CVSS: 5.3EPSS: 23%CPEs: 4EXPL: 0CVE-2016-3273
https://notcve.org/view.php?id=CVE-2016-3273
The XSS Filter in Microsoft Internet Explorer 9 through 11 and Microsoft Edge does not properly restrict JavaScript code, which allows remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability." El XSS Filter en Microsoft Internet Explorer 9 hasta la versión 11 y Microsoft Edge no restringe correctamente código JavaScript, lo que permite a atacantes remotos obtener información sensible a través de un sitio web manipulado, también conocida como "Microsoft Browser Information Disclosure Vulnerability". • http://www.securityfocus.com/bid/91576 http://www.securitytracker.com/id/1036283 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-084 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-085 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.6EPSS: 19%CPEs: 3EXPL: 0CVE-2016-3241 – Microsoft Internet Explorer CTableRowCellsCollectionCacheItem Out-Of-Bounds Read Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2016-3241
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3240 and CVE-2016-3242. Microsoft Internet Explorer 9 hasta la versión 11 permite a atacantes remotos ejecutar código arbitrario o provocar una denegación de servicio (corrupción de memoria) a través de un sitio web manipulado, también conocida como "Internet Explorer Memory Corruption Vulnerability", una vulnerabilidad diferente a CVE-2016-3240 y CVE-2016-3242. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The vulnerability relates to how Internet Explorer keeps track of table rows when performing layout of HTML tables. By manipulating a document's elements, an attacker can cause Internet Explorer to read beyond the end of an array of pointers to CTableCell objects. • http://www.securityfocus.com/bid/91569 http://www.securitytracker.com/id/1036283 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-084 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.6EPSS: 19%CPEs: 3EXPL: 0CVE-2016-3242 – Microsoft Internet Explorer CTableLayout AddRow Out-Of-Bounds Read Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2016-3242
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3240 and CVE-2016-3241. Microsoft Internet Explorer 9 hasta la versión 11 permite a atacantes remotos ejecutar código arbitrario o provocar una denegación de servicio (corrupción de memoria) a través de un sitio web manipulado, también conocida como "Internet Explorer Memory Corruption Vulnerability", una vulnerabilidad diferente a CVE-2016-3240 y CVE-2016-3241. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The vulnerability relates to how Internet Explorer keeps track of table rows when performing layout of HTML tables. By manipulating a document's elements an attacker can cause Internet Explorer to read beyond the end of an array of pointers to CTableRow objects. • http://www.securityfocus.com/bid/91570 http://www.securitytracker.com/id/1036283 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-084 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.6EPSS: 25%CPEs: 4EXPL: 0CVE-2016-3264 – Microsoft Edge CGeolocationManager Use-After-Free Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2016-3264
Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability." Microsoft Internet Explorer 9 hasta la versión 11 y Microsoft Edge permiten a atacantes remotos ejecutar código arbitrario o provocar una denegación de servicio (corrupción de memoria) a través de un sitio web manipulado, también conocida como "Microsoft Browser Memory Corruption Vulnerability". This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Edge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The vulnerability relates to how Microsoft Edge requests permission from the user to allow a website to access device location information (for example, GPS). By performing certain actions in script, an attacker can force a CGeolocationManager object in memory to be reused after it has been freed. • http://www.securityfocus.com/bid/91598 http://www.securitytracker.com/id/1036283 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-084 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-085 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.6EPSS: 11%CPEs: 6EXPL: 0CVE-2016-3205
https://notcve.org/view.php?id=CVE-2016-3205
The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3206 and CVE-2016-3207. Los motores de Microsoft (1) JScript 5.8 y (2) VBScript 5.7 y 5.8, tal como se utilizan en Internet Explorer 9 hasta la versión 11 y otros productos, permiten a atacantes remotos ejecutar código arbitrario o provocar una denegación de servicio (corrupción de memoria) a través de un sitio web manipulado, también conocida como "Scripting Engine Memory Corruption Vulnerability", una vulnerabilidad diferente a CVE-2016-3206 y CVE-2016-3207. • http://www.securitytracker.com/id/1036096 http://www.securitytracker.com/id/1036097 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-063 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-069 • CWE-20: Improper Input Validation CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •