Microsoft » Internet Explorer : Security Vulnerabilities (CVSS score between 5 and 5.99)

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2016-7153	200	+Info	2016-09-06	2017-02-19	5.0	None	Remote	Low	Not required	Partial	None	None
The HTTP/2 protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote attackers to obtain cleartext data by leveraging a web-browser configuration in which third-party cookies are sent, aka a "HEIST" attack.
2	CVE-2016-7152	200	+Info	2016-09-06	2017-02-19	5.0	None	Remote	Low	Not required	Partial	None	None
The HTTPS protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote attackers to obtain cleartext data by leveraging a web-browser configuration in which third-party cookies are sent, aka a "HEIST" attack.
3	CVE-2016-3353	254	Bypass	2016-09-14	2018-10-12	5.1	None	Remote	High	Not required	Partial	Partial	Partial
Microsoft Internet Explorer 9 through 11 mishandles .url files from the Internet zone, which allows remote attackers to bypass intended access restrictions via a crafted file, aka "Internet Explorer Security Feature Bypass."
4	CVE-2016-3295	119	DoS Exec Code Overflow Mem. Corr.	2016-09-14	2018-10-12	5.1	None	Remote	High	Not required	Partial	Partial	Partial
Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability."
5	CVE-2016-3292	20	Bypass	2016-09-14	2018-10-12	5.1	None	Remote	High	Not required	Partial	Partial	Partial
Microsoft Internet Explorer 10 and 11 mishandles integrity settings and zone settings, which allows remote attackers to bypass a sandbox protection mechanism via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."
6	CVE-2016-3247		DoS Exec Code Mem. Corr.	2016-09-14	2018-10-12	5.1	None	Remote	High	Not required	Partial	Partial	Partial
Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability."
7	CVE-2015-6053	200	+Info	2015-10-14	2018-10-12	5.0	None	Remote	Low	Not required	Partial	None	None
Microsoft Internet Explorer 11 allows remote attackers to obtain sensitive information from process memory via crafted parameters in an ArrayBuffer.slice call, aka "Internet Explorer Information Disclosure Vulnerability."
8	CVE-2015-2483	200	+Info	2015-09-09	2018-10-12	5.0	None	Remote	Low	Not required	Partial	None	None
Microsoft Internet Explorer 10 and 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Information Disclosure Vulnerability."
9	CVE-2014-6339	264	Bypass	2014-11-11	2018-10-12	5.0	None	Remote	Low	Not required	None	Partial	None
Microsoft Internet Explorer 8 and 9 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability."
10	CVE-2014-6328	20	XSS Bypass	2014-12-11	2018-10-12	5.0	None	Remote	Low	Not required	None	Partial	None
Microsoft Internet Explorer 8 through 11 allows remote attackers to bypass the XSS filter via a crafted attribute of an element in an HTML document, aka "Internet Explorer XSS Filter Bypass Vulnerability," a different vulnerability than CVE-2014-6365.
11	CVE-2012-1545	119	DoS Overflow Mem. Corr. Bypass	2012-03-09	2021-07-23	5.8	None	Remote	Medium	Not required	None	Partial	Partial
Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, allows remote attackers to bypass Protected Mode or cause a denial of service (memory corruption) by leveraging access to a Low integrity process, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012.
12	CVE-2011-4689	264		2011-12-07	2021-07-23	5.0	None	Remote	Low	Not required	Partial	None	None
Microsoft Internet Explorer 6 through 9 does not prevent capture of data about the times of Same Origin Policy violations during IFRAME loading attempts, which makes it easier for remote attackers to determine whether a document exists in the browser cache via crafted JavaScript code.
13	CVE-2010-5071	264	+Info	2011-12-07	2021-07-23	5.0	None	Remote	Low	Not required	Partial	None	None
The JavaScript implementation in Microsoft Internet Explorer 8.0 and earlier does not properly restrict the set of values contained in the object returned by the getComputedStyle method, which allows remote attackers to obtain sensitive information about visited web pages by calling this method.
14	CVE-2010-1991	399	DoS	2010-05-20	2021-07-23	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Internet Explorer 6.0.2900.2180, 7, and 8.0.7600.16385 executes a mail application in situations where an IFRAME element has a mailto: URL in its SRC attribute, which allows remote attackers to cause a denial of service (excessive application launches) via an HTML document with many IFRAME elements.
15	CVE-2010-1127		DoS Exec Code	2010-03-26	2021-07-23	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Internet Explorer 6 and 7 does not initialize certain data structures during execution of the createElement method, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted JavaScript code, as demonstrated by setting the (1) outerHTML or (2) value property of an object returned by createElement.
16	CVE-2009-4073	200	+Info	2009-11-24	2021-07-23	5.0	None	Remote	Low	Not required	Partial	None	None
The printing functionality in Microsoft Internet Explorer 8 allows remote attackers to discover a local pathname, and possibly a local username, by reading the dc:title element of a PDF document that was generated from a local web page.
17	CVE-2009-3943		DoS	2009-11-16	2022-02-28	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Internet Explorer 6 through 6.0.2900.2180 and 7 through 7.0.6000.16711 allows remote attackers to cause a denial of service (application hang) via a JavaScript loop that configures the home page by using the setHomePage method and a DHTML behavior property.
