CVSS: 9.8EPSS: 79%CPEs: 30EXPL: 0CVE-2007-5347
https://notcve.org/view.php?id=CVE-2007-5347
12 Dec 2007 — Microsoft Internet Explorer 5.01 through 7 allows remote attackers to execute arbitrary code via "unexpected method calls to HTML objects," aka "DHTML Object Memory Corruption Vulnerability." Microsoft Internet Explorer 5.01 hasta la 7 permite a atacantes remotos ejecutar código de su elección a través de "llamadas a métodos no esperados de objetos HTML", también conocido como "Vulnerabilidad de corrupción de objeto de memoria DHTML". • http://secunia.com/advisories/28036 • CWE-399: Resource Management Errors •
CVSS: 9.3EPSS: 90%CPEs: 30EXPL: 0CVE-2007-3902 – Microsoft Internet Explorer setExpression Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2007-3902
11 Dec 2007 — Use-after-free vulnerability in the CRecalcProperty function in mshtml.dll in Microsoft Internet Explorer 5.01 through 7 allows remote attackers to execute arbitrary code by calling the setExpression method and then modifying the outerHTML property of an HTML element, one variant of "Uninitialized Memory Corruption Vulnerability." Una vulnerabilidad de uso de memoria previamente liberada en la función CRecalcProperty en la biblioteca mshtml.dll en Microsoft Internet Explorer versiones 5.01 hasta 7, permite ... • http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=631 • CWE-189: Numeric Errors CWE-399: Resource Management Errors •
CVSS: 8.8EPSS: 91%CPEs: 17EXPL: 0CVE-2007-3903 – Microsoft Internet Explorer Node Manipulation Memory Corruption Vulnerability
https://notcve.org/view.php?id=CVE-2007-3903
11 Dec 2007 — Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code via uninitialized or deleted objects used in repeated calls to the (1) cloneNode or (2) nodeValue JavaScript function, a different issue than CVE-2007-3902 and CVE-2007-5344, a variant of "Uninitialized Memory Corruption Vulnerability." Microsoft Internet Explorer versiones 6 y 7, permite a los atacantes remotos ejecutar código arbitrario por medio de objetos no inicializados o eliminados usados en llamadas repetidas a la ... • http://secunia.com/advisories/28036 • CWE-399: Resource Management Errors •
CVSS: 8.8EPSS: 88%CPEs: 30EXPL: 0CVE-2007-5344 – Microsoft Internet Explorer Element Tags Vulnerability
https://notcve.org/view.php?id=CVE-2007-5344
11 Dec 2007 — Microsoft Internet Explorer 5.01 through 7 allows remote attackers to execute arbitrary code via a crafted website using Javascript that creates, modifies, deletes, and accesses document objects using the tags property, which triggers heap corruption, related to uninitialized or deleted objects, a different issue than CVE-2007-3902 and CVE-2007-3903, and a variant of "Uninitialized Memory Corruption Vulnerability." Microsoft Internet Explorer versiones 5.01 hasta 7, permite a los atacantes remotos ejecutar ... • http://secunia.com/advisories/28036 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.4EPSS: 36%CPEs: 21EXPL: 0CVE-2007-5355
https://notcve.org/view.php?id=CVE-2007-5355
05 Dec 2007 — The Web Proxy Auto-Discovery (WPAD) feature in Microsoft Internet Explorer 6 and 7, when a primary DNS suffix with three or more components is configured, resolves an unqualified wpad hostname in a second-level domain outside this configured DNS domain, which allows remote WPAD servers to conduct man-in-the-middle (MITM) attacks. La característica Web Proxy Auto-Discovery en Microsoft Internet Explorer 6 y 7, cuando un sufijo de DNS primario con tres o más componentes es configurado, resuelve nombre de host... • http://secunia.com/advisories/27901 •
CVSS: 8.1EPSS: 80%CPEs: 1EXPL: 0CVE-2007-5456
https://notcve.org/view.php?id=CVE-2007-5456
14 Oct 2007 — Microsoft Internet Explorer 7 and earlier allows remote attackers to bypass the "File Download - Security Warning" dialog box and download arbitrary .exe files by placing a '?' (question mark) followed by a non-.exe filename after the .exe filename, as demonstrated by (1) .txt, (2) .cda, (3) .log, (4) .dif, (5) .sol, (6) .htt, (7) .itpc, (8) .itms, (9) .dvr-ms, (10) .dib, (11) .asf, (12) .tif, and unspecified other extensions, a different issue than CVE-2004-1331. NOTE: this issue might not cross privilege ... • http://securityreason.com/securityalert/3222 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.3EPSS: 96%CPEs: 10EXPL: 1CVE-2007-3896 – Microsoft Windows - URI Handler Command Execution
https://notcve.org/view.php?id=CVE-2007-3896
11 Oct 2007 — The URL handling in Shell32.dll in the Windows shell in Microsoft Windows XP and Server 2003, with Internet Explorer 7 installed, allows remote attackers to execute arbitrary programs via invalid "%" sequences in a mailto: or other URI handler, as demonstrated using mIRC, Outlook, Firefox, Adobe Reader, Skype, and other applications. NOTE: this issue might be related to other issues involving URL handlers in Windows systems, such as CVE-2007-3845. There also might be separate but closely related issues in t... • https://www.exploit-db.com/exploits/30645 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 87%CPEs: 29EXPL: 0CVE-2007-3893
https://notcve.org/view.php?id=CVE-2007-3893
09 Oct 2007 — Unspecified vulnerability in Microsoft Internet Explorer 5.01 through 7 allows remote attackers to execute arbitrary code via unspecified vectors involving memory corruption from an unhandled error. Vulnerabilidad no especificada en Microsoft Internet Explorer 5.01 hasta 7 permite a atacantes remotos ejecutar código de su elección mediante vectores no especificados que implican corrupción de memoria debido a un error no controlado. • http://secunia.com/advisories/23469 • CWE-399: Resource Management Errors •
CVSS: 7.5EPSS: 26%CPEs: 29EXPL: 0CVE-2007-3892
https://notcve.org/view.php?id=CVE-2007-3892
09 Oct 2007 — Microsoft Internet Explorer 5.01 through 7 allows remote attackers to spoof the URL address bar and other "trust UI" components via unspecified vectors, a different issue than CVE-2007-1091 and CVE-2007-3826. Microsoft Internet Explorer 5.01 hasta 7 permite a atacantes remotos falsificar la barra de direcciones URL y otras "Interfaces de Usuario de confianza" mediante vectores no especificados, un asunto diferente que CVE-2007-1091 y CVE-2007-3826. • http://secunia.com/advisories/27133 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2007-5277
https://notcve.org/view.php?id=CVE-2007-5277
08 Oct 2007 — Microsoft Internet Explorer 6 drops DNS pins based on failed connections to irrelevant TCP ports, which makes it easier for remote attackers to conduct DNS rebinding attacks, as demonstrated by a port 81 URL in an IMG SRC, when the DNS pin had been established for a session on port 80, a different issue than CVE-2006-4560. Microsoft Internet Explorer 6 borra asignaciones DNS fijas en conexiones fallidas a puertos TCP irrelevantes, lo cual hace más fácil para atacantes remotos llevar a cabo ataques de revinc... • http://crypto.stanford.edu/dns/dns-rebinding.pdf •