CVSS: 9.8EPSS: 54%CPEs: 44EXPL: 0CVE-2009-0550
https://notcve.org/view.php?id=CVE-2009-0550
15 Apr 2009 — Windows HTTP Services (aka WinHTTP) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008; and WinINet in Microsoft Internet Explorer 5.01 SP4, 6 SP1, 6 and 7 on Windows XP SP2 and SP3, 6 and 7 on Windows Server 2003 SP1 and SP2, 7 on Windows Vista Gold and SP1, and 7 on Windows Server 2008; allows remote web servers to capture and replay NTLM credentials, and execute arbitrary code, via vectors related to absence of a "credential-reflection protections"... • http://blogs.technet.com/srd/archive/2009/04/14/ntlm-credential-reflection-updates-for-http-clients.aspx •
CVSS: 9.3EPSS: 86%CPEs: 28EXPL: 0CVE-2009-0551
https://notcve.org/view.php?id=CVE-2009-0551
15 Apr 2009 — Microsoft Internet Explorer 6 SP1, 6 and 7 on Windows XP SP2 and SP3, 6 and 7 on Windows Server 2003 SP1 and SP2, 7 on Windows Vista Gold and SP1, and 7 on Windows Server 2008 does not properly handle transition errors in a request for one HTTP document followed by a request for a second HTTP document, which allows remote attackers to execute arbitrary code via vectors involving (1) multiple crafted pages on a web site or (2) a web page with crafted inline content such as banner advertisements, aka "Page Tr... • http://osvdb.org/53624 • CWE-399: Resource Management Errors •
CVSS: 9.3EPSS: 82%CPEs: 12EXPL: 0CVE-2009-0552
https://notcve.org/view.php?id=CVE-2009-0552
15 Apr 2009 — Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4, 6 SP1, 6 on Windows XP SP2 and SP3, and 6 on Windows Server 2003 SP1 and SP2 allows remote attackers to execute arbitrary code via a web page that triggers presence of an object in memory that was (1) not properly initialized or (2) deleted, aka "Uninitialized Memory Corruption Vulnerability." Vulnerabilidad no especificada en Microsoft Internet Explorer 5.01 SP4, 6 SP1, 6 en Windows XP SP2 y SP3, y 6 en Windows Server 2003 SP1 y SP2 permite... • http://osvdb.org/53625 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.3EPSS: 47%CPEs: 29EXPL: 0CVE-2009-0554
https://notcve.org/view.php?id=CVE-2009-0554
15 Apr 2009 — Microsoft Internet Explorer 5.01 SP4, 6 SP1, 6 and 7 on Windows XP SP2 and SP3, 6 and 7 on Windows Server 2003 SP1 and SP2, 7 on Windows Vista Gold and SP1, and 7 on Windows Server 2008 allows remote attackers to execute arbitrary code via a web page that triggers presence of an object in memory that was (1) not properly initialized or (2) deleted, aka "Uninitialized Memory Corruption Vulnerability." Microsoft Internet Explorer v5.01 SP4, v6 SP1, v6 y v7 en Windows XP SP2 y SP3, v6 y v7 en Windows Server 20... • http://secunia.com/advisories/34678 • CWE-399: Resource Management Errors •
CVSS: 9.3EPSS: 96%CPEs: 13EXPL: 6CVE-2009-0075 – Microsoft Internet Explorer CFunctionPointer Memory Corruption Vulnerability
https://notcve.org/view.php?id=CVE-2009-0075
10 Feb 2009 — Microsoft Internet Explorer 7 does not properly handle errors during attempted access to deleted objects, which allows remote attackers to execute arbitrary code via a crafted HTML document, related to CFunctionPointer and the appending of document objects, aka "Uninitialized Memory Corruption Vulnerability." Microsoft Internet Explorer 7 no maneja adecuadamente los errores durante un intento de acceso a los objetos eliminados, esto permite a atacantes remotos ejecutar código de su elección a través de un d... • https://www.exploit-db.com/exploits/8077 • CWE-399: Resource Management Errors •
CVSS: 9.3EPSS: 54%CPEs: 14EXPL: 4CVE-2009-0076 – Microsoft Internet Explorer Malformed CSS Memory Corruption Vulnerability
https://notcve.org/view.php?id=CVE-2009-0076
10 Feb 2009 — Microsoft Internet Explorer 7, when XHTML strict mode is used, allows remote attackers to execute arbitrary code via the zoom style directive in conjunction with unspecified other directives in a malformed Cascading Style Sheets (CSS) stylesheet in a crafted HTML document, aka "CSS Memory Corruption Vulnerability." Microsoft Internet Explorer 7, cuando usamos XHTML en modo estricto, permite a atacantes remotos ejecutar código de su elección a través de la directiva "zoom style" en conjunción con otras direc... • https://www.exploit-db.com/exploits/8082 • CWE-399: Resource Management Errors •
CVSS: 4.3EPSS: 5%CPEs: 1EXPL: 1CVE-2009-0369 – Microsoft Internet Explorer 7 - Clickjacking
https://notcve.org/view.php?id=CVE-2009-0369
30 Jan 2009 — Microsoft Internet Explorer 7 allows remote attackers to trick a user into visiting an arbitrary URL via an onclick action that moves a crafted element to the current mouse position, related to a "Clickjacking" vulnerability. Microsoft Internet Explorer 7 permite a los atacantes remotos engañar a los usuarios que visitan arbitrariamente una URL a través de una acción onclick que mueva un elemento manipulado a la posición actual del ratón, en relación a una vulnerabilidad "Clickjacking". • https://www.exploit-db.com/exploits/7912 •
CVSS: 9.8EPSS: 21%CPEs: 2EXPL: 1CVE-2009-0341 – Microsoft Internet Explorer 7 - HTML Form Value Denial of Service
https://notcve.org/view.php?id=CVE-2009-0341
29 Jan 2009 — The shell32 module in Microsoft Internet Explorer 7.0 on Windows XP SP3 might allow remote attackers to execute arbitrary code via a long VALUE attribute in an INPUT element, possibly related to a stack consumption vulnerability. El módulo shell32 en Microsoft Internet Explorer v7.0 en Windows XP SP3 permitiría a atacantes remotos ejecutar código a su elección a través de un atributo largo VALUE en un elemento INPUT, relacionado posiblemente con la vulnerabilidad de vaciado de pila. • https://www.exploit-db.com/exploits/32763 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 1CVE-2009-0072
https://notcve.org/view.php?id=CVE-2009-0072
08 Jan 2009 — Microsoft Internet Explorer 6.0 through 8.0 beta2 allows remote attackers to cause a denial of service (application crash) via an onload=screen[""] attribute value in a BODY element. Microsoft Internet Explorer 6.0 hasta 8.0 beta2 permite a atacantes remotos provocar una denegación de servicio (caída de aplicación) a través del valor del atributo onload=screen[""] en un elemento "BODY". • http://skypher.com/index.php/2009/01/07/msie-screen-null-ptr-dos-details •
CVSS: 9.3EPSS: 0%CPEs: 3EXPL: 0CVE-2008-5522
https://notcve.org/view.php?id=CVE-2008-5522
12 Dec 2008 — AVG Anti-Virus 8.0.0.161, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit. AVG Anti-Virus v8.0.0.161, cuando se utiliza Internet Explorer 6 o 7, permite a atacantes remotos eludir la detección de malware en un documento HT... • http://securityreason.com/securityalert/4723 • CWE-20: Improper Input Validation •