive information via unspecified vectors, aka "Microsoft Browser Information Disclosure Vulnerability." La clase RegEx en el filtro XSS en Microsoft Internet Explorer 9 hasta la versión 11 y Microsoft Edge permite a atacantes remotos llevar a cabo ataques XSS y obtener información sensible a través de vectores no especificados, vulnerabilidad también conocida como "Microsoft Browser Information Disclosure Vulnerability". • http://www.securityfocus.com/bid/94059 http://www.securitytracker.com/id/1037245 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-129 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-142 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.6EPSS: 76%CPEs: 2EXPL: 2CVE-2016-7241 – Microsoft Edge - JSON.parse Info Leak
https://notcve.org/view.php?id=CVE-2016-7241
Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability." Microsoft Internet Explorer 11 y Microsoft Edge permiten a atacantes remotos ejecutar un código arbitrario o provocar una denegación de servicio (corrupción de memoria) a través de un sitio web manipulado, vulnerabilidad también conocida como "Microsoft Browser Memory Corruption Vulnerability". Microsoft Edge has an information leak in JSON.parse. If this function is called with a reviver, and the reviver modifies the output object to contain a native array, the Walk function assumes that this array is a Var array, and writes pointers to it. These pointers can then be read out of the array by script. • https://www.exploit-db.com/exploits/40875 http://packetstormsecurity.com/files/139991/Microsoft-Edge-JSON.parse-Information-Leak.html http://www.securityfocus.com/bid/94055 http://www.securitytracker.com/id/1037245 https://bugs.chromium.org/p/project-zero/issues/detail?id=952 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-129 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-142 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •