CVSS: 8.8EPSS: 33%CPEs: 30EXPL: 0CVE-2007-5344 – Microsoft Internet Explorer Element Tags Vulnerability
https://notcve.org/view.php?id=CVE-2007-5344
11 Dec 2007 — Microsoft Internet Explorer 5.01 through 7 allows remote attackers to execute arbitrary code via a crafted website using Javascript that creates, modifies, deletes, and accesses document objects using the tags property, which triggers heap corruption, related to uninitialized or deleted objects, a different issue than CVE-2007-3902 and CVE-2007-3903, and a variant of "Uninitialized Memory Corruption Vulnerability." Microsoft Internet Explorer versiones 5.01 hasta 7, permite a los atacantes remotos ejecutar ... • http://secunia.com/advisories/28036 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.3EPSS: 52%CPEs: 30EXPL: 0CVE-2007-3902 – Microsoft Internet Explorer setExpression Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2007-3902
11 Dec 2007 — Use-after-free vulnerability in the CRecalcProperty function in mshtml.dll in Microsoft Internet Explorer 5.01 through 7 allows remote attackers to execute arbitrary code by calling the setExpression method and then modifying the outerHTML property of an HTML element, one variant of "Uninitialized Memory Corruption Vulnerability." Una vulnerabilidad de uso de memoria previamente liberada en la función CRecalcProperty en la biblioteca mshtml.dll en Microsoft Internet Explorer versiones 5.01 hasta 7, permite ... • http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=631 • CWE-189: Numeric Errors CWE-399: Resource Management Errors •
CVSS: 8.8EPSS: 48%CPEs: 17EXPL: 0CVE-2007-3903 – Microsoft Internet Explorer Node Manipulation Memory Corruption Vulnerability
https://notcve.org/view.php?id=CVE-2007-3903
11 Dec 2007 — Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code via uninitialized or deleted objects used in repeated calls to the (1) cloneNode or (2) nodeValue JavaScript function, a different issue than CVE-2007-3902 and CVE-2007-5344, a variant of "Uninitialized Memory Corruption Vulnerability." Microsoft Internet Explorer versiones 6 y 7, permite a los atacantes remotos ejecutar código arbitrario por medio de objetos no inicializados o eliminados usados en llamadas repetidas a la ... • http://secunia.com/advisories/28036 • CWE-399: Resource Management Errors •
CVSS: 4.3EPSS: 23%CPEs: 44EXPL: 1CVE-2007-4848
https://notcve.org/view.php?id=CVE-2007-4848
12 Sep 2007 — Microsoft Internet Explorer 4.0 through 7 allows remote attackers to determine the existence of local files that have associated images via a res:// URI in the src property of a JavaScript Image object, as demonstrated by the URI for a bitmap image resource within a (1) .exe or (2) .dll file. Microsoft Internet Explorer 4.0 hasta 7 permite a atacantes remotos determinar la existencia de archivos locales que tienen imágenes asociadas mediante un URI res:// en la propiedad src de un objeto Image de JavaScript... • http://osvdb.org/37638 •
CVSS: 7.8EPSS: 27%CPEs: 7EXPL: 0CVE-2007-3550
https://notcve.org/view.php?id=CVE-2007-3550
03 Jul 2007 — Microsoft Internet Explorer 6.0 and 7.0 allows remote attackers to fill Zones with arbitrary domains using certain metacharacters such as wildcards via JavaScript, which results in a denial of service (website suppression and resource consumption), aka "Internet Explorer Zone Domain Specification Dos and Page Suppressing". NOTE: this issue has been disputed by a third party, who states that the zone settings cannot be manipulated ** EN DISPUTA ** Microsoft Internet Explorer versión 6.0 y versión 7.0 permite... • http://lists.grok.org.uk/pipermail/full-disclosure/2007-July/064326.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.3EPSS: 54%CPEs: 25EXPL: 0CVE-2007-0942
https://notcve.org/view.php?id=CVE-2007-0942
08 May 2007 — Microsoft Internet Explorer 5.01 SP4 on Windows 2000 SP4; 6 SP1 on Windows 2000 SP4; 6 and 7 on Windows XP SP2, or Windows Server 2003 SP1 or SP2; and possibly 7 on Windows Vista does not properly "instantiate certain COM objects as ActiveX controls," which allows remote attackers to execute arbitrary code via a crafted COM object from chtskdic.dll. Microsoft Internet Explorer versión 5.01 SP4 en Windows 2000 SP4; versión 6 SP1 en Windows 2000 SP4; versiones 6 y 7 en Windows XP SP2, o Windows Server 2003 SP... • http://secunia.com/advisories/23769 •
CVSS: 9.3EPSS: 57%CPEs: 43EXPL: 11CVE-2007-1765 – Microsoft Windows Explorer - '.ANI' File Denial of Service
https://notcve.org/view.php?id=CVE-2007-1765
30 Mar 2007 — Unspecified vulnerability in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code or cause a denial of service (persistent reboot) via a malformed ANI file, which results in memory corruption when processing cursors, animated cursors, and icons, a similar issue to CVE-2005-0416, as originally demonstrated using Internet Explorer 6 and 7. NOTE: this issue might be a duplicate of CVE-2007-0038; if so, then use CVE-2007-0038 instead of this identifier. Una vulnerabilidad n... • https://www.exploit-db.com/exploits/3684 •
CVSS: 8.1EPSS: 66%CPEs: 4EXPL: 1CVE-2007-1499 – Microsoft Internet Explorer 7 - NavCancel.HTM Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2007-1499
17 Mar 2007 — Microsoft Internet Explorer 7.0 on Windows XP and Vista allows remote attackers to conduct phishing attacks and possibly execute arbitrary code via a res: URI to navcancl.htm with an arbitrary URL as an argument, which displays the URL in the location bar of the "Navigation Canceled" page and injects the script into the "Refresh the page" link, aka Navigation Cancel Page Spoofing Vulnerability." Microsoft Internet Explorer versión 7.0 en Windows XP y Vista, permite a los atacantes remotos conducir ataques d... • https://www.exploit-db.com/exploits/29741 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 17%CPEs: 41EXPL: 3CVE-2006-7065 – Microsoft Internet Explorer 6.0/7.0 - IFrame Refresh Denial of Service
https://notcve.org/view.php?id=CVE-2006-7065
27 Feb 2007 — Microsoft Internet Explorer allows remote attackers to cause a denial of service (crash) via an IFRAME with a certain XML file and XSL stylesheet that triggers a crash in mshtml.dll when a refresh is called, probably a null pointer dereference. Microsoft Internet Explorer permite a atacantes remotos provocar denegación de servicio (caida) a través de un IFRAME con ciertos archivos XML y plantillas de estilo XSL que disparan una cauda en mshtml.dll cuando un se llama se solicita un refresco de cotenido, prob... • https://www.exploit-db.com/exploits/28343 •
CVSS: 6.1EPSS: 20%CPEs: 1EXPL: 0CVE-2007-1114
https://notcve.org/view.php?id=CVE-2007-1114
26 Feb 2007 — The child frames in Microsoft Internet Explorer 7 inherit the default charset from the parent window when a charset is not specified in an HTTP Content-Type header or META tag, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated using the UTF-7 character set. Los marcos hijo en Microsoft Internet Explorer 7 heredan el juego de caracteres de la ventana padre cuando un juego de caracteres no se ha especificado en una cabecera HTTP Content-Type o en una etiqueta META, l... • http://secunia.com/advisories/24314 •