18	CVE-2009-3270	400	DoS	2009-09-18	2022-02-28	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Internet Explorer 7 through 7.0.6000.16711 allows remote attackers to cause a denial of service (unusable browser) by calling the window.print function in a loop, aka a "printing DoS attack," possibly a related issue to CVE-2009-0821.
19	CVE-2009-3267	400	DoS	2009-09-18	2022-02-28	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Internet Explorer 6 through 6.0.2900.2180, and 7.0.6000.16711, allows remote attackers to cause a denial of service (CPU consumption) via an automatically submitted form containing a KEYGEN element, a related issue to CVE-2009-1828.
20	CVE-2009-2954	20	DoS	2009-08-24	2021-07-23	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Internet Explorer 6.0.2900.2180 and earlier allows remote attackers to cause a denial of service (CPU consumption and application hang) via JavaScript code with a long string value for the hash property (aka location.hash), a related issue to CVE-2008-5715.
21	CVE-2009-2576	399	DoS	2009-07-22	2021-07-23	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Internet Explorer 6.0.2900.2180 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via a long Unicode string argument to the write method, a related issue to CVE-2009-2479. NOTE: it was later reported that 7.0.6000.16473 and earlier are also affected.
22	CVE-2009-2069	287		2009-06-15	2021-07-23	5.8	None	Remote	Medium	Not required	Partial	Partial	None
Microsoft Internet Explorer before 8 displays a cached certificate for a (1) 4xx or (2) 5xx CONNECT response page returned by a proxy server, which allows man-in-the-middle attackers to spoof an arbitrary https site by letting a browser obtain a valid certificate from this site during one request, and then sending the browser a crafted 502 response page upon a subsequent request.
23	CVE-2009-2057	287		2009-06-15	2021-07-23	5.8	None	Remote	Medium	Not required	Partial	Partial	None
Microsoft Internet Explorer before 8 uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack.
24	CVE-2008-7295	264		2011-08-09	2021-07-23	5.8	None	Remote	Medium	Not required	None	Partial	Partial
Microsoft Internet Explorer cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict Transport Security (HSTS) includeSubDomains feature, aka a "cookie forcing" issue.
25	CVE-2008-4788			2008-10-29	2018-10-11	5.0	None	Remote	Low	Not required	None	Partial	None
Microsoft Internet Explorer 6 omits high-bit URL-encoded characters when displaying the address bar, which allows remote attackers to spoof the address bar via a URL with a domain name that differs from an important domain name only in these characters, as demonstrated by using exam%A9ple.com to spoof example.com, aka MSRC ticket MSRC7900.
26	CVE-2008-4787			2008-10-29	2018-10-11	5.8	None	Remote	Medium	Not required	None	Partial	Partial
Visual truncation vulnerability in Microsoft Internet Explorer 6 allows remote attackers to spoof the address bar via a URL with a hostname containing many   (Non-Blocking Space character) sequences, which are rendered as whitespace, aka MSRC ticket MSRC7899, a related issue to CVE-2003-1025.
27	CVE-2008-4381	399	DoS	2008-10-02	2018-10-11	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Internet Explorer 7 allows remote attackers to cause a denial of service (application crash) via Javascript that calls the alert function with a URL-encoded string of a large number of invalid characters.
28	CVE-2008-0090	119	DoS Overflow	2008-01-04	2021-07-23	5.0	None	Remote	Low	Not required	None	None	Partial
A certain ActiveX control in npUpload.dll in DivX Player 6.6.0 allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via a long argument to the SetPassword method.
29	CVE-2007-3497			2007-06-29	2021-07-23	5.0	None	Remote	Low	Not required	Partial	None	None
Microsoft Internet Explorer 7 allows remote attackers to determine the existence of page history via the history.length JavaScript variable.
30	CVE-2007-3481	119	Overflow Bypass	2007-06-28	2021-07-23	5.0	None	Remote	Low	Not required	Partial	None	None
DISPUTED Cross-domain vulnerability in Microsoft Internet Explorer 6 and 7 allows remote attackers to bypass the Same Origin Policy and access restricted information from other domains via JavaScript that overwrites the document variable and statically sets the document.domain attribute. NOTE: this issue has been disputed by other researchers, citing a variable scoping issue and information about the semantics of document.domain.
31	CVE-2007-3164			2007-06-11	2021-07-23	5.8	None	Remote	Medium	Not required	Partial	Partial	None
Microsoft Internet Explorer 7, when prompting for HTTP Basic Authentication for an IDN web site, uses ACE labels for the domain name in the status bar, but uses internationalized labels for this name in the authentication dialog, which might allow remote attackers to perform phishing attacks if the user misinterprets confusable characters in the internationalized labels, as demonstrated by displaying xn--theshmogroup-bgk.com only in the status bar.
32	CVE-2006-7065		DoS	2007-03-02	2021-07-23	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Internet Explorer allows remote attackers to cause a denial of service (crash) via an IFRAME with a certain XML file and XSL stylesheet that triggers a crash in mshtml.dll when a refresh is called, probably a null pointer dereference.
