Vulnerabilidades do Microsoft Internet Explorer

CVE-2015-2425 Alta · 8.8 KEV Alta · 56 CWE-787 14/07/2015

Microsoft Internet Explorer Memory Corruption Vulnerability

Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2383 and CVE-2015-2384.

CVE-2015-2419 Alta · 8.8 KEV Alta · 64 Exploit público CWE-787 14/07/2015

Microsoft Internet Explorer Memory Corruption Vulnerability

JScript 9 in Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "JScript9 Memory Corruption Vulnerability."

CVE-2015-0071 Média · 6.5 KEV Alta · 53 11/02/2015

Microsoft Internet Explorer ASLR Bypass Vulnerability

Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability."

CVE-2015-0313 Crítica · 9.8 KEV Urgente · 80 Exploit público CWE-416 02/02/2015

Adobe Flash Player Use-After-Free Vulnerability

Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2015, a different vulnerability than CVE-2015-0315, CVE-2015-0320, and CVE-2015-0322.

CVE-2015-0311 Crítica · 9.8 KEV Urgente · 80 Exploit público 23/01/2015

Adobe Flash Player Remote Code Execution Vulnerability

Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.202.438 on Linux allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in January 2015.

CVE-2014-4123 Alta · 8.8 KEV Alta · 56 15/10/2014

Microsoft Internet Explorer Privilege Escalation Vulnerability

Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability," as exploited in the wild in October 2014, a different vulnerability than CVE-2014-4124.

CVE-2014-2817 Alta · 8.8 KEV Alta · 56 12/08/2014

Microsoft Internet Explorer Privilege Escalation Vulnerability

Microsoft Internet Explorer 6 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."

CVE-2014-1776 Crítica · 9.8 KEV Urgente · 73 CWE-416 27/04/2014

Microsoft Internet Explorer Memory Corruption Vulnerability

Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to the CMarkup::IsConnectedToPrimaryMarkup function, as exploited in the wild in April 2014. NOTE: this issue originally emphasized VGX.DLL, but Microsoft clarified that "VGX.DLL does not contain the vulnerable code leveraged in this exploit. Disabling VGX.DLL is an exploit-specific workaround that provides an immediate, effective workaround to help block known attacks."

CVE-2013-7331 Média · 6.5 KEV Alta · 68 Exploit público CWE-209 26/02/2014

Microsoft Internet Explorer Information Disclosure Vulnerability

The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share pathnames, intranet hostnames, and intranet IP addresses by examining error codes, as demonstrated by a res:// URL, and exploited in the wild in February 2014.

CVE-2014-0322 Alta · 8.8 KEV Urgente · 86 Exploit público CWE-416 14/02/2014

Microsoft Internet Explorer Use-After-Free Vulnerability

Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code, CMarkup, and the onpropertychange attribute of a script element, as exploited in the wild in January and February 2014.

CVE-2013-3897 Alta · 8.8 KEV Urgente · 76 Exploit público CWE-416 09/10/2013

Microsoft Internet Explorer Use-After-Free Vulnerability

Use-after-free vulnerability in the CDisplayPointer class in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted JavaScript code that uses the onpropertychange event handler, as exploited in the wild in September and October 2013, aka "Internet Explorer Memory Corruption Vulnerability."

CVE-2013-3893 Alta · 8.8 KEV Urgente · 86 Exploit público CWE-416 18/09/2013

Microsoft Internet Explorer Resource Management Errors Vulnerability

Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaScript strings, as demonstrated by use of an ms-help: URL that triggers loading of hxds.dll.

CVE-2013-3163 Alta · 8.8 KEV Urgente · 76 Exploit público CWE-787 10/07/2013

Microsoft Internet Explorer Memory Corruption Vulnerability

Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3144 and CVE-2013-3151.

CVE-2013-1347 Alta · 8.8 KEV Urgente · 76 Exploit público CWE-416 05/05/2013

Microsoft Internet Explorer Remote Code Execution Vulnerability

Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly allocated or (2) is deleted, as exploited in the wild in May 2013.

CVE-2013-2551 Alta · 8.8 KEV Urgente · 86 Exploit público Ransomware CWE-416 11/03/2013

Microsoft Internet Explorer Use-After-Free Vulnerability

Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than CVE-2013-1308 and CVE-2013-1309.

CVE-2012-4792 Alta · 8.8 KEV Urgente · 86 Exploit público CWE-416 30/12/2012

Microsoft Internet Explorer Use-After-Free Vulnerability

Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object, and exploited in the wild in December 2012.

CVE-2012-4969 Alta · 8.1 KEV Urgente · 76 Exploit público CWE-416 18/09/2012

Microsoft Internet Explorer Use-After-Free Vulnerability

Use-after-free vulnerability in the CMshtmlEd::Exec function in mshtml.dll in Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code via a crafted web site, as exploited in the wild in September 2012.

CVE-2011-3389 Média · 4.3 Exploit público CWE-326 06/09/2011

Inadequate Encryption Strength em Google Chrome

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.

CVE-2010-3962 Alta · 8.1 KEV Urgente · 79 Exploit público CWE-416 05/11/2010

Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability

Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors related to Cascading Style Sheets (CSS) token sequences and the clip attribute, aka an "invalid flag reference" issue or "Uninitialized Memory Corruption Vulnerability," as exploited in the wild in November 2010.

CVE-2010-0806 Alta · 8.8 KEV Urgente · 76 Exploit público CWE-399 10/03/2010

Microsoft Internet Explorer Use-After-Free Vulnerability

Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object, as exploited in the wild in March 2010, aka "Uninitialized Memory Corruption Vulnerability."

CVE-2010-0249 Alta · 8.8 KEV Urgente · 76 Exploit público CWE-416 15/01/2010

Microsoft Internet Explorer Use-After-Free Vulnerability

Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista Gold, SP1, and SP2; Windows Server 2008 Gold, SP2, and R2; and Windows 7 allows remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object, related to incorrectly initialized memory and improper handling of objects in memory, as exploited in the wild in December 2009 and January 2010 during Operation Aurora, aka "HTML Object Memory Corruption Vulnerability."