CVSS: 5.0EPSS: 83%CPEs: 7EXPL: 0CVE-2015-1684 – Microsoft Windows VBScript Regular Expression Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2015-1684
VBScript.dll in the Microsoft VBScript 5.6 through 5.8 engine, as used in Internet Explorer 8 through 11 and other products, allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "VBScript ASLR Bypass." VBScript.dll en el motor Microsoft VBScript 5.6 hasta 5.8, utilizado en Internet Explorer 8 hasta 11 y otros productos, permite a atacantes remotos evadir el mecanismo de protección ASLR a través de un sitio web manipulado, también conocido como 'evasión de ASLR de VBScript.' This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The vulnerability relates to how VBScript processes capturing groups in regular expressions. By performing a search using a regular expression that has an unusual form, an attacker can reveal data stored in the memory of the current process. • http://www.securityfocus.com/bid/74522 http://www.securitytracker.com/id/1032282 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-043 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-053 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.3EPSS: 21%CPEs: 7EXPL: 0CVE-2015-0032
https://notcve.org/view.php?id=CVE-2015-0032
vbscript.dll in Microsoft VBScript 5.6 through 5.8, as used with Internet Explorer 8 through 11 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "VBScript Memory Corruption Vulnerability." vbscript.dll en Microsoft VBScript 5.6 hasta 5.8, utilizado con Internet Explorer 8 hasta 11 y otros productos, permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (corrupción de memoria) a través de un sitio web manipulado, también conocido como 'vulnerabilidad de corrupción de memoria de VBScript.' • http://www.securityfocus.com/bid/72910 http://www.securitytracker.com/id/1031887 http://www.securitytracker.com/id/1031888 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-018 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-019 • CWE-399: Resource Management Errors •
CVSS: 9.3EPSS: 90%CPEs: 9EXPL: 1CVE-2014-6363 – Microsoft Internet Explorer 8/9/10/11 / IIS / CScript.exe/WScript.exe VBScript - CRegExp..Execute Use of Uninitialized Memory (MS14-080/MS14-084)
https://notcve.org/view.php?id=CVE-2014-6363
vbscript.dll in Microsoft VBScript 5.6 through 5.8, as used with Internet Explorer 6 through 11 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "VBScript Memory Corruption Vulnerability." vbscript.dll en Microsoft VBScript 5.6 hasta 5.8, utilizado con Internet Explorer 6 hasta 11 y otros productos, permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (corrupción de memoria) a través de un sitio web manipulado, también conocido como 'Vulnerabilidad de la corrupción de memoria de VBScript'. A specially crafted script can cause the VBScript engine to access data before initializing it. An attacker that is able to run such a script in any application that embeds the VBScript engine may be able to control execution flow and execute arbitrary code. This includes all versions of Microsoft Internet Explorer. • https://www.exploit-db.com/exploits/40721 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-080 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-084 https://www.verisign.com/en_US/security-services/security-intelligence/vulnerability-reports/articles/index.xhtml?id=1075 • CWE-399: Resource Management Errors •
CVSS: 9.3EPSS: 93%CPEs: 9EXPL: 0CVE-2014-0271
https://notcve.org/view.php?id=CVE-2014-0271
The VBScript engine in Microsoft Internet Explorer 6 through 11, and VBScript 5.6 through 5.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "VBScript Memory Corruption Vulnerability." El motor VBScript en Microsoft Internet Explorer 6 hasta 11 y VBScript 5.6 hasta 5.8, permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (corrupción de memoria) a través de un sitio web manipulado, también conocido como "VBScript Memory Corruption Vulnerability." • http://osvdb.org/103166 http://secunia.com/advisories/56796 http://secunia.com/advisories/56814 http://www.securityfocus.com/bid/65395 http://www.securitytracker.com/id/1029741 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-010 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-011 https://exchange.xforce.ibmcloud.com/vulnerabilities/90757 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 82%CPEs: 36EXPL: 0CVE-2011-0663
https://notcve.org/view.php?id=CVE-2011-0663
Multiple integer overflows in the Microsoft (1) JScript 5.6 through 5.8 and (2) VBScript 5.6 through 5.8 scripting engines allow remote attackers to execute arbitrary code via a crafted web page, aka "Scripting Memory Reallocation Vulnerability." Múltiples desbordamientos de enteros en los motores de secuencias de comandos (1) JScript v5.6 a la v5.8 y(2) VBScript v5.6 a la v5.8, permite a atacantes remotos ejecutar código de su elección a través de una página web manipulada. También conocida como "Scripting Memory Reallocation Vulnerability." • http://osvdb.org/71774 http://secunia.com/advisories/44162 http://www.securityfocus.com/bid/47249 http://www.securitytracker.com/id?1025333 http://www.us-cert.gov/cas/techalerts/TA11-102A.html http://www.vupen.com/english/advisories/2011/0949 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-031 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12673 • CWE-189: Numeric Errors •