CVSS: 9.3EPSS: 23%CPEs: 3EXPL: 0CVE-2016-3211 – Microsoft Internet Explorer PerformDoDragDrop Protected Mode Sandbox Escape Vulnerability
https://notcve.org/view.php?id=CVE-2016-3211
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0199 and CVE-2016-0200. Microsoft Internet Explorer 9 hasta la versión 11 permite a atacantes remotos ejecutar código arbitrarios o provocar una denegación de servicio (corrupción de memoria) a través de un sitio web manipulado, también conocida como "Internet Explorer Memory Corruption Vulnerability", una vulnerabilidad diferente a CVE-2016-0199 y CVE-2016-0200. This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the usage of the method IShdocvwBroker::PerformDoDragDrop. An attacker who has gained code execution within the Internet Explorer Protected Mode sandbox can leverage this method to place a malicious executable file in any location to which the user has write access. • http://www.securitytracker.com/id/1036096 http://www.zerodayinitiative.com/advisories/ZDI-16-366 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-063 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 23%CPEs: 3EXPL: 0CVE-2016-0200 – Microsoft Internet Explorer s_DestroyLinkCallback Use-After-Free Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2016-0200
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0199 and CVE-2016-3211. Microsoft Internet Explorer 9 hasta la versión 11 permite a atacantes remotos ejecutar código arbitrario o provocar una denegación de servicio (corrupción de memoria) a través de un sitio web manipulado, también conocida como "Internet Explorer Memory Corruption Vulnerability", una vulnerabilidad diferente a CVE-2016-0199 y CVE-2016-3211. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The vulnerability relates to how Internet Explorer keeps track of linked web resources. By manipulating a document's elements, an attacker can cause Internet Explorer to use an array address after the array has been relocated elsewhere in memory. • http://www.securitytracker.com/id/1036096 http://www.zerodayinitiative.com/advisories/ZDI-16-365 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-063 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.6EPSS: 34%CPEs: 5EXPL: 0CVE-2016-0187
https://notcve.org/view.php?id=CVE-2016-0187
The Microsoft (1) JScript 5.8 and (2) VBScript 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0189. Los motores Microsoft (1) JScript 5.8 y (2) VBScript 5.8, según se utilizan en Internet Explorer 9 hasta la versión 11 y otros productos, permiten a atacantes remotos ejecutar código arbitrario o provocar una denegación de servicio (corrupción de memoria) a través de un sitio web manipulado, también conocido como "Scripting Engine Memory Corruption Vulnerability", una vulnerabilidad diferente a CVE-2016-0189. • http://www.securityfocus.com/bid/90011 http://www.securitytracker.com/id/1035820 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-051 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-053 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.6EPSS: 96%CPEs: 20EXPL: 2CVE-2016-0189 – Microsoft Internet Explorer Memory Corruption Vulnerability
https://notcve.org/view.php?id=CVE-2016-0189
The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0187. Los motores Microsoft (1) JScript 5.8 y (2) VBScript 5.7 y 5.8, según se utilizan en Internet Explorer 9 hasta la versión 11 y otros productos, permiten a atacantes remotos ejecutar código arbitrario o provocar una denegación de servicio (corrupción de memoria) a través de un sitio web manipulado, también conocido como "Scripting Engine Memory Corruption Vulnerability", una vulnerabilidad diferente a CVE-2016-0187. The Microsoft JScript nd VBScript engines, as used in Internet Explorer and other products, allow attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site. • https://www.exploit-db.com/exploits/40118 http://www.securityfocus.com/bid/90012 http://www.securitytracker.com/id/1035820 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-051 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-053 https://www.virusbulletin.com/virusbulletin/2017/01/journey-and-evolution-god-mode-2016-cve-2016-0189 • CWE-787: Out-of-bounds Write •
CVSS: 7.6EPSS: 76%CPEs: 4EXPL: 0CVE-2016-0192 – Microsoft Internet Explorer AcquireLineBoxBuilderForLayout Null Array Base Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2016-0192
Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability." Microsoft Internet Explorer 9 hasta la versión 11 y Microsoft Edge permiten a atacantes remotos ejecutar código arbitrario o provocar una denegación de servicio (corrupción de memoria) a través de un sitio web manipulado, también conocido como "Microsoft Browser Memory Corruption Vulnerability". This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The vulnerability relates to how Internet Explorer performs layout of web pages. By manipulating a document's elements an attacker can cause Internet Explorer to use a null pointer as the base address of an array read. • http://www.securityfocus.com/bid/90007 http://www.securitytracker.com/id/1035820 http://www.securitytracker.com/id/1035821 http://www.zerodayinitiative.com/advisories/ZDI-16-276 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-051 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-052 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •