CVSS: 7.6EPSS: 96%CPEs: 20EXPL: 2CVE-2016-0189 – Microsoft Internet Explorer Memory Corruption Vulnerability
https://notcve.org/view.php?id=CVE-2016-0189
The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0187. Los motores Microsoft (1) JScript 5.8 y (2) VBScript 5.7 y 5.8, según se utilizan en Internet Explorer 9 hasta la versión 11 y otros productos, permiten a atacantes remotos ejecutar código arbitrario o provocar una denegación de servicio (corrupción de memoria) a través de un sitio web manipulado, también conocido como "Scripting Engine Memory Corruption Vulnerability", una vulnerabilidad diferente a CVE-2016-0187. The Microsoft JScript nd VBScript engines, as used in Internet Explorer and other products, allow attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site. • https://www.exploit-db.com/exploits/40118 http://www.securityfocus.com/bid/90012 http://www.securitytracker.com/id/1035820 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-051 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-053 https://www.virusbulletin.com/virusbulletin/2017/01/journey-and-evolution-god-mode-2016-cve-2016-0189 • CWE-787: Out-of-bounds Write •
CVSS: 7.6EPSS: 76%CPEs: 8EXPL: 0CVE-2016-0002
https://notcve.org/view.php?id=CVE-2016-0002
The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, allow remote attackers to execute arbitrary code via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability." Los motores Microsoft (1) VBScript 5.7 y 5.8 y (2) JScript 5.7 y 5.8, como se utilizan en Internet Explorer 8 hasta la versión 11 y otros productos, permiten a atacantes remotos ejecutar código arbitrario a través de un sitio web manipulado, también conocido como "Scripting Engine Memory Corruption Vulnerability". • http://www.securitytracker.com/id/1034648 http://www.securitytracker.com/id/1034650 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-001 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-003 https://www.verisign.com/en_US/security-services/security-intelligence/vulnerability-reports/articles/index.xhtml?id=1215 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.0EPSS: 7%CPEs: 8EXPL: 0CVE-2015-6135 – Microsoft Windows VBScript CreateObject Function Use-After-Free Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2015-6135
The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Scripting Engine Information Disclosure Vulnerability." Los motores de Microsoft (1) VBScript 5.7 y 5.8 y (2) JScript 5.7 y 5.8, como se utilizan en Internet Explorer 8 hasta la versión 11 y otros productos, permiten a atacantes remotos obtener información sensible de la memoria de proceso a través de un sitio web manipulado, también conocida como 'Scripting Engine Information Disclosure Vulnerability'. This vulnerability allows remote attackers to disclose the contents of memory on applications using the VBScript scripting language on vulnerable installations of Microsoft Windows. Microsoft Internet Explorer is an affected application. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the implementation of the VBScript CreateObject function. • http://www.securitytracker.com/id/1034315 http://www.securitytracker.com/id/1034317 http://www.zerodayinitiative.com/advisories/ZDI-15-586 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-124 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-126 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.3EPSS: 91%CPEs: 8EXPL: 0CVE-2015-6136 – Microsoft Windows VBScript Split Function Use-After-Free Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2015-6136
The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, allow remote attackers to execute arbitrary code via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability." Los motores de Microsoft (1) VBScript 5.7 y 5.8 y (2) JScript 5.7 y 5.8, como se utilizan en Internet Explorer 8 hasta la versión 11 y otros productos, permiten a atacantes remotos ejecutar código arbitrario a través de un sitio web manipulado, también conocida como 'Scripting Engine Memory Corruption Vulnerability'. This vulnerability allows remote attackers to disclose the contents of memory on applications using the VBScript scripting language on vulnerable installations of Microsoft Windows. Microsoft Internet Explorer is an affected application. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the implementation of the VBScript Split function. • http://www.securitytracker.com/id/1034315 http://www.securitytracker.com/id/1034317 http://www.zerodayinitiative.com/advisories/ZDI-15-591 http://www.zerodayinitiative.com/advisories/ZDI-15-592 http://www.zerodayinitiative.com/advisories/ZDI-15-593 http://www.zerodayinitiative.com/advisories/ZDI-15-594 http://www.zerodayinitiative.com/advisories/ZDI-15-595 http://www.zerodayinitiative.com/advisories/ZDI-15-597 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-124 https • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 85%CPEs: 6EXPL: 0CVE-2015-6089
https://notcve.org/view.php?id=CVE-2015-6089
The Microsoft (1) VBScript and (2) JScript engines, as used in Internet Explorer 8 through 11, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability." Los motores Microsoft (1) VBScript y (2) JScript, como se usan en Internet Explorer 8 hasta la versión 11, permiten a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (corrupción de memoria) a través de una página web manipulada, también conocida como 'Scripting Engine Memory Corruption Vulnerability'. • http://www.securitytracker.com/id/1034112 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-112 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •