CVSS: 7.6EPSS: 14%CPEs: 18EXPL: 1CVE-2019-0667 – Microsoft Windows VBScript Array Uninitialized Pointer Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2019-0667
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0665, CVE-2019-0666, CVE-2019-0772. Existe una vulnerabilidad de ejecución de código remota en la manera en que el motor VBScript maneja los objetos en la memoria, también se conoce como "Windows VBScript Engine Remote Code Execution Vulnerability". Este ID de CVE es diferente de los CVE-2019-0665, CVE-2019-0666, CVE-2019-0772. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft VBScript. • https://www.exploit-db.com/exploits/46568 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0667 • CWE-787: Out-of-bounds Write •
CVSS: 4.3EPSS: 96%CPEs: 5EXPL: 1CVE-2019-0768 – Microsoft Internet Explorer 11 - VBScript Execution Policy Bypass in MSHTML
https://notcve.org/view.php?id=CVE-2019-0768
A security feature bypass vulnerability exists when Internet Explorer VBScript execution policy does not properly restrict VBScript under specific conditions, and to allow requests that should otherwise be ignored, aka 'Internet Explorer Security Feature Bypass Vulnerability'. This CVE ID is unique from CVE-2019-0761. Se presenta una vulnerabilidad de omisión de la característica de seguridad cuando la política de ejecución de VBScript de Internet Explorer no restringe apropiadamente VBScript bajo condiciones específicas y permite peticiones que de otro modo deberían ser ignoradas, también conocidas como " Internet Explorer Security Feature Bypass Vulnerability”. Este ID de CVE es diferente de CVE-2019-0761. MSHTML only checks for the CLSID associated with VBScript when blocking in the Internet Zone, but doesn't check other VBScript CLSIDs which allow a web page to bypass the security zone policy. • https://www.exploit-db.com/exploits/46567 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0768 • CWE-20: Improper Input Validation •
CVSS: 7.6EPSS: 4%CPEs: 16EXPL: 0CVE-2019-0665 – Microsoft Internet Explorer Attr nodeValue Use-After-Free Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2019-0665
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0666, CVE-2019-0667, CVE-2019-0772. Se presenta una vulnerabilidad de ejecución de código remota en la manera en que el motor VBScript maneja los objetos en la memoria, también se conoce como "Vulnerabilidad de ejecución de código remota en el motor VBScript de Windows". Este ID de CVE es diferente de los CVE-2019-0666, CVE-2019-0667, CVE-2019-0772. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0665 • CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 13%CPEs: 28EXPL: 0CVE-2019-0746 – Microsoft Chakra lastIndexOf Integer Underflow Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2019-0746
An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft Edge, aka 'Scripting Engine Information Disclosure Vulnerability'. Una vulnerabilidad de divulgación de información existe cuando el motor de scripting no maneja adecuadamente los objetos en memoria en Microsoft Edge, también conocido como 'Scripting Engine Information Disclosure Vulnerability'. This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Microsoft Chakra. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the implementation of the lastIndexOf method in JavaScript. By performing actions in JavaScript, an attacker can trigger an integer underflow before reading memory. • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0746 •
CVSS: 6.5EPSS: 1%CPEs: 15EXPL: 0CVE-2019-0676 – Microsoft Internet Explorer Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2019-0676
An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory.An attacker who successfully exploited this vulnerability could test for the presence of files on disk, aka 'Internet Explorer Information Disclosure Vulnerability'. Existe una vulnerabilidad de divulgación de información cuando Internet Explorer gestiona inadecuadamente los objetos en la memoria. Un atacante que explote con éxito esta vulnerabilidad podría averiguar si existen archivos en el disco. Esto también se conoce como "Internet Explorer Information Disclosure Vulnerability'. An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory. • http://www.securityfocus.com/bid/106886 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0676 •