33	CVE-2006-7029		DoS	2007-02-23	2021-07-23	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Internet Explorer 6 SP2 and earlier allows remote attackers to cause a denial of service (crash) via a frameset with only one frame that calls resizeTo with certain arguments. NOTE: this issue might be related to CVE-2006-3637.
34	CVE-2006-6311		DoS	2006-12-06	2021-07-23	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Internet Explorer 6.0.2900.2180 allows remote attackers to cause a denial of service via a style attribute in an HTML table tag with a width value that is dynamically calculated using JavaScript.
35	CVE-2006-6310		DoS	2006-12-06	2021-07-23	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Internet Explorer 6.0 SP1 and earlier allows remote attackers to cause a denial of service (crash) via an invalid src attribute value ("?") in an HTML frame tag that is in a frameset tag with a large rows attribute. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
36	CVE-2006-5162		DoS Overflow	2006-10-05	2021-12-13	5.0	None	Remote	Low	Not required	None	None	Partial
wininet.dll in Microsoft Internet Explorer 6.0 SP2 and earlier allows remote attackers to cause a denial of service (unhandled exception and crash) via a long Content-Type header, which triggers a stack overflow.
37	CVE-2006-4687	119	Exec Code Overflow Mem. Corr.	2006-11-14	2021-07-23	5.1	None	Remote	High	Not required	Partial	Partial	Partial
Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via crafted layout combinations involving DIV tags and HTML CSS float properties that trigger memory corruption, aka "HTML Rendering Memory Corruption Vulnerability."
38	CVE-2006-3898		DoS	2006-07-27	2021-12-13	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Internet Explorer 6.0 on Windows XP SP2 allows remote attackers to cause a denial of service (application crash) by calling the Click method of the Internet.HHCtrl.1 ActiveX object before initializing the URL, which triggers a null dereference.
39	CVE-2006-3659		DoS	2006-07-18	2021-07-23	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (crash) by setting the location or URL property of a MHTMLFile ActiveX object.
40	CVE-2006-3658		DoS	2006-07-18	2021-07-23	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (crash) by accessing the object references of a FolderItem ActiveX object, which triggers a null dereference in the security check.
41	CVE-2006-3657		DoS Overflow	2006-07-18	2021-07-23	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (stack overflow exception) via a DXImageTransform.Microsoft.Gradient ActiveX object with a long (1) StartColorStr or (2) EndColorStr property.
42	CVE-2006-3640		+Info	2006-08-09	2021-07-23	5.0	None	Remote	Low	Not required	Partial	None	None
Microsoft Internet Explorer 5.01 and 6 allows certain script to persist across navigations between pages, which allows remote attackers to obtain the window location of visited web pages in other domains or zones, aka "Window Location Information Disclosure Vulnerability."
43	CVE-2006-3637		Exec Code Mem. Corr.	2006-08-08	2021-07-23	5.1	None	Remote	High	Not required	Partial	Partial	Partial
Microsoft Internet Explorer 5.01 SP4 and 6 does not properly handle various HTML layout component combinations, which allows user-assisted remote attackers to execute arbitrary code via a crafted HTML file that leads to memory corruption, aka "HTML Rendering Memory Corruption Vulnerability."
44	CVE-2006-3605		DoS	2006-07-18	2021-12-13	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (crash) by setting the Transition property on an uninitialized DXImageTransform.Microsoft.RevealTrans.1 ActiveX Object, which triggers a null dereference.
45	CVE-2006-3591		DoS	2006-07-18	2021-12-13	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (application crash) by accessing the URL property of a TriEditDocument.TriEditDocument object before it has been initialized, which triggers a NULL pointer dereference.
46	CVE-2006-3545		DoS	2006-07-13	2021-07-23	5.0	None	Remote	Low	Not required	None	None	Partial
DISPUTED Microsoft Internet Explorer 7.0 Beta allows remote attackers to cause a denial of service (application crash) via a web page with multiple empty APPLET start tags. NOTE: a third party has disputed this issue, stating that the crash does not occur with Microsoft Internet Explorer 7.0 Beta3.
47	CVE-2006-3513		DoS	2006-07-11	2021-07-23	5.0	None	Remote	Low	Not required	None	None	Partial
danim.dll in Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (application crash) by accessing the Data property of a DirectAnimation DAUserData object before it is initialized, which triggers a NULL pointer dereference.
48	CVE-2006-3472		DoS	2006-07-10	2021-07-23	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Internet Explorer 6.0 and 6.0 SP1 allows remote attackers to cause a denial of service via an HTML page with an A tag containing a long title attribute. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
49	CVE-2006-3427		DoS	2006-07-07	2021-12-13	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (crash) by declaring the sourceURL attribute on an uninitialized DirectAnimation.StructuredGraphicsControl ActiveX Object, which triggers a null dereference.
50	CVE-2006-3354		DoS	2006-07-06	2021-07-23	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (crash) by setting the Filter property of an ADODB.Recordset ActiveX object to certain values multiple times, which triggers a null dereference.

Total number of vulnerabilities : 146 Page : 1 (This Page)2 3