CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2008-3358
https://notcve.org/view.php?id=CVE-2008-3358
Cross-site scripting (XSS) vulnerability in Web Dynpro (WD) in the SAP NetWeaver portal, when Internet Explorer 7.0.5730 is used, allows remote attackers to inject arbitrary web script or HTML via a crafted URI, which causes the XSS payload to be reflected in a text/plain document. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en el Web Dynpro (WD) en el portal SAP NetWeaver, cuando se usa con Internet Explorer v7.0.5730, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través de una URI manipulada, lo que provoca que la carga XSS sea reflejada en un documento de texto plano. • http://osvdb.org/51627 http://secunia.com/advisories/33685 http://service.sap.com/sap/support/notes/1235253 http://www.csnc.ch/misc/files/advisories/CVE-2008-3358.txt http://www.securityfocus.com/archive/1/500415/100/0/threaded http://www.securityfocus.com/bid/33465 http://www.securitytracker.com/id?1021638 http://www.vupen.com/english/advisories/2009/0255 https://exchange.xforce.ibmcloud.com/vulnerabilities/48237 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 1%CPEs: 6EXPL: 1CVE-2009-0072 – Microsoft Internet Explorer Javascript Denial Of Service
https://notcve.org/view.php?id=CVE-2009-0072
Microsoft Internet Explorer 6.0 through 8.0 beta2 allows remote attackers to cause a denial of service (application crash) via an onload=screen[""] attribute value in a BODY element. Microsoft Internet Explorer 6.0 hasta 8.0 beta2 permite a atacantes remotos provocar una denegación de servicio (caída de aplicación) a través del valor del atributo onload=screen[""] en un elemento "BODY". • http://skypher.com/index.php/2009/01/07/msie-screen-null-ptr-dos-details http://www.securityfocus.com/bid/33149 https://exchange.xforce.ibmcloud.com/vulnerabilities/47788 •
CVSS: 6.8EPSS: 1%CPEs: 2EXPL: 2CVE-2008-5750 – Google Chrome - 'ChromeHTML://' Remote Parameter Injection
https://notcve.org/view.php?id=CVE-2008-5750
Argument injection vulnerability in Microsoft Internet Explorer 8 beta 2 on Windows XP SP3 allows remote attackers to execute arbitrary commands via the --renderer-path option in a chromehtml: URI. Vulnerabilidad de inyección de argumento en Microsoft Internet Explorer 8 beta 2 sobre Windows XP SP3, permite a atacantes remotos ejecutar comandos de su elección a través de la opción "--renderer-path" en una URI chromehtml:. • https://www.exploit-db.com/exploits/7566 http://retrogod.altervista.org/9sg_chrome.html http://securityreason.com/securityalert/4821 http://www.securityfocus.com/archive/1/499570/100/0/threaded http://www.securityfocus.com/bid/32999 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.3EPSS: 0%CPEs: 3EXPL: 0CVE-2008-5527
https://notcve.org/view.php?id=CVE-2008-5527
ESET Smart Security, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit. ESET Smart Security, cuando se utiliza Internet Explorer 6 o 7, permite a atacantes remotos eludir la detección de malware en un documento HTML colocando una cabecera MZ (alias "EXE info") al principio, y modificar el nombre del archivo a (1 ) sin extensión, (2) una extensión. txt, o (3) una extensión .jpg, como lo demuestra un documento que contiene un exploit CVE-2006-5745. • http://securityreason.com/securityalert/4723 http://www.securityfocus.com/archive/1/498995/100/0/threaded http://www.securityfocus.com/archive/1/499043/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/47435 • CWE-20: Improper Input Validation •
CVSS: 9.3EPSS: 0%CPEs: 3EXPL: 0CVE-2008-5541
https://notcve.org/view.php?id=CVE-2008-5541
Sophos Anti-Virus 4.33.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit. Sophos Anti-Virus v4.33.0, cuando se utiliza Internet Explorer 6 o 7, permite a atacantes remotos eludir la detección de malware en un documento HTML colocando una cabecera MZ (alias "EXE info") al principio, y modificar el nombre del archivo a (1 ) sin extensión, (2) una extensión. txt, o (3) una extensión .jpg, como lo demuestra un documento que contiene un exploit CVE-2006-5745. • http://securityreason.com/securityalert/4723 http://www.securityfocus.com/archive/1/498995/100/0/threaded http://www.securityfocus.com/archive/1/499043/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/47435 • CWE-20: Improper Input Validation •