CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2009-4074
https://notcve.org/view.php?id=CVE-2009-4074
The XSS Filter in Microsoft Internet Explorer 8 allows remote attackers to leverage the "response-changing mechanism" to conduct cross-site scripting (XSS) attacks against web sites that have no inherent XSS vulnerabilities, related to the details of output encoding and improper modification of an HTML attribute, aka "XSS Filter Script Handling Vulnerability." El filtro XSS en Microsoft Internet Explorer v8 permite a atacantes remotos afianzar "el mecanismo de cambio de respuesta" para conducir un ataque de secuencias de comandos en sitios cruzados (XSS) contra paginas web que no tienen vulnerabilidades XSS, relacionado con la codificación de salida. • http://hackademix.net/2009/11/21/ies-xss-filter-creates-xss-vulnerabilities http://www.owasp.org/images/5/50/OWASP-Italy_Day_IV_Maone.pdf http://www.securityfocus.com/bid/37135 http://www.theregister.co.uk/2009/11/20/internet_explorer_security_flaw https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-002 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7715 •
CVSS: 5.0EPSS: 0%CPEs: 4EXPL: 0CVE-2009-4073
https://notcve.org/view.php?id=CVE-2009-4073
The printing functionality in Microsoft Internet Explorer 8 allows remote attackers to discover a local pathname, and possibly a local username, by reading the dc:title element of a PDF document that was generated from a local web page. La funcionalidad de impresión en Microsoft Internet Explorer 8 permite a atacantes remotos descubrir un nombre de archivo y probablemente descubrir un usuario local, por la lectura del dc: pequeño elemento de un documento PDF que fue generado desde una página web local. • http://osvdb.org/60504 http://secunia.com/advisories/37362 http://securethoughts.com/2009/11/millions-of-pdf-invisibly-embedded-with-your-internal-disk-paths http://www.securityfocus.com/archive/1/508010/100/0/threaded http://www.theregister.co.uk/2009/11/23/internet_explorer_file_disclosure_bug https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12355 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.3EPSS: 95%CPEs: 41EXPL: 2CVE-2009-1547 – Microsoft Internet Explorer 5.0.1 - 'deflate' HTTP Content Encoding Remote Code Execution
https://notcve.org/view.php?id=CVE-2009-1547
Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via a crafted data stream header that triggers memory corruption, aka "Data Stream Header Corruption Vulnerability." Vulnerabilidad inespecífica en Microsoft Internet Explorer v5.01 SP4, v6, v6 SP1, y v7 permite a atacantes remotos ejecutar código arbitrario a través de cabeceras de flujos de datos manipulados que inician una corrupción de memoria, también conocido como "Vulnerabilidad de corrupción de cabecera de flujo de datos". Microsoft Internet Explorer suffers from a Content-Encoding: deflate memory corruption vulnerability. • https://www.exploit-db.com/exploits/33270 https://www.exploit-db.com/exploits/9893 http://www.us-cert.gov/cas/techalerts/TA09-286A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-054 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6454 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.3EPSS: 23%CPEs: 41EXPL: 0CVE-2009-2529
https://notcve.org/view.php?id=CVE-2009-2529
Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, 7, and 8 does not properly handle argument validation for unspecified variables, which allows remote attackers to execute arbitrary code via a crafted HTML document, aka "HTML Component Handling Vulnerability." Microsoft Internet Explorer v5.01 SP4, v6, v6 SP1, v7, y v8 no gestiona adecuadamente la validación de argumentos para un número de variables sin especificar lo que permite a atacantes remotos ejecutar código arbitrario a través de un documentos HTML manipulado, también conocido como "Vulnerabilidad de gestión de componentes HTML". • http://www.us-cert.gov/cas/techalerts/TA09-286A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-054 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6419 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.3EPSS: 89%CPEs: 41EXPL: 0CVE-2009-2530 – Microsoft Internet Explorer Event Object Type Double-Free Vulnerability
https://notcve.org/view.php?id=CVE-2009-2530
Microsoft Internet Explorer 6, 6 SP1, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "Uninitialized Memory Corruption Vulnerability," a different vulnerability than CVE-2009-2531. Microsoft Internet Explorer v6, v6 SP1, v7, y v8 no gestiona adecuadamente los objetos en memoria, lo que permite a atacantes remotos ejecutar código arbitrario mediante el acceso a un objeto que (1) no ha sido adecuadamente inicializado o (2) es borrado, lo que lleva a una corrupción de memoria, también conocido como "Vulnerabilidad de memoria no inicializada corrupta", una vulnerabilidad diferente que CVE-2008-2531. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page. The specific flaw exists within the copy constructor for a specific DOM object. When duplicated, more than one reference can be made of anything assigned to it's properties. • http://www.us-cert.gov/cas/techalerts/TA09-286A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-054 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6190 • CWE-94: Improper Control of Generation of Code ('Code Injection') •