CVSS: 9.3EPSS: 95%CPEs: 33EXPL: 4CVE-2010-0249 – Microsoft Internet Explorer - 'Aurora' Memory Corruption (MS10-002)
https://notcve.org/view.php?id=CVE-2010-0249
Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista Gold, SP1, and SP2; Windows Server 2008 Gold, SP2, and R2; and Windows 7 allows remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object, related to incorrectly initialized memory and improper handling of objects in memory, as exploited in the wild in December 2009 and January 2010 during Operation Aurora, aka "HTML Object Memory Corruption Vulnerability." Vulnerabilidad de uso después de liberación en Microsoft Internet Explorer 6, 6 SP1, 7 y 8 en Windows 2000 SP4; Windows XP SP2 y SP3; Windows Server 2003 SP2; Windows Vista Gold SP1 y SP2; Windows Server 2008 Gold, SP2 y R2; y Windows 7; permite a atacantes remotos ejecutar código de su elección accediendo a un puntero asociado a un objeto eliminado, como se ha explotado activamente en Enero 2010. • https://www.exploit-db.com/exploits/16599 https://www.exploit-db.com/exploits/11167 http://blogs.technet.com/msrc/archive/2010/01/14/security-advisory-979352.aspx http://news.cnet.com/8301-27080_3-10435232-245.html http://osvdb.org/61697 http://securitytracker.com/id?1023462 http://support.microsoft.com/kb/979352 http://www.exploit-db.com/exploits/11167 http://www.kb.cert.org/vuls/id/492515 http://www.microsoft.com/technet/security/advisory/979352.mspx http:/ • CWE-416: Use After Free •
CVSS: 4.3EPSS: 94%CPEs: 41EXPL: 1CVE-2008-4033 – Microsoft XML Core Services DTD - Cross-Domain Scripting (MS08-069)
https://notcve.org/view.php?id=CVE-2008-4033
Cross-domain vulnerability in Microsoft XML Core Services 3.0 through 6.0, as used in Microsoft Expression Web, Office, Internet Explorer, and other products, allows remote attackers to obtain sensitive information from another domain and corrupt the session state via HTTP request header fields, as demonstrated by the Transfer-Encoding field, aka "MSXML Header Request Vulnerability." Vulnerabilidad de dominios cruzados en Microsoft XML Core Services v3.0 hasta v6.0, como el que se utiliza en Microsoft Expression Web, Office, Internet Explorer y otros productos; permite a atacantes remotos obtener información sensible de otro dominio y corromper el estado de la sesión a través de solicitudes de campos de cabecera HTTP, como se ha demostrado con el campo Transfer-Encoding. También se conoce como "Vulnerabilidad de la solicitud de la cabecera MSXML". • https://www.exploit-db.com/exploits/7196 http://marc.info/?l=bugtraq&m=122703006921213&w=2 http://securitytracker.com/id?1021164 http://www.securityfocus.com/bid/32204 http://www.us-cert.gov/cas/techalerts/TA08-316A.html http://www.vupen.com/english/advisories/2008/3111 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-069 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5847 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 66%CPEs: 3EXPL: 0CVE-2007-1692
https://notcve.org/view.php?id=CVE-2007-1692
The default configuration of Microsoft Windows uses the Web Proxy Autodiscovery Protocol (WPAD) without static WPAD entries, which might allow remote attackers to intercept web traffic by registering a proxy server using WINS or DNS, then responding to WPAD requests, as demonstrated using Internet Explorer. NOTE: it could be argued that if an attacker already has control over WINS/DNS, then web traffic could already be intercepted by modifying WINS or DNS records, so this would not cross privilege boundaries and would not be a vulnerability. It has also been reported that DHCP is an alternate attack vector. La configuración predeterminada de Microsoft Windows usa el Web Proxy Autodiscovery Protocol (WPAD) sin entradas WPAD estáticas, lo que podría permitir a atacantes remotos interceptar el tráfico web mediante el registro de un servidor proxy usando WINS o DNS y, a continuación, responder a peticiones WPAD, como es demostrado por Internet Explorer. NOTA: se podría argumentar que si un atacante ya tiene control sobre WINS/DNS, entonces el tráfico web ya podría ser interceptado mediante la modificación de registros WINS o DNS, por lo que esto no cruzaría los límites de privilegios y no sería una vulnerabilidad. • http://archives.neohapsis.com/archives/isn/2007-q1/0418.html http://isc.sans.org/diary.html?storyid=2517 http://news.com.com/Windows+weakness+can+lead+to+network+traffic+hijacks/2100-1002_3-6170229.html http://support.microsoft.com/kb/934864 http://www.vupen.com/english/advisories/2007/1115 https://exchange.xforce.ibmcloud.com/vulnerabilities/33244 • CWE-16: Configuration •
CVSS: 5.0EPSS: 23%CPEs: 13EXPL: 1CVE-2006-7031 – Microsoft Internet Explorer 6.0.2900 SP2 - CSS Attribute Denial of Service
https://notcve.org/view.php?id=CVE-2006-7031
Microsoft Internet Explorer 6.0.2900 SP2 and earlier allows remote attackers to cause a denial of service (crash) via a table element with a CSS attribute that sets the position, which triggers an "unhandled exception" in mshtml.dll. Microsoft Internet Explorer 6.0.2900 SP2 y versiones anteriores permite a atacantes remotos provocar una denegación de servicio (caída) mediante un elemento tabla con un atributo CSS que fija la posición, lo cual dispara una "excepción no manejada" en mshtml.dll. • https://www.exploit-db.com/exploits/1775 http://www.securityfocus.com/bid/17932 •
CVSS: 10.0EPSS: 95%CPEs: 10EXPL: 2CVE-2007-1070 – Trend Micro ServerProtect - 'eng50.dll' Remote Stack Overflow
https://notcve.org/view.php?id=CVE-2007-1070
Multiple stack-based buffer overflows in Trend Micro ServerProtect for Windows and EMC 5.58, and for Network Appliance Filer 5.61 and 5.62, allow remote attackers to execute arbitrary code via crafted RPC requests to TmRpcSrv.dll that trigger overflows when calling the (1) CMON_NetTestConnection, (2) CMON_ActiveUpdate, and (3) CMON_ActiveRollback functions in (a) StCommon.dll, and (4) ENG_SetRealTimeScanConfigInfo and (5) ENG_SendEMail functions in (b) eng50.dll. Múltiples desbordamientos de búfer basado en pila en Trend Micro ServerProtect para Windows y EMC 5.58, y para Network Appliance Filer 5.61 y 5.62, permite a atacantes remotos ejecutar código de su elección a través respuestas RPC manipuladas en TmRpcSrv.dll que disparan un desbordamiento de búfer cuando se llama a las funciones (1) CMON_NetTestConnection, (2) CMON_ActiveUpdate, y (3) CMON_ActiveRollbackn en (a) StCommon.dll, y (4) ENG_SetRealTimeScanConfigInfo y (5) las funciones ENG_SendEMail en (b) eng50.dll. • https://www.exploit-db.com/exploits/4367 https://www.exploit-db.com/exploits/16827 http://esupport.trendmicro.com/support/viewxml.do?ContentID=EN-1034290 http://osvdb.org/33042 http://secunia.com/advisories/24243 http://www.kb.cert.org/vuls/id/349393 http://www.kb.cert.org/vuls/id/466609 http://www.kb.cert.org/vuls/id/630025 http://www.kb.cert.org/vuls/id/730433 http://www.securityfocus.com/archive/1/460686/100/0/threaded http://www.securityfocus. •