Vendor CVEs
Microsoft
All CVEs
15,658 total · sorted by risk| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2006-0376 | 0.01 | — | 0.18 | Jan 22, 2006 | The 802.11 wireless client in certain operating systems including Windows 2000, Windows XP, and Windows Server 2003 does not warn the user when (1) it establishes an association with a station in ad hoc (aka peer-to-peer) mode or (2) a station in ad hoc mode establishes an… | |||
| CVE-2005-4843 | 0.01 | — | 0.11 | Dec 31, 2005 | The SmartConnect Class control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of the class associated with the control's CLSID, which is not intended for use within Internet Explorer. | |||
| CVE-2005-4841 | 0.01 | — | 0.09 | Dec 31, 2005 | The Outlook Progress Ctl control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of the class associated with the control's CLSID, which is not intended for use within Internet Explorer. | |||
| CVE-2005-4842 | 0.01 | — | 0.09 | Dec 31, 2005 | The System Monitor Source Properties control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of the class associated with the control's CLSID, which is not intended for use within Internet Explorer. | |||
| CVE-2005-4827 | 0.01 | — | 0.11 | Dec 31, 2005 | Internet Explorer 6.0, and possibly other versions, allows remote attackers to bypass the same origin security policy and make requests outside of the intended domain by calling open on an XMLHttpRequest object (Microsoft.XMLHTTP) and using tab, newline, and carriage return… | |||
| CVE-2005-4679 | 0.01 | — | 0.08 | Dec 31, 2005 | Internet Explorer 6 for Windows XP Service Pack 2 allows remote attackers to spoof the URL in the status bar via the title in an image in a link to a trusted site within a form to the malicious site. | |||
| CVE-2005-4844 | 0.01 | — | 0.12 | Dec 31, 2005 | The CLSID_ApprenticeICW control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of the class associated with the control's CLSID, which is not intended for use within Internet Explorer. | |||
| CVE-2005-4810 | 0.01 | — | 0.14 | Dec 31, 2005 | Microsoft Internet Explorer 7.0 Beta3 and earlier allows remote attackers to cause a denial of service (crash) via a "text/html" HTML Content-type header sent in response to an XMLHttpRequest (AJAX). | |||
| CVE-2005-4840 | 0.01 | — | 0.12 | Dec 31, 2005 | The Outlook Express Address Book control, when using Internet Explorer 6, allows remote attackers to cause a denial of service (NULL dereference and browser crash) by creating the OutlookExpress.AddressBook COM object, which is not intended for use within Internet Explorer. | |||
| CVE-2005-2829 | 0.01 | — | 0.19 | Dec 14, 2005 | Multiple design errors in Microsoft Internet Explorer 5.01, 5.5, and 6 allow user-assisted attackers to execute arbitrary code by (1) overlaying a malicious new window above a file download box, then (2) using a keyboard shortcut and delaying the display of the file download box… | |||
| CVE-2005-3945 | 0.01 | — | 0.12 | Dec 1, 2005 | The SynAttackProtect protection in Microsoft Windows 2003 before SP1 and Windows 2000 before SP4 with Update Roll-up uses a hash of predictable data, which allows remote attackers to cause a denial of service (CPU consumption) via a flood of SYN packets that produce identical… | |||
| CVE-2005-3595 | 0.01 | — | 0.16 | Nov 16, 2005 | By default Microsoft Windows XP Home Edition installs with a blank password for the Administrator account, which allows remote attackers to gain control of the computer. | |||
| CVE-2005-3312 | 0.01 | — | 0.12 | Oct 26, 2005 | The HTML rendering engine in Microsoft Internet Explorer 6.0 allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML in corrupted images and other files such as .GIF, JPG, and WAV, which is rendered as HTML when the user clicks on the link, even though the… | |||
| CVE-2005-2126 | 0.01 | — | 0.14 | Oct 21, 2005 | The FTP client in Windows XP SP1 and Server 2003, and Internet Explorer 6 SP1 on Windows 2000 SP4, when "Enable Folder View for FTP Sites" is enabled and the user manually initiates a file transfer, allows user-assisted, remote FTP servers to overwrite files in arbitrary… | |||
