CVSS: 6.8EPSS: 82%CPEs: 29EXPL: 0CVE-2007-3893
https://notcve.org/view.php?id=CVE-2007-3893
Unspecified vulnerability in Microsoft Internet Explorer 5.01 through 7 allows remote attackers to execute arbitrary code via unspecified vectors involving memory corruption from an unhandled error. Vulnerabilidad no especificada en Microsoft Internet Explorer 5.01 hasta 7 permite a atacantes remotos ejecutar código de su elección mediante vectores no especificados que implican corrupción de memoria debido a un error no controlado. • http://secunia.com/advisories/23469 http://securitytracker.com/id?1018788 http://www.securityfocus.com/archive/1/482366/100/0/threaded http://www.securityfocus.com/bid/25916 http://www.us-cert.gov/cas/techalerts/TA07-282A.html http://www.vupen.com/english/advisories/2007/3437 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-057 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2284 • CWE-399: Resource Management Errors •
CVSS: 4.3EPSS: 0%CPEs: 44EXPL: 1CVE-2007-4848
https://notcve.org/view.php?id=CVE-2007-4848
Microsoft Internet Explorer 4.0 through 7 allows remote attackers to determine the existence of local files that have associated images via a res:// URI in the src property of a JavaScript Image object, as demonstrated by the URI for a bitmap image resource within a (1) .exe or (2) .dll file. Microsoft Internet Explorer 4.0 hasta 7 permite a atacantes remotos determinar la existencia de archivos locales que tienen imágenes asociadas mediante un URI res:// en la propiedad src de un objeto Image de JavaScript, como se ha demostrado con el URI de un recurso de imagen bitmap dentro de un archivo (1) .exe o (2) .dll. • http://osvdb.org/37638 http://xs-sniper.com/blog/2007/07/20/more-uri-stuff-ies-resouce-uri •
CVSS: 4.3EPSS: 57%CPEs: 7EXPL: 1CVE-2007-3670 – Microsoft Internet Explorer and Mozilla Firefox - URI Handler Command Injection
https://notcve.org/view.php?id=CVE-2007-3670
Argument injection vulnerability in Microsoft Internet Explorer, when running on systems with Firefox installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a (1) FirefoxURL or (2) FirefoxHTML URI, which are inserted into the command line that is created when invoking firefox.exe. NOTE: it has been debated as to whether the issue is in Internet Explorer or Firefox. As of 20070711, it is CVE's opinion that IE appears to be failing to properly delimit the URL argument when invoking Firefox, and this issue could arise with other protocol handlers in IE as well. However, Mozilla has stated that it will address the issue with a "defense in depth" fix that will "prevent IE from sending Firefox malicious data." Una vulnerabilidad de inyección de argumentos en Microsoft Internet Explorer, cuando es ejecutado en sistemas con Firefox instalado y ciertos URIs registrados, permiten a atacantes remotos conducir ataques de tipo cross-browser scripting y ejecutar comandos arbitrarios por medio de metacaracteres de shell en un URI (1) FirefoxURL o (2) FirefoxHTML, que son insertadas en la línea de comandos que son creadas cuando se invoca el archivo firefox.exe. • https://www.exploit-db.com/exploits/30285 ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt http://archives.neohapsis.com/archives/fulldisclosure/2007-07/0160.html http://blog.mozilla.com/security/2007/07/10/security-issue-in-url-protocol-handling-on-windows http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00774579 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id= • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 5%CPEs: 7EXPL: 0CVE-2007-3550
https://notcve.org/view.php?id=CVE-2007-3550
Microsoft Internet Explorer 6.0 and 7.0 allows remote attackers to fill Zones with arbitrary domains using certain metacharacters such as wildcards via JavaScript, which results in a denial of service (website suppression and resource consumption), aka "Internet Explorer Zone Domain Specification Dos and Page Suppressing". NOTE: this issue has been disputed by a third party, who states that the zone settings cannot be manipulated ** EN DISPUTA ** Microsoft Internet Explorer versión 6.0 y versión 7.0 permite a atacantes remotos rellenar Zonas con dominios de su elección utilizando determinados metacaracteres tales como comodines mediante JavaScript, lo cual resulta en una denegación de servicio (supresión de sitios web y agotamiento de recursos), también conocida como "Internet Explorer Zone Domain Specification Dos and Page Suppressing". NOTA: esta cuestión ha sido discutida por una tercera parte, la cual establece que la configuración de la zona no puede ser manipulada. • http://lists.grok.org.uk/pipermail/full-disclosure/2007-July/064326.html http://osvdb.org/45814 http://securityreason.com/securityalert/2855 http://www.secniche.org/advisory/Internet_Dos_Adv.pdf http://www.securityfocus.com/archive/1/472651/100/0/threaded http://www.securityfocus.com/archive/1/473662 http://www.securityfocus.com/archive/1/485536/100/0/threaded http://www.securityfocus.com/bid/24744 https://exchange.xforce.ibmcloud.com/vulnerabilities/35455 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2007-3497
https://notcve.org/view.php?id=CVE-2007-3497
Microsoft Internet Explorer 7 allows remote attackers to determine the existence of page history via the history.length JavaScript variable. Microsoft Internet Explorer 7 permite a atacantes remotos determinar la existencia de historia de una página mediante la variable Javascript history.length. • http://osvdb.org/38955 http://www.0x000000.com/?i=363 •