CVSS: 9.3EPSS: 87%CPEs: 5EXPL: 0CVE-2013-3199 – Microsoft Internet Explorer Undo Command Use-After-Free Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2013-3199
Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." Microsoft Internet Explorer 6 hasta 10 permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (corrupción de memoria) a través de un sitio web malicioso, también conocido como "Internet Explorer Memory Corruption Vulnerability”. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the Undo command. Executing undo can force Internet Explorer to free an object resulting in a use-after-free condition. • http://www.us-cert.gov/ncas/alerts/TA13-225A https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-059 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18203 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.9EPSS: 0%CPEs: 5EXPL: 1CVE-2013-4015 – Microsoft Internet Explorer - CAnchorElement Use-After-Free (MS13-055)
https://notcve.org/view.php?id=CVE-2013-4015
Microsoft Internet Explorer 6 through 10 allows local users to bypass the elevation policy check in the (1) Protected Mode or (2) Enhanced Protected Mode protection mechanism, and consequently gain privileges, by leveraging the ability to execute sandboxed code. Microsoft Internet Explorer v6 hasta v10 permite a usuarios locales evitar el chequeo de la politica de elevación de permisos en los mecanismos de protección (1) Protected Mode o (2) Enhanced Protected Mode, y consecuentemente obtener privilegios, haciendo uso de la capacidad de ejecutar código en la sandbox. • https://www.exploit-db.com/exploits/28187 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-055 https://exchange.xforce.ibmcloud.com/vulnerabilities/85762 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.3EPSS: 86%CPEs: 4EXPL: 1CVE-2013-3147 – Microsoft Internet Explorer BubbleBecomeCurrent Use-After-Free Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2013-3147
Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." Microsoft Internet Explorer 6 hasta 9 permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (corrupción de memoria) a través de un sitio web malicioso, también conocido como "Internet Explorer Memory Corruption Vulnerability". This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the onbeforeeditfocus event. This event object can be freed and referenced by BubbleBecomeCurrent afterwards. • https://www.exploit-db.com/exploits/28187 http://www.us-cert.gov/ncas/alerts/TA13-190A https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-055 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16966 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.3EPSS: 86%CPEs: 5EXPL: 1CVE-2013-3153 – Microsoft Internet Explorer RemoveSplice Use-After-Free Remote Code Execution Vulnerabliity
https://notcve.org/view.php?id=CVE-2013-3153
Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3148. Microsoft Internet Explorer 6 hasta 10 permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (corrupción de memoria) a través de un sitio web malicioso, también conocido como "Internet Explorer Memory Corruption Vulnerability", una vulnerabilidad diferente a CVE-2013-3148. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the onpropertychange event handler. By manipulating a document's elements an attacker can force a dangling pointer to be reused after it has been freed. • https://www.exploit-db.com/exploits/28187 http://www.us-cert.gov/ncas/alerts/TA13-190A https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-055 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16927 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.3EPSS: 86%CPEs: 5EXPL: 1CVE-2013-3148 – Microsoft Internet Explorer CMshtmlEd Use-After-Free Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2013-3148
Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3153. Microsoft Internet Explorer 6 hasta 10 permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (corrupción de memoria) a través de un sitio web malicioso, también conocido como "Internet Explorer Memory Corruption Vulnerability", una vulnerabilidad diferente a CVE-2013-3153. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the usage of CMshtmlEd object. This object can be freed and used afterwards by an execCommand edit function within a timer function. • https://www.exploit-db.com/exploits/28187 http://www.us-cert.gov/ncas/alerts/TA13-190A https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-055 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17034 • CWE-94: Improper Control of Generation of Code ('Code Injection') •