| CVE-2005-1981 | 0.01 | — | 0.07 | Aug 10, 2005 | Unknown vulnerability in Microsoft Windows 2000 Server and Windows Server 2003 domain controllers allows remote authenticated users to cause a denial of service (system crash) via a crafted Kerberos message. | |||
| CVE-2005-2304 | 0.01 | — | 0.09 | Jul 19, 2005 | Microsoft MSN Messenger 9.0 and Internet Explorer 6.0 allows remote attackers to cause a denial of service (crash) via an image with an ICC Profile with a large Tag Count. | |||
| CVE-2005-2274 | 0.01 | — | 0.10 | Jul 13, 2005 | Microsoft Internet Explorer 6.0 does not clearly associate a Javascript dialog box with the web page that generated it, which allows remote attackers to spoof a dialog box from a trusted site and facilitates phishing attacks, aka the "Dialog Origin Spoofing Vulnerability." | |||
| CVE-2005-2225 | 0.01 | — | 0.16 | Jul 12, 2005 | Microsoft MSN Messenger allows remote attackers to cause a denial of service via a plaintext message containing the ".pif" string, which is interpreted as a malicious file extension and causes users to be kicked from a group conversation. NOTE: it has been reported that Gaim is… | |||
| CVE-2005-2226 | 0.01 | — | 0.13 | Jul 12, 2005 | Microsoft Outlook Express 6.0 leaks the default news server account when a user responds to a "watched" conversation thread, which could allow remote attackers to obtain sensitive information. | |||
| CVE-2005-2224 | 0.01 | — | 0.18 | Jul 12, 2005 | aspnet_wp.exe in Microsoft ASP.NET web services allows remote attackers to cause a denial of service (CPU consumption from infinite loop) via a crafted SOAP message to an RPC/Encoded method. | |||
| CVE-2005-0360 | 0.01 | — | 0.12 | Jul 5, 2005 | The Microsoft Log Sink Class ActiveX control in pkmcore.dll is marked as "safe for scripting" for Internet Explorer, which allows remote attackers to create or append to arbitrary files. | |||
| CVE-2005-0563 | 0.01 | — | 0.14 | Jun 14, 2005 | Cross-site scripting (XSS) vulnerability in Microsoft Outlook Web Access (OWA) component in Exchange Server 5.5 allows remote attackers to inject arbitrary web script or HTML via an email message with an encoded javascript: URL ("javAsc ript:") in an IMG tag. | |||
| CVE-2005-1214 | 0.01 | — | 0.13 | Jun 14, 2005 | Microsoft Agent allows remote attackers to spoof trusted Internet content and execute arbitrary code by disguising security prompts on a malicious Web page. | |||
| CVE-2005-1207 | 0.01 | — | 0.07 | Jun 14, 2005 | Buffer overflow in the Web Client service in Microsoft Windows XP and Windows Server 2003 allows remote authenticated users to execute arbitrary code via a crafted WebDAV request containing special parameters. | |||
| CVE-2005-0488 | 0.01 | — | 0.17 | Jun 14, 2005 | Certain BSD-based Telnet clients, including those used on Solaris and SuSE Linux, allow remote malicious Telnet servers to read sensitive environment variables via the NEW-ENVIRON option with a SEND ENV_USERVAR command. | |||
| CVE-2005-1792 | 0.01 | — | 0.07 | Jun 1, 2005 | Memory leak in Windows Management Instrumentation (WMI) service allows attackers to cause a denial of service (memory consumption and crash) by creating security contexts more quickly than they can be cleared from the RPC cache. | |||
| CVE-2005-1793 | 0.01 | — | 0.07 | Jun 1, 2005 | User32.DLL in Microsoft Windows 98SE, and possibly other operating systems, allows local and remote attackers to cause a denial of service (crash) via an icon (.ico) bitmap file with large width and height values. | |||
| CVE-2005-1829 | 0.01 | — | 0.13 | May 28, 2005 | Microsoft Internet Explorer 6 SP2 allows remote attackers to cause a denial of service (infinite loop and application crash) via two embedded files that call each other. | |||
| CVE-2005-1683 | 0.01 | — | 0.15 | May 20, 2005 | Buffer overflow in winword.exe 10.2627.6714 and earlier in Microsoft Word for the Macintosh, before SP3 for Word 2002, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted mcw file. | |||
