CVSS: 7.6EPSS: 97%CPEs: 10EXPL: 6CVE-2010-0483 – Microsoft Internet Explorer - 'Winhlp32.exe' MsgBox Code Execution (MS10-023)
https://notcve.org/view.php?id=CVE-2010-0483
vbscript.dll in VBScript 5.1, 5.6, 5.7, and 5.8 in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2, when Internet Explorer is used, allows user-assisted remote attackers to execute arbitrary code by referencing a (1) local pathname, (2) UNC share pathname, or (3) WebDAV server with a crafted .hlp file in the fourth argument (aka helpfile argument) to the MsgBox function, leading to code execution involving winhlp32.exe when the F1 key is pressed, aka "VBScript Help Keypress Vulnerability." La biblioteca VBScript.dll en VBScript versiones 5.1, 5.6, 5.7 y 5.8 en Microsoft Windows 2000 SP4, XP SP2 y SP3, y Server 2003 SP2, cuando se utiliza Internet Explorer, permite a atacantes remotos asistidos por el usuario ejecutar código arbitrario mediante referencia a un (1) nombre de ruta local, (2) nombre de ruta (pathname) compartida UNC , o (3) servidor WebDAV con un archivo .hlp creado en el argumento fourth (también se conoce como argumento HelpFile) a la función MsgBox, lo que conlleva a la ejecución de código que implica WinHlp32.exe cuando se presiona la tecla F1, también conocida como "VBScript Help Keypress Vulnerability". • https://www.exploit-db.com/exploits/16541 https://www.exploit-db.com/exploits/11615 http://blogs.technet.com/msrc/archive/2010/02/28/investigating-a-new-win32hlp-and-internet-explorer-issue.aspx http://blogs.technet.com/msrc/archive/2010/03/01/security-advisory-981169-released.aspx http://blogs.technet.com/srd/archive/2010/03/01/help-keypress-vulnerability-in-vbscript-enabling-remote-code-execution.aspx http://isec.pl/vulnerabilities/isec-0027-msgbox-helpfile-ie.txt http://isec.pl/vulnera • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.3EPSS: 3%CPEs: 29EXPL: 1CVE-2010-0555
https://notcve.org/view.php?id=CVE-2010-0555
Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, 7, and 8 does not prevent rendering of non-HTML local files as HTML documents, which allows remote attackers to bypass intended access restrictions and read arbitrary files via vectors involving the product's use of text/html as the default content type for files that are encountered after a redirection, aka the URLMON sniffing vulnerability, a variant of CVE-2009-1140 and related to CVE-2008-1448. Microsoft Internet Explorer v5.01 SP4, v6, vv6 SP1, v7, y v8 no previene el renderizado de ficheros locales no HTML como documentos HTML, lo que permite a atacantes remotos evitar las restricciones de acceso establecidas y leer archivos a su elección que incluyen el uso del producto de text/html como el tipo contenido por defecto para archivos que se encuentran después de una redirección, tamién conocido como vulnerabilidad de esnifado URLMON, una variante de CVE-2009-1140 y relacionada con CVE-2008-1448. • http://blogs.technet.com/msrc/archive/2010/02/03/security-advisory-980088-released.aspx http://isc.sans.org/diary.html?n&storyid=8152 http://osvdb.org/62157 http://www.coresecurity.com/content/internet-explorer-dynamic-object-tag http://www.microsoft.com/technet/security/advisory/980088.mspx http://www.securityfocus.com/archive/1/509345/100/0/threaded http://www.securityfocus.com/bid/38055 http://www.securityfocus.com/bid/38056 •
CVSS: 4.3EPSS: 93%CPEs: 49EXPL: 1CVE-2010-0255
https://notcve.org/view.php?id=CVE-2010-0255
Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, 7, and 8 does not prevent rendering of non-HTML local files as HTML documents, which allows remote attackers to bypass intended access restrictions and read arbitrary files via vectors involving JavaScript exploit code that constructs a reference to a file://127.0.0.1 URL, aka the dynamic OBJECT tag vulnerability, as demonstrated by obtaining the data from an index.dat file, a variant of CVE-2009-1140 and related to CVE-2008-1448. Microsoft Internet Explorer v5.01 SP4, v6, vv6 SP1, v7, y v8 no previene el renderizado de ficheros locales no HTML como documentos HTML, lo que permite a atacantes remotos superar las restricciones de acceso establecidas y leer ficheros a su elección a través de vectores que incluyen codigo explotable JavaScript que constituye una referencia en un fichero URL file://127.0.0.1, también conocido como vulnerabilidad de etiqueta OBJETC dinámica, como queda demostrado en los datos obtenidos de un fichero index.dat, una variante de CVE-2009-1140 y relacionada con CVE-2008-1448. • http://blogs.technet.com/msrc/archive/2010/02/03/security-advisory-980088-released.aspx http://isc.sans.org/diary.html?n&storyid=8152 http://osvdb.org/62156 http://support.avaya.com/css/P8/documents/100089747 http://www.coresecurity.com/content/internet-explorer-dynamic-object-tag http://www.microsoft.com/technet/security/advisory/980088.mspx http://www.securityfocus.com/archive/1/509345/100/0/threaded http://www.securityfocus.com/bid/38055 http://www.securityfocus.com/bid/3805 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 95%CPEs: 46EXPL: 1CVE-2010-0027 – Microsoft Windows ShellExecute Improper Sanitization Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2010-0027
The URL validation functionality in Microsoft Internet Explorer 5.01, 6, 6 SP1, 7 and 8, and the ShellExecute API function in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2, does not properly process input parameters, which allows remote attackers to execute arbitrary local programs via a crafted URL, aka "URL Validation Vulnerability." La funcionalidad de validación de URL en Microsoft Internet Explorer versiones 5.01, 6, 6 SP1, 7 y 8, y la función de la API ShellExecute en Windows 2000 SP4, XP SP2 y SP3, y Server 2003 SP2, no procesa apropiadamente los parámetros de entrada, lo que permite a los atacantes remotos ejecutar programas locales arbitrarios por medio de una URL creada, también conocida como "URL Validation Vulnerability". This vulnerability allows remote attackers to force a Microsoft Windows system to execute a given local executable. User interaction is required in that the target must access a malicious URL. The specific flaw exists within the ShellExecute API. Using a specially formatted URL an attacker can bypass sanitization checks within this function and force the calling application into running an executable of their choice. • https://www.exploit-db.com/exploits/33552 http://www.securityfocus.com/archive/1/509470/100/0/threaded http://www.us-cert.gov/cas/techalerts/TA10-040A.html http://www.zerodayinitiative.com/advisories/ZDI-10-016 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-002 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-007 https://exchange.xforce.ibmcloud.com/vulnerabilities/55773 https://oval.cisecurity.org/repository/search/definition/oval% • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.3EPSS: 93%CPEs: 25EXPL: 0CVE-2010-0247
https://notcve.org/view.php?id=CVE-2010-0247
Microsoft Internet Explorer 5.01 SP4, 6, and 6 SP1 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "Uninitialized Memory Corruption Vulnerability." Microsoft Internet Explorer 5.01 SP4, 6 y 6 SP1 no maneja de manera apropiada los objetos en memoria lo que permite a atacantes remotos ejecutar código de su elección accediendo a un objeto que (1) no fue correctamente iniciado o (2) es borrado, lo que conduce a una corrupción de memoria, también conocida como "Vulnerabilidad de Corrupción de Memoria no Iniciada". • https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-002 https://exchange.xforce.ibmcloud.com/vulnerabilities/55777 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8506 • CWE-94: Improper Control of Generation of Code ('Code Injection') •