CVSS: 9.3EPSS: 93%CPEs: 26EXPL: 0CVE-2011-1963 – Microsoft Internet Explorer XSLT SetViewSlave Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2011-1963
Microsoft Internet Explorer 7 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, aka "XSLT Memory Corruption Vulnerability." Microsoft Internet Explorer 7 hasta 9 no maneja adecuadamente objetos en memoria, lo que permite a atacantes remotos ejecutar código de su elección accediendo a objetos que (1) no fueron inicializados correctamente o (2) es eliminado, también conocido como "vulnerabilidad XSLT Memory Corruption". This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the part of the application that is responsible for reloading the markup for a root document object. During reloading of the markup, the application will dispatch a notification whilst retaining a reference to the object in the function's context. • http://www.us-cert.gov/cas/techalerts/TA11-221A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-057 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12753 • CWE-908: Use of Uninitialized Resource •
CVSS: 9.3EPSS: 93%CPEs: 30EXPL: 0CVE-2011-1964 – Microsoft Internet Explorer 9 STYLE Object Parsing Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2011-1964
Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, aka "Style Object Memory Corruption Vulnerability." Microsoft Internet Explorer 6 hasta la versión 9 no maneja apropiadamente objetos en memoria, lo que permite a atacantes remotos ejecutar código arbitrario accediendo a un objeto que (1) no fue apropiadamente inicializado o (2) ha sido borrado. También conocida como "vulnerabilidad de corrupcción de memoria de objeto de estilo". This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the part of the application that is responsible for handling STYLE elements. • http://www.us-cert.gov/cas/techalerts/TA11-221A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-057 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12617 • CWE-908: Use of Uninitialized Resource •
CVSS: 7.2EPSS: 0%CPEs: 17EXPL: 0CVE-2011-1881
https://notcve.org/view.php?id=CVE-2011-1881
win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that triggers a NULL pointer dereference, a different vulnerability than other CVEs listed in MS11-054, aka "Win32k Null Pointer De-reference Vulnerability." win32k.sys en los controladores de modo kernel de Microsoft Windows XP SP2 y SP3, Windows Server 2003 SP2, Windows Vista SP1 y SP2, Windows Server 2008 Gold, Service Pack 2, R2 y R2 SP1, y Windows 7 Gold SP1 permite a usuarios locales obtener privilegios a través de una aplicación diseñada que provoca un a desreferencia puntero a Nulo, una vulnerabilidad diferente a los CVE enumerados en MS11-054, también conocido como "Vulnerabilidad de desreferencia a puntero nulo en Win32k. " • http://osvdb.org/73787 http://secunia.com/advisories/45186 http://support.avaya.com/css/P8/documents/100144947 http://www.securityfocus.com/bid/48599 http://www.securitytracker.com/id?1025761 http://www.us-cert.gov/cas/techalerts/TA11-193A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-054 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12851 •
CVSS: 7.2EPSS: 0%CPEs: 17EXPL: 0CVE-2011-1883
https://notcve.org/view.php?id=CVE-2011-1883
Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that leverages incorrect driver object management, a different vulnerability than other CVEs listed in MS11-054, aka "Win32k Use After Free Vulnerability." Vulnerabilidad de uso después de la liberación en win32k.sys en los controladores de modo kernel de Microsoft Windows XP SP2 y SP3, Windows Server 2003 SP2, Windows Vista SP1 y SP2, Windows Server 2008 Gold, Service Pack 2, R2 y R2 SP1, y Windows 7 Gold SP1, permite a atacantes locales producir una denegación de servicio (caída de aplicación) o posiblemente ejecutar código arbitrario mediante una aplicación manipulada que aprovecha la gestión incorrecta objeto controlador, una vulnerabilidad diferente a los CVE enumerados en MS11-054, también conocido como " uso después de la liberación en Win32k". • http://osvdb.org/73783 http://secunia.com/advisories/45186 http://support.avaya.com/css/P8/documents/100144947 http://www.securityfocus.com/bid/48595 http://www.securitytracker.com/id?1025761 http://www.us-cert.gov/cas/techalerts/TA11-193A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-054 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12721 • CWE-399: Resource Management Errors •
CVSS: 7.2EPSS: 0%CPEs: 17EXPL: 0CVE-2011-1874
https://notcve.org/view.php?id=CVE-2011-1874
Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that leverages incorrect driver object management, a different vulnerability than other CVEs listed in MS11-054, aka "Win32k Use After Free Vulnerability." Vulnerabilidad de uso después de liberación en los controladores kernel-mode en Microsoft Windows XP SP2 y SP3, Windows Server 2003 SP2, Windows Vista SP1 y SP2, Windows Server 2008 Gold, SP2, R2, y R2 SP1, y Windows 7 Gold y SP1 , permite a usuarios locales conseguir privilegios a través de una aplicación diseñada para aprovechar el manejo incorrecto de objetos del controlador, una vulnerabilidad diferente a los CVE enumerados en MS11-054, también conocido como "Vulnerabilidad de uso después de la liberación en Win32k". • http://osvdb.org/73777 http://secunia.com/advisories/45186 http://support.avaya.com/css/P8/documents/100144947 http://www.securityfocus.com/bid/48587 http://www.securitytracker.com/id?1025761 http://www.us-cert.gov/cas/techalerts/TA11-193A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-054 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12585 • CWE-399: Resource Management Errors •