| CVE-2005-0558 | 0.01 | — | 0.15 | May 2, 2005 | Buffer overflow in Microsoft Word 2000, Word 2002, and Word 2003 allows remote attackers to execute arbitrary code via a crafted document. | |||
| CVE-2005-0954 | 0.01 | — | 0.15 | May 2, 2005 | Windows Explorer and Internet Explorer in Windows 2000 SP1 allows remote attackers to cause a denial of service (CPU consumption) via a malformed Windows Metafile (WMF) file. | |||
| CVE-2005-1052 | 0.01 | — | 0.09 | May 2, 2005 | Microsoft Outlook 2003 and Outlook Web Access (OWA) 2003 do not properly display comma separated addresses in the From field in an e-mail message, which could allow remote attackers to spoof e-mail addresses. | |||
| CVE-2005-0500 | 0.01 | — | 0.11 | May 2, 2005 | Internet Explorer 6.0 on Windows XP SP2 allows remote attackers to spoof the domain name of a URL in a titlebar for a script-initiated popup window, which could facilitate phishing attacks. | |||
| CVE-2005-0509 | 0.01 | — | 0.16 | Mar 14, 2005 | Multiple cross-site scripting (XSS) vulnerabilities in the Mono 1.0.5 implementation of ASP.NET (.Net) allow remote attackers to inject arbitrary HTML or web script via Unicode representations for ASCII fullwidth characters that are converted to normal ASCII characters,… | |||
| CVE-2004-0892 | 0.01 | — | 0.17 | Jan 27, 2005 | Microsoft Proxy Server 2.0 and Microsoft ISA Server 2000 (which is included in Small Business Server 2000 and Small Business Server 2003 Premium Edition) allows remote attackers to spoof trusted Internet content on a specially crafted webpage via spoofed reverse DNS lookup… | |||
| CVE-2005-0110 | 0.01 | — | 0.07 | Jan 14, 2005 | Internet Explorer 6 on Windows XP SP2 allows remote attackers to bypass the file download warning dialog and possibly trick an unknowledgeable user into executing arbitrary code via a web page with a body element containing an onclick tag, as demonstrated using the createElement… | |||
| CVE-2004-1133 | 0.01 | — | 0.10 | Jan 10, 2005 | Multiple cross-site scripting (XSS) vulnerabilities in Microsoft W3Who ISAPI (w3who.dll) allow remote attackers to inject arbitrary HTML and web script via (1) HTTP headers such as "Connection" or (2) invalid parameters whose values are echoed in the resulting error message. | |||
| CVE-2004-1173 | 0.01 | — | 0.12 | Dec 31, 2004 | Internet Explorer 6 allows remote attackers to bypass the popup blocker via the document object model (DOM) methods in the DHTML Dynamic HTML (DHTML) Editing Component (DEC) and Javascript that calls showModalDialog. | |||
| CVE-2004-2307 | 0.01 | — | 0.15 | Dec 31, 2004 | Microsoft Internet Explorer 6.0.2600 on Windows XP allows remote attackers to cause a denial of service (browser crash) via a shell: URI with double backslashes (\\) in an HTML tag such as IFRAME or A. | |||
| CVE-2004-2476 | 0.01 | — | 0.09 | Dec 31, 2004 | Microsoft Internet Explorer 6.0 allows remote attackers to cause a denial of service (infinite loop and crash) via an IFRAME with "?" as the file source. | |||
| CVE-2004-2219 | 0.01 | — | 0.08 | Dec 31, 2004 | Microsoft Internet Explorer 6 allows remote attackers to spoof the address bar to facilitate phishing attacks via Javascript that uses an invalid URI, modifies the Location field, then uses history.back to navigate to the previous domain, aka NullyFake. | |||
| CVE-2004-2011 | 0.01 | — | 0.07 | Dec 31, 2004 | msxml3.dll in Internet Explorer 6.0.2600.0 allows remote attackers to cause a denial of service (crash) via a single & (ampersand) in a link, which triggers a parsing error, possibly due to missing portions of the URI. | |||
| CVE-2004-2694 | 0.01 | — | 0.09 | Dec 31, 2004 | Microsoft Outlook Express 6.0 allows remote attackers to bypass intended access restrictions, load content from arbitrary sources into the Outlook context, and facilitate phishing attacks via a "BASE HREF" with the target set to "_top". | |||
| CVE-2004-2179 | 0.01 | — | 0.12 | Dec 31, 2004 | asycpict.dll, as used in Microsoft products such as Front Page 97 and 98, allows remote attackers to cause a denial of service (hang) via a JPEG image with maximum height and width values. | |||
