CVSS: 9.3EPSS: 1%CPEs: 2EXPL: 0CVE-2007-4356
https://notcve.org/view.php?id=CVE-2007-4356
15 Aug 2007 — Microsoft Internet Explorer 6 and 7 embeds FTP credentials in HTML files that are retrieved during an FTP session, which allows context-dependent attackers to obtain sensitive information by reading the HTML source, as demonstrated by a (1) .htm, (2) .html, or (3) .mht file. Microsoft Internet Explorer 6 y 7 incrusta credenciales FTP en los archivos HTML que se obtienen durante una sesión FTP, lo cual permite a atacantes locales o remotos (dependiendo del contexto) obtener información sensible leyendo la fu... • http://blog.washingtonpost.com/securityfix/2007/08/ftp_files_expose_web_site_cred.html •
CVSS: 9.8EPSS: 92%CPEs: 3EXPL: 1CVE-2007-1749 – Microsoft Internet Explorer 5.0.1 - Vector Markup Language 'VGX.dll' Remote Buffer Overflow
https://notcve.org/view.php?id=CVE-2007-1749
14 Aug 2007 — Integer underflow in the CDownloadSink class code in the Vector Markup Language (VML) component (VGX.DLL), as used in Internet Explorer 5.01, 6, and 7 allows remote attackers to execute arbitrary code via compressed content with an invalid buffer size, which triggers a heap-based buffer overflow. Desbordamiento de entero en CDownloadSink class code en el componente de Lenguaje de Marcado Vectoria (VML) (VGX.DLL), como el utilizado en Internet Explorer 5.01, 6, y 7 permite a atacantes remotos ejecutar código... • https://www.exploit-db.com/exploits/30494 •
CVSS: 9.3EPSS: 95%CPEs: 3EXPL: 1CVE-2007-2216 – Microsoft Internet Explorer 5.0.1 - 'TBLinf32.dll' ActiveX Control Remote Code Execution
https://notcve.org/view.php?id=CVE-2007-2216
14 Aug 2007 — The tblinf32.dll (aka vstlbinf.dll) ActiveX control for Internet Explorer 5.01, 6 SP1, and 7 uses an incorrect IObjectsafety implementation, which allows remote attackers to execute arbitrary code by requesting the HelpString property, involving a crafted DLL file argument to the TypeLibInfoFromFile function, which overwrites the HelpStringDll property to call the DLLGetDocumentation function in another DLL file, aka "ActiveX Object Vulnerability." El control ActiveX de la biblioteca tblinf32.dll (también c... • https://www.exploit-db.com/exploits/30490 • CWE-16: Configuration •
CVSS: 9.3EPSS: 89%CPEs: 3EXPL: 0CVE-2007-3041
https://notcve.org/view.php?id=CVE-2007-3041
14 Aug 2007 — Unspecified vulnerability in the pdwizard.ocx ActiveX object for Internet Explorer 5.01, 6 SP1, and 7 allows remote attackers to execute arbitrary code via unknown vectors related to Microsoft Visual Basic 6 objects and memory corruption, aka "ActiveX Object Memory Corruption Vulnerability." Una vulnerabilidad no especificada en el objeto ActiveX del archivo pdwizard.ocx para Internet Explorer versiones 5.01, 6 SP1 y 7, permite a atacantes remotos ejecutar código arbitrario por medio de vectores de ataque d... • http://secunia.com/advisories/26419 •
CVSS: 5.5EPSS: 1%CPEs: 2EXPL: 1CVE-2007-4227
https://notcve.org/view.php?id=CVE-2007-4227
08 Aug 2007 — Microsoft Windows Explorer (explorer.exe) allows user-assisted remote attackers to cause a denial of service via a certain JPG file, as demonstrated by something.jpg. NOTE: this issue might be related to CVE-2007-3958. Microsoft Windows Explorer (explorer.exe) permite a atacantes remotos con la complicidad del usuario provocar una denegación de servicio mediante cierto fichero JPG, como ha sido demostrado por something.jpg. NOTA: este asunto podría estar relacionado con CVE-2007-3958. • http://lostmon.blogspot.com/2007/08/windows-extended-file-attributes-buffer.html •
