CVSS: 9.3EPSS: 89%CPEs: 1EXPL: 0CVE-2006-5581 – Microsoft Internet Explorer normalize() Function Memory Corruption Vulnerability
https://notcve.org/view.php?id=CVE-2006-5581
Unspecified vulnerability in Microsoft Internet Explorer 6 allows remote attackers to execute arbitrary code via certain DHTML script functions, such as normalize, and "incorrectly created elements" that trigger memory corruption, aka "DHTML Script Function Memory Corruption Vulnerability." Vulnerabilidad sin especificar en el Microsoft Internet Explorer 6 permite a atacantes remotos ejecutar código de su elección a través de determinadas funciones DHTML , como la "normalize", y "elementos creados incorrectamente" que disparan una corrupción de memoria, también conocido como "Vulnerabilidad de corrupción de memoria mediante una función DHTML". This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page. The specific vulnerability exists due to improper handling of the normalize() function. When called in certain circumstances user controllable memory can be used to execute arbitrary code. • http://secunia.com/advisories/23288 http://securitytracker.com/id?1017373 http://www.kb.cert.org/vuls/id/347448 http://www.osvdb.org/30814 http://www.securityfocus.com/archive/1/454210/100/0/threaded http://www.securityfocus.com/archive/1/454969/100/200/threaded http://www.securityfocus.com/bid/21546 http://www.symantec.com/security_response/writeup.jsp?docid=2006-121212-1201-99 http://www.us-cert.gov/cas/techalerts/TA06-346A.html http://www.vupen.com/english/ •
CVSS: 5.0EPSS: 12%CPEs: 2EXPL: 3CVE-2006-6310 – Microsoft Internet Explorer 6 - Frame Src Denial of Service
https://notcve.org/view.php?id=CVE-2006-6310
Microsoft Internet Explorer 6.0 SP1 and earlier allows remote attackers to cause a denial of service (crash) via an invalid src attribute value ("?") in an HTML frame tag that is in a frameset tag with a large rows attribute. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information. Microsoft Internet Explorer 6.0 SP1 y anteriores permiten a atacantes remotos provocar una denegación de servicio (caída) mediante un valor del atributo src inválido ("?") en una etiqueta frame de HTML que se encuentra dentro de una etiqueta frameset con un atriburo rows grande. • https://www.exploit-db.com/exploits/29229 http://downloads.securityfocus.com/vulnerabilities/exploits/21447.html http://www.osvdb.org/31325 http://www.securityfocus.com/bid/21447 •
CVSS: 4.3EPSS: 12%CPEs: 2EXPL: 0CVE-2006-2384
https://notcve.org/view.php?id=CVE-2006-2384
Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to conduct spoofing and phishing attacks by using a modal browser window in a way that preserves the original address bar and trusted UI of a trusted site, even after the browser has been navigated to a malicious site, aka the "Address Bar Spoofing Vulnerability." • http://secunia.com/advisories/20595 http://securitytracker.com/id?1016291 http://www.osvdb.org/26445 http://www.securityfocus.com/bid/18321 http://www.vupen.com/english/advisories/2006/2319 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-021 https://exchange.xforce.ibmcloud.com/vulnerabilities/26777 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1478 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 3%CPEs: 66EXPL: 2CVE-2006-0585
https://notcve.org/view.php?id=CVE-2006-0585
jscript.dll in Microsoft Internet Explorer 6.0 SP1 and earlier allows remote attackers to cause a denial of service (application crash) via a Shockwave Flash object that contains ActionScript code that calls VBScript, which in turn calls the Javascript document.write function, which triggers a null dereference. • http://securitytracker.com/id?1015559 http://www.securityfocus.com/archive/1/423675/100/0/threaded http://www.securityfocus.com/archive/1/425422/30/6890/threaded http://www.securityfocus.com/bid/16441 •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2005-4844
https://notcve.org/view.php?id=CVE-2005-4844
The CLSID_ApprenticeICW control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of the class associated with the control's CLSID, which is not intended for use within Internet Explorer. • http://www.securityfocus.com/archive/1/391803 •