Microsoft Ie vulnerabilities

200 CVEs affecting Microsoft Ie, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2012-1545, published 2012-03-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2003-0344, published 2003-06-16. High severity, CVSS 7.5. EPSS: 81.3% chance of exploitation in the next 30 days. Buffer overflow in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to execute arbitrary code via / (slash) characters in the Type property of an Object tag in a web page.
CVE-2006-4777, published 2006-09-14. High severity, CVSS 7.6. EPSS: 79.8% chance of exploitation in the next 30 days. Heap-based buffer overflow in the DirectAnimation Path Control (DirectAnimation.PathControl) COM object (daxctle.ocx) for Internet Explorer 6.0 SP1, on Chinese and possibly other Windows…
CVE-2002-1142, published 2002-11-29. High severity, CVSS 7.5. EPSS: 76% chance of exploitation in the next 30 days. Heap-based buffer overflow in the Remote Data Services (RDS) component of Microsoft Data Access Components (MDAC) 2.1 through 2.6, and Internet Explorer 5.01 through 6.0, allows remote attackers to…
CVE-2006-1185, published 2006-04-11. High severity, CVSS 7.5. EPSS: 70.3% chance of exploitation in the next 30 days. Unspecified vulnerability in Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via certain invalid HTML that causes memory corruption.
CVE-2006-1359, published 2006-03-23. High severity, CVSS 9.3. EPSS: 68.3% chance of exploitation in the next 30 days. Microsoft Internet Explorer 6 and 7 Beta 2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a certain createTextRange call on a checkbox object, which…
CVE-2004-1050, published 2004-12-31. High severity, CVSS 10.0. EPSS: 67.1% chance of exploitation in the next 30 days. Heap-based buffer overflow in Internet Explorer 6 allows remote attackers to execute arbitrary code via long (1) SRC or (2) NAME attributes in IFRAME, FRAME, and EMBED elements, as originally…
CVE-2006-3730, published 2006-07-21. High severity, CVSS 8.8. EPSS: 63.6% chance of exploitation in the next 30 days. Integer overflow in Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a 0x7fffffff argument to the setSlice…
CVE-2004-0212, published 2004-08-06. High severity, CVSS 10.0. EPSS: 63.5% chance of exploitation in the next 30 days. Stack-based buffer overflow in the Task Scheduler for Windows 2000 and XP, and Internet Explorer 6 on Windows NT 4.0, allows local or remote attackers to execute arbitrary code via a .job file…
CVE-2006-4446, published 2006-08-30. Medium severity, CVSS 5.0. EPSS: 62.2% chance of exploitation in the next 30 days. Heap-based buffer overflow in DirectAnimation.PathControl COM object (daxctle.ocx) in Microsoft Internet Explorer 6.0 SP1 allows remote attackers to cause a denial of service and possibly execute…
CVE-2006-1245, published 2006-03-17. High severity, CVSS 7.5. EPSS: 61.8% chance of exploitation in the next 30 days. Buffer overflow in mshtml.dll in Microsoft Internet Explorer 6.0.2900.2180, and probably other versions, allows remote attackers to execute arbitrary code via an HTML tag with a large number of…

Latest

CVE-2012-1545, published 2012-03-09. Medium severity, CVSS 5.8. EPSS: 20.1% chance of exploitation in the next 30 days. Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, allows remote attackers to bypass Protected Mode or cause a denial of service (memory corruption) by leveraging access to a Low…
CVE-2010-5071, published 2011-12-07. Medium severity, CVSS 5.0. EPSS: 12.7% chance of exploitation in the next 30 days. The JavaScript implementation in Microsoft Internet Explorer 8.0 and earlier does not properly restrict the set of values contained in the object returned by the getComputedStyle method, which allows…
CVE-2002-2435, published 2011-12-07. Medium severity, CVSS 4.3. EPSS: 13.7% chance of exploitation in the next 30 days. The Cascading Style Sheets (CSS) implementation in Microsoft Internet Explorer 8.0 and earlier does not properly handle the :visited pseudo-class, which allows remote attackers to obtain sensitive…
CVE-2011-2383, published 2011-06-03. Medium severity, CVSS 4.3. EPSS: 20.8% chance of exploitation in the next 30 days. Microsoft Internet Explorer 9 and earlier does not properly restrict cross-zone drag-and-drop actions, which allows user-assisted remote attackers to read cookie files via vectors involving an IFRAME…
CVE-2011-2382, published 2011-06-03. Medium severity, CVSS 4.3. EPSS: 19.3% chance of exploitation in the next 30 days. Microsoft Internet Explorer 8 and earlier, and Internet Explorer 9 beta, does not properly restrict cross-zone drag-and-drop actions, which allows user-assisted remote attackers to read cookie files…
CVE-2010-2118, published 2010-06-01. Medium severity, CVSS 4.3. EPSS: 10.1% chance of exploitation in the next 30 days. Microsoft Internet Explorer 6.0.2900.2180 and 8.0.7600.16385 allows remote attackers to cause a denial of service (resource consumption) via JavaScript code containing an infinite loop that creates…
CVE-2010-1991, published 2010-05-20. Medium severity, CVSS 5.0. EPSS: 10.5% chance of exploitation in the next 30 days. Microsoft Internet Explorer 6.0.2900.2180, 7, and 8.0.7600.16385 executes a mail application in situations where an IFRAME element has a mailto: URL in its SRC attribute, which allows remote…
CVE-2009-2576, published 2009-07-22. Medium severity, CVSS 5.0. EPSS: 14.9% chance of exploitation in the next 30 days. Microsoft Internet Explorer 6.0.2900.2180 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via a long Unicode string argument to the write method, a…
CVE-2009-2433, published 2009-07-10. Medium severity, CVSS 4.3. EPSS: 18.9% chance of exploitation in the next 30 days. Stack-based buffer overflow in the AddFavorite method in Microsoft Internet Explorer allows remote attackers to cause a denial of service (application crash) and possibly have unspecified other…
CVE-2009-2069, published 2009-06-15. Medium severity, CVSS 5.8. EPSS: 2.2% chance of exploitation in the next 30 days. Microsoft Internet Explorer before 8 displays a cached certificate for a (1) 4xx or (2) 5xx CONNECT response page returned by a proxy server, which allows man-in-the-middle attackers to spoof an…