CVSS: 6.0EPSS: 1%CPEs: 2EXPL: 0CVE-2006-3643
https://notcve.org/view.php?id=CVE-2006-3643
Cross-site scripting (XSS) vulnerability in Internet Explorer 5.01 and 6 in Microsoft Windows 2000 SP4 permits access to local "HTML-embedded resource files" in the Microsoft Management Console (MMC) library, which allows remote authenticated users to execute arbitrary commands, aka "MMC Redirect Cross-Site Scripting Vulnerability." Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Internet Explorer 5.01 y 6 en Microsoft Windows 2000 SP4 permite acceso a "ficheros de recursos HTML-embedded" locales en la biblioteca de Consola de Administración de Microsoft (MMC), que permite a atacantes remotos autenticados ejecutar comandos de su elección, también conocido como "Vulnerabilidad de redirección de secuencias de comandos en sitios cruzados de MMC" • http://secunia.com/advisories/21401 http://securitytracker.com/id?1016655 http://www.kb.cert.org/vuls/id/927548 http://www.securityfocus.com/bid/19417 http://www.us-cert.gov/cas/techalerts/TA06-220A.html http://www.vupen.com/english/advisories/2006/3213 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-044 https://exchange.xforce.ibmcloud.com/vulnerabilities/28005 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A638 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 71%CPEs: 8EXPL: 0CVE-2006-3638
https://notcve.org/view.php?id=CVE-2006-3638
Microsoft Internet Explorer 5.01 and 6 does not properly handle uninitialized COM objects, which allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code, as demonstrated by the Nth function in the DirectAnimation.DATuple ActiveX control, aka "COM Object Instantiation Memory Corruption Vulnerability." Microsoft Internet Explorer 5.01 y 6 no maneja adecuadamente objetos COM no inicializados, lo cual permite a atacantes remotos provocar una denegación de servicio (corrupción de memoria) y posiblemente ejecutar código de su elección, como ha sido demostrado por la función Nth en el control ActiveX DirectAnimation.DATuple, también conocido como "Vulnerabilidad de Corrupción de Memoria en la Instanciación de Objetos COM". • http://secunia.com/advisories/21396 http://securitytracker.com/id?1016663 http://www.kb.cert.org/vuls/id/959049 http://www.osvdb.org/27852 http://www.securityfocus.com/archive/1/442728/100/0/threaded http://www.securityfocus.com/bid/19340 http://www.tippingpoint.com/security/advisories/TSRT-06-09.html http://www.us-cert.gov/cas/techalerts/TA06-220A.html http://www.vupen.com/english/advisories/2006/3212 https://docs.microsoft.com/en-us/security-updates/securitybulletin • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.1EPSS: 96%CPEs: 2EXPL: 1CVE-2006-3637 – Microsoft Internet Explorer 5.0.1 - Frameset Memory Corruption
https://notcve.org/view.php?id=CVE-2006-3637
Microsoft Internet Explorer 5.01 SP4 and 6 does not properly handle various HTML layout component combinations, which allows user-assisted remote attackers to execute arbitrary code via a crafted HTML file that leads to memory corruption, aka "HTML Rendering Memory Corruption Vulnerability." Microsoft Internet Explorer 5.01 SP4 y 6 no maneja adecuadamente diversas combinaciones de componentes en diseños HTML, lo cual permite a atacantes remotos con la intervención del usuario ejecutar código de su elección mediante un archivo HTML manipulado que lleva a una corrupción de memoria, también conocido como "Vulnerabilidad de Corrupción de Memoria en Renderizado HTML" • https://www.exploit-db.com/exploits/27971 http://secunia.com/advisories/21396 http://securitytracker.com/id?1016663 http://www.kb.cert.org/vuls/id/340060 http://www.osvdb.org/27853 http://www.us-cert.gov/cas/techalerts/TA06-220A.html http://www.vupen.com/english/advisories/2006/3212 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-042 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A502 •
CVSS: 7.5EPSS: 69%CPEs: 2EXPL: 0CVE-2006-3450 – Microsoft Internet Explorer CSS Class Ordering Memory Corruption Vulnerability
https://notcve.org/view.php?id=CVE-2006-3450
Microsoft Internet Explorer 6 allows remote attackers to execute arbitrary code by using the document.getElementByID Javascript function to access crafted Cascading Style Sheet (CSS) elements, and possibly other unspecified vectors involving certain layout positioning combinations in an HTML file. Microsoft Internet Explorer 6 permite a atacantes remotos ejecutar código de su elección usando la función Javascript document.getElementByID para acceder a elementos de Hojas de Estilo en Cascada (CSS) manipulados, y posiblemente otros vectores no especificados relacionados con determinadas combinaciones de posicionamiento en el diseño de un archivo HTML. This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page. The specific vulnerability exists due to improper handling of CSS class values. Accessing a specially crafted CSS element via document.getElementByID causes a memory corruption eventually leading to code execution. • http://secunia.com/advisories/21396 http://securitytracker.com/id?1016663 http://www.kb.cert.org/vuls/id/119180 http://www.osvdb.org/27855 http://www.securityfocus.com/archive/1/442579/100/0/threaded http://www.securityfocus.com/bid/19312 http://www.us-cert.gov/cas/techalerts/TA06-220A.html http://www.vupen.com/english/advisories/2006/3212 http://www.zerodayinitiative.com/advisories/ZDI-06-027.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/20 • CWE-20: Improper Input Validation •
CVSS: 5.0EPSS: 92%CPEs: 4EXPL: 3CVE-2006-3915 – Microsoft Internet Explorer 6 - Native Function Iterator Denial of Service
https://notcve.org/view.php?id=CVE-2006-3915
Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) by iterating over any native function, as demonstrated with the window.alert function, which triggers a null dereference. Microsoft Internet Explorer 6 sobre Windows XP SP2 permite a atacantes remotos provocar denegación de servicio (caida) a travès de la iteración sobre cualquier función nativa, como se demostro con la función window.alert, lo cual dispara un referencia null. • https://www.exploit-db.com/exploits/28265 http://browserfun.blogspot.com/2006/07/mobb-25-native-function-iterator.html http://www.osvdb.org/27373 http://www.securityfocus.com/bid/19140 http://www.vupen.com/english/advisories/2006/2955 https://exchange.xforce.ibmcloud.com/vulnerabilities/27932 •