CVSS: 9.3EPSS: 89%CPEs: 41EXPL: 0CVE-2009-2530 – Microsoft Internet Explorer Event Object Type Double-Free Vulnerability
https://notcve.org/view.php?id=CVE-2009-2530
Microsoft Internet Explorer 6, 6 SP1, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "Uninitialized Memory Corruption Vulnerability," a different vulnerability than CVE-2009-2531. Microsoft Internet Explorer v6, v6 SP1, v7, y v8 no gestiona adecuadamente los objetos en memoria, lo que permite a atacantes remotos ejecutar código arbitrario mediante el acceso a un objeto que (1) no ha sido adecuadamente inicializado o (2) es borrado, lo que lleva a una corrupción de memoria, también conocido como "Vulnerabilidad de memoria no inicializada corrupta", una vulnerabilidad diferente que CVE-2008-2531. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page. The specific flaw exists within the copy constructor for a specific DOM object. When duplicated, more than one reference can be made of anything assigned to it's properties. • http://www.us-cert.gov/cas/techalerts/TA09-286A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-054 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6190 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.3EPSS: 89%CPEs: 41EXPL: 0CVE-2009-2531 – Microsoft Internet Explorer writing-mode Memory Corruption Vulnerability
https://notcve.org/view.php?id=CVE-2009-2531
Microsoft Internet Explorer 6, 6 SP1, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "Uninitialized Memory Corruption Vulnerability," a different vulnerability than CVE-2009-2530. Microsoft Internet Explorer v6, v6 SP1, v7, y v8, no maneja adecuadamente objetos en memoria lo que permite a atacantes remotos ejecutar codigo arbitrario mediante el acceso a un objeto que (1) no ha sido adecuadamente inicializado, o (2) es borrado, produciendo un corrupcion de memoria, también conocido como "Vulnerabilidad de corrupción de memoria no inicializada", una vulnerabilidad diferente que CVE-2009-2530. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required in that a user must visit a malicious web page. The specific flaw exists in the parsing of CSS style information. When a writing-mode style is used with a specific combination of HTML tags, memory corruption occurs. • http://www.us-cert.gov/cas/techalerts/TA09-286A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-054 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5766 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 1CVE-2009-3270 – Multiple Browsers - 'window.print()' Denial of Service
https://notcve.org/view.php?id=CVE-2009-3270
Microsoft Internet Explorer 7 through 7.0.6000.16711 allows remote attackers to cause a denial of service (unusable browser) by calling the window.print function in a loop, aka a "printing DoS attack," possibly a related issue to CVE-2009-0821. Microsoft Internet Explorer 7 desde 7.0.6000.16711 permite a atacantes remotos producir una denegación de servicio (navegador inutilizable) mediante una llamada en bucle a la función window.print, también conocido como "ataque DoS de impresión", posiblemente relacionado con CVE-2009-0821. • https://www.exploit-db.com/exploits/12509 http://websecurity.com.ua/2872 http://www.securityfocus.com/archive/1/506328/100/100/threaded http://www.securityfocus.com/bid/79354 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6281 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 0CVE-2009-3267
https://notcve.org/view.php?id=CVE-2009-3267
Microsoft Internet Explorer 6 through 6.0.2900.2180, and 7.0.6000.16711, allows remote attackers to cause a denial of service (CPU consumption) via an automatically submitted form containing a KEYGEN element, a related issue to CVE-2009-1828. Microsoft Internet Explorer v6 desde v6.0.2900.2180, y v7.0.6000.16711, permite a atacantes remotos producir una denegación de servicio (consumo de CPU) a través de un envío automático de un formulario que contenga un elemento generador de claves, una vulnerabilidad relacionada con CVE-2009-1828. • http://websecurity.com.ua/3194 http://www.securityfocus.com/archive/1/506328/100/100/threaded https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5519 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 4.3EPSS: 2%CPEs: 3EXPL: 0CVE-2009-3003
https://notcve.org/view.php?id=CVE-2009-3003
Microsoft Internet Explorer 6 through 8 allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed login form for the site containing that page. Microsoft Internet Explorer v6 a v8 permiten falsificar la barra de direcciones a atacantes remotos, a través de window.open con una URI relativa, que muestre una dirección URL arbitraria de un sitio web visitado por la víctima, como lo demuestra la visita a una web controlada por el atacante, que lanza un formulario de acceso falso para el sitio que contiene esa página. • http://lostmon.blogspot.com/2009/08/multiple-browsers-fake-url-folder-file.html http://secunia.com/advisories/36334 https://exchange.xforce.ibmcloud.com/vulnerabilities/53005 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12817 •