Page 58 of 625 results (0.014 seconds)

CVSS: 5.0EPSS: 46%CPEs: 5EXPL: 2

CVE-2009-3019 – Microsoft Internet Explorer - JavaScript SetAttribute Remote Crash

https://notcve.org/view.php?id=CVE-2009-3019

Microsoft Internet Explorer 6 on Windows XP SP2 and SP3, and Internet Explorer 7 on Vista, allows remote attackers to cause a denial of service (application crash) via JavaScript code that calls createElement to create an instance of the LI element, and then calls setAttribute to set the value attribute. Microsoft Internet Explorer 6 en Windows XP SP2 y SP3, e Internet Explorer 7 en Vista, permite a atacantes remotos provocar una denegación de servicio (caída de aplicación) a través de código Javascript que hace una llamada a createElement para crear una instancia del elemento LI, y entonces llama a setAttribute para fijar el valor del atributo. • https://www.exploit-db.com/exploits/9455 http://www.exploit-db.com/exploits/9455 • CWE-94: Improper Control of Generation of Code ('Code Injection') •

CVSS: 4.3EPSS: 2%CPEs: 3EXPL: 0

CVE-2009-3003

https://notcve.org/view.php?id=CVE-2009-3003

Microsoft Internet Explorer 6 through 8 allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed login form for the site containing that page. Microsoft Internet Explorer v6 a v8 permiten falsificar la barra de direcciones a atacantes remotos, a través de window.open con una URI relativa, que muestre una dirección URL arbitraria de un sitio web visitado por la víctima, como lo demuestra la visita a una web controlada por el atacante, que lanza un formulario de acceso falso para el sitio que contiene esa página. • http://lostmon.blogspot.com/2009/08/multiple-browsers-fake-url-folder-file.html http://secunia.com/advisories/36334 https://exchange.xforce.ibmcloud.com/vulnerabilities/53005 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12817 •

CVSS: 5.0EPSS: 0%CPEs: 76EXPL: 0

CVE-2009-2954

https://notcve.org/view.php?id=CVE-2009-2954

Microsoft Internet Explorer 6.0.2900.2180 and earlier allows remote attackers to cause a denial of service (CPU consumption and application hang) via JavaScript code with a long string value for the hash property (aka location.hash), a related issue to CVE-2008-5715. Microsoft Internet Explorer v6.0.2900.2180 y anteriores, permite a atacantes remotos provocar una denegación de servicio (consumo de CPU o cuelgue de aplicación) a través de código JavaScript con un valor de cadena larga para la propiedad "hash" (también conocida como location.hash). Cuestión relacionada con el CVE-2008-5715. • http://websecurity.com.ua/3424 http://www.securityfocus.com/archive/1/506006/100/0/threaded • CWE-20: Improper Input Validation •

CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0

CVE-2009-2668

https://notcve.org/view.php?id=CVE-2009-2668

Microsoft Internet Explorer 6 through 6.0.2900.2180 and 7 through 7.0.6000.16473 allows remote attackers to cause a denial of service (CPU consumption) via an XML document composed of a long series of start-tags with no corresponding end-tags, a related issue to CVE-2009-1232. Microsoft Internet Explorer v6 hasta v6.0.2900.2180 y v7 hasta v7.0.6000.16473, permite a atacantes remotos causar una denegación de servicio (consumo CPU) a través de un documento XML compuesto de una serie larga de start-targs que no corresponden con end-tags, relacionado con el asunto CVE-2009-1232. • http://archives.neohapsis.com/archives/bugtraq/2009-07/0193.html http://websecurity.com.ua/3216 • CWE-399: Resource Management Errors •

CVSS: 10.0EPSS: 95%CPEs: 31EXPL: 0

CVE-2009-1918 – Microsoft Internet Explorer getElementsByTagName Memory Corruption Vulnerability

https://notcve.org/view.php?id=CVE-2009-1918

Microsoft Internet Explorer 5.01 SP4 and 6 SP1; Internet Explorer 6 for Windows XP SP2 and SP3 and Server 2003 SP2; and Internet Explorer 7 and 8 for Windows XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 do not properly handle table operations, which allows remote attackers to execute arbitrary code via a crafted HTML document that triggers memory corruption by adding malformed elements to an empty DIV element, related to the getElementsByTagName method, aka "HTML Objects Memory Corruption Vulnerability." Microsoft Internet Explorer v5.01 SP4 y v6 SP1; Internet Explorer 6 para Windows XP SP2 y SP3 y Server 2003 SP2; e Internet Explorer 7 y 8 for Windows XP SP2 y SP3, Server 2003 SP2, Vista Gold, SP1, y SP2, y Server 2008 Gold y SP2, no maneja adecuadamente las operaciones con tablas, lo que permite a atacantes remotos la ejecución de código de su elección a través de un documento HTML manipulado que provoca una corrupción de memoria. También conocida como "Vulnerabilidad de corrupción de Memoria en objetos HTML". This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page. The specific flaw exists in the appending of elements to an invalid object. • http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=953693 http://www.securityfocus.com/archive/1/505523/100/0/threaded http://www.securityfocus.com/bid/35826 http://www.securitytracker.com/id?1022611 http://www.us-cert.gov/cas/techalerts/TA09-195A.html http://www.vupen.com/english/advisories/2009/2033 http://www.zerodayinitiative.com/advisories/ZDI-09-047 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-034 https://oval.cisecurity.org/repositor • CWE-94: Improper Control of Generation of Code ('Code Injection') •