CVSS: 8.8EPSS: 71%CPEs: 7EXPL: 1CVE-2007-3670 – Microsoft Internet Explorer and Mozilla Firefox - URI Handler Command Injection
https://notcve.org/view.php?id=CVE-2007-3670
10 Jul 2007 — Argument injection vulnerability in Microsoft Internet Explorer, when running on systems with Firefox installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a (1) FirefoxURL or (2) FirefoxHTML URI, which are inserted into the command line that is created when invoking firefox.exe. NOTE: it has been debated as to whether the issue is in Internet Explorer or Firefox. As of 20070711, it is CVE's opinio... • https://www.exploit-db.com/exploits/30285 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 91%CPEs: 1EXPL: 3CVE-2007-3576
https://notcve.org/view.php?id=CVE-2007-3576
05 Jul 2007 — Microsoft Internet Explorer 6 executes web script from URIs of arbitrary scheme names ending with the "script" character sequence, using the (1) vbscript: handler for scheme names with 7 through 9 characters, and the (2) javascript: handler for scheme names with 10 or more characters, which might allow remote attackers to bypass certain XSS protection schemes. NOTE: other researchers dispute the significance of this issue, stating "this only works when typed in the address bar. ** IMPUGNADA ** Microsoft Int... • http://groups.google.com/group/php-ids/browse_thread/thread/3ec15f69d6b3dba0 •
CVSS: 7.8EPSS: 16%CPEs: 7EXPL: 0CVE-2007-3550
https://notcve.org/view.php?id=CVE-2007-3550
03 Jul 2007 — Microsoft Internet Explorer 6.0 and 7.0 allows remote attackers to fill Zones with arbitrary domains using certain metacharacters such as wildcards via JavaScript, which results in a denial of service (website suppression and resource consumption), aka "Internet Explorer Zone Domain Specification Dos and Page Suppressing". NOTE: this issue has been disputed by a third party, who states that the zone settings cannot be manipulated ** EN DISPUTA ** Microsoft Internet Explorer versión 6.0 y versión 7.0 permite... • http://lists.grok.org.uk/pipermail/full-disclosure/2007-July/064326.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.0EPSS: 1%CPEs: 2EXPL: 0CVE-2007-3481
https://notcve.org/view.php?id=CVE-2007-3481
28 Jun 2007 — Cross-domain vulnerability in Microsoft Internet Explorer 6 and 7 allows remote attackers to bypass the Same Origin Policy and access restricted information from other domains via JavaScript that overwrites the document variable and statically sets the document.domain attribute. NOTE: this issue has been disputed by other researchers, citing a variable scoping issue and information about the semantics of document.domain ** EN DISPUTA ** Vulnerabilidad entre dominios en Microsoft Internet Explorer 6 y 7 perm... • http://osvdb.org/38953 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.5EPSS: 36%CPEs: 2EXPL: 3CVE-2007-3406 – Microsoft Internet Explorer 6 - Local File Access
https://notcve.org/view.php?id=CVE-2007-3406
26 Jun 2007 — Multiple absolute path traversal vulnerabilities in Microsoft Internet Explorer 6 on Windows XP SP2 allow remote attackers to access arbitrary local files via the file: URI in the (1) src attribute of a (a) bgsound, (b) input, (c) EMBED, (d) img, or (e) script tag; (2) data attribute of an object tag; (3) value attribute of a param tag; (4) background attribute of a body tag; or (5) the background:url attribute declared in the BODY parameter of a STYLE tag. Múltiples vulnerabilidades de salto de directorio ... • https://www.exploit-db.com/exploits/29619 •