CVSS: 7.5EPSS: 51%CPEs: 7EXPL: 3CVE-2003-1041 – Microsoft Windows XP/2000 - showHelp '.CHM' File Execution (MS03-004)
https://notcve.org/view.php?id=CVE-2003-1041
Internet Explorer 5.x and 6.0 allows remote attackers to execute arbitrary programs via a modified directory traversal attack using a URL containing ".." (dot dot) sequences and a filename that ends in "::" which is treated as a .chm file even if it does not have a .chm extension. NOTE: this bug may overlap CVE-2004-0475. Internet Explorer 5.x y 6.0 permite a atacantes remotos ejecutar programas arbitrarios mediante una URL conteniendo secuencias ".." (punto punto) en un nombre de fichero terminado en "::" que es tratado como un fichero CHM aunque no tenga extensión .chm. • https://www.exploit-db.com/exploits/23504 http://www.kb.cert.org/vuls/id/187196 http://www.securityfocus.com/archive/1/348521 http://www.securityfocus.com/bid/9320 http://www.us-cert.gov/cas/techalerts/TA04-196A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-023 https://exchange.xforce.ibmcloud.com/vulnerabilities/14105 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1186 https://oval.cisecurity.org/repository& •
CVSS: 10.0EPSS: 16%CPEs: 10EXPL: 0CVE-2003-1027
https://notcve.org/view.php?id=CVE-2003-1027
Internet Explorer 5.01 through 6 SP1 allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by using method caching (SaveRef) to access the window.moveBy method, which is otherwise inaccessible, as demonstrated by HijackClickV2, a different vulnerability than CVE-2003-0823, aka the "Function Pointer Drag and Drop Vulnerability." Internet Explorer 6 SP1 permite a atacantes remotos enviar acciones de arrastrar y soltar y otras acciones con el ratón a otras ventanas usando cacheado de métodos (SaveRef) para acceder al método window.moveBy, que es de otra manera inaccesible, como se demostró por HijackClickV2. • http://marc.info/?l=bugtraq&m=106979479719446&w=2 http://marc.info/?l=bugtraq&m=107038202225587&w=2 http://www.kb.cert.org/vuls/id/413886 http://www.safecenter.net/UMBRELLAWEBV4/HijackClickV2 http://www.securitytracker.com/id?1006036 http://www.us-cert.gov/cas/techalerts/TA04-033A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-004 https://exchange.xforce.ibmcloud.com/vulnerabilities/13844 https://oval.cisecurity.org/repository/search/definition/ •
CVSS: 9.3EPSS: 1%CPEs: 10EXPL: 1CVE-2003-1026 – Microsoft Internet Explorer - URL Injection in History List (MS04-004)
https://notcve.org/view.php?id=CVE-2003-1026
Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions via a javascript protocol URL in a sub-frame, which is added to the history list and executed in the top window's zone when the history.back (back) function is called, as demonstrated by BackToFramedJpu, aka the "Travel Log Cross Domain Vulnerability." Internet Explorer SP1 permite a atacantes remotos evitar restricciones de zonas mediante una URL de protocolo JavaScript en un sub-marco, que es añadido al historial de páginas visitadas y es ejecutado en la zona de seguridad de la ventana principal cuando se usa el método JavaScritp "history.back" (mostrar página anterior), como se demostró por BackToFramedJpu. • https://www.exploit-db.com/exploits/151 http://marc.info/?l=bugtraq&m=106979349517578&w=2 http://marc.info/?l=bugtraq&m=107038202225587&w=2 http://www.kb.cert.org/vuls/id/784102 http://www.safecenter.net/UMBRELLAWEBV4/BackToFramedJpu http://www.us-cert.gov/cas/techalerts/TA04-033A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-004 https://exchange.xforce.ibmcloud.com/vulnerabilities/13846 https://oval.cisecurity.org/repository/search/definition • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.0EPSS: 0%CPEs: 10EXPL: 0CVE-2003-1028
https://notcve.org/view.php?id=CVE-2003-1028
The download function of Internet Explorer 6 SP1 allows remote attackers to obtain the cache directory name via an HTTP response with an invalid ContentType and a .htm file, which could allow remote attackers to bypass security mechanisms that rely on random names, as demonstrated by threadid10008. La función de descarga de Internet Explorer 6 SP1 permite a atacantes remotos obtener el nombre de directorio de caché mediante una respuesta HTTP con un ContentType inválido y un fichero .html, lo que podría permitir a atacantes remotos saltarse mecanismos de seguridad que se basan en nombres aleatorios, como se demostró por threadid10008. • http://marc.info/?l=bugtraq&m=106979428718705&w=2 http://marc.info/?l=bugtraq&m=106979624321665&w=2 http://marc.info/?l=bugtraq&m=107038202225587&w=2 http://www.osvdb.org/7890 http://www.safecenter.net/UMBRELLAWEBV4/threadid10008 https://exchange.xforce.ibmcloud.com/vulnerabilities/13847 •
CVSS: 5.0EPSS: 4%CPEs: 2EXPL: 0CVE-2003-0519
https://notcve.org/view.php?id=CVE-2003-0519
Certain versions of Internet Explorer 5 and 6, in certain Windows environments, allow remote attackers to cause a denial of service (freeze) via a URL to C:\aux (MS-DOS device name) and possibly other devices. Ciertas versiones de Internet Explorer 5 y 7, en ciertos entornos Windows, permite a atacantes remotos causar una denegación de servicio (cuelgue) con una URL a C:\\AUX (nombre de dispositivo MS-DOS) y posiblemente otros dispositivos. • http://lists.grok.org.uk/pipermail/full-disclosure/2003-July/006286.html •