| CVE-2004-1155 | 0.01 | — | 0.13 | Dec 31, 2004 | Internet Explorer 5.01 through 6 allows remote attackers to spoof arbitrary web sites by injecting content from one window into another window whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the "window… | |||
| CVE-2004-2482 | 0.01 | — | 0.13 | Dec 31, 2004 | Microsoft Outlook 2000 and 2003, when configured to use Microsoft Word 2000 or 2003 as the e-mail editor and when forwarding e-mail, does not properly handle an opening OBJECT tag that does not have a closing OBJECT tag, which causes Outlook to automatically download the URI in… | |||
| CVE-2004-2643 | 0.01 | — | 0.07 | Dec 31, 2004 | Directory traversal vulnerability in Microsoft cabarc allows remote attackers to overwrite files via "../" sequences in file names in a CAB archive. | |||
| CVE-2004-1376 | 0.01 | — | 0.09 | Dec 30, 2004 | Directory traversal vulnerability in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote malicious FTP servers to overwrite arbitrary files via .. (dot dot) sequences in filenames returned from a LIST command. | |||
| CVE-2004-0867 | 0.01 | — | 0.17 | Dec 23, 2004 | Mozilla Firefox 0.9.2 allows web sites to set cookies for country-specific top-level domains, such as .ltd.uk, .plc.uk, and .sch.uk, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session. NOTE: it was later reported that 2.x is… | |||
| CVE-2004-0610 | 0.01 | — | 0.15 | Dec 6, 2004 | The Web administration interface in Microsoft MN-500 Wireless Router allows remote attackers to cause a denial of service (connection refusal) via a large number of open HTTP connections. |
- CVE-2006-0376Jan 22, 2006risk 0.01cvss —epss 0.18
The 802.11 wireless client in certain operating systems including Windows 2000, Windows XP, and Windows Server 2003 does not warn the user when (1) it establishes an association with a station in ad hoc (aka peer-to-peer) mode or (2) a station in ad hoc mode establishes an…
- CVE-2005-4843Dec 31, 2005risk 0.01cvss —epss 0.11
The SmartConnect Class control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of the class associated with the control's CLSID, which is not intended for use within Internet Explorer.
- CVE-2005-4841Dec 31, 2005risk 0.01cvss —epss 0.09
The Outlook Progress Ctl control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of the class associated with the control's CLSID, which is not intended for use within Internet Explorer.
- CVE-2005-4842Dec 31, 2005risk 0.01cvss —epss 0.09
The System Monitor Source Properties control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of the class associated with the control's CLSID, which is not intended for use within Internet Explorer.
- CVE-2005-4827Dec 31, 2005risk 0.01cvss —epss 0.11
Internet Explorer 6.0, and possibly other versions, allows remote attackers to bypass the same origin security policy and make requests outside of the intended domain by calling open on an XMLHttpRequest object (Microsoft.XMLHTTP) and using tab, newline, and carriage return…
- CVE-2005-4679Dec 31, 2005risk 0.01cvss —epss 0.08
Internet Explorer 6 for Windows XP Service Pack 2 allows remote attackers to spoof the URL in the status bar via the title in an image in a link to a trusted site within a form to the malicious site.
- CVE-2005-4844Dec 31, 2005risk 0.01cvss —epss 0.12
The CLSID_ApprenticeICW control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of the class associated with the control's CLSID, which is not intended for use within Internet Explorer.
- CVE-2005-4810Dec 31, 2005risk 0.01cvss —epss 0.14
Microsoft Internet Explorer 7.0 Beta3 and earlier allows remote attackers to cause a denial of service (crash) via a "text/html" HTML Content-type header sent in response to an XMLHttpRequest (AJAX).
- CVE-2005-4840Dec 31, 2005risk 0.01cvss —epss 0.12
The Outlook Express Address Book control, when using Internet Explorer 6, allows remote attackers to cause a denial of service (NULL dereference and browser crash) by creating the OutlookExpress.AddressBook COM object, which is not intended for use within Internet Explorer.
- CVE-2005-2829Dec 14, 2005risk 0.01cvss —epss 0.19
Multiple design errors in Microsoft Internet Explorer 5.01, 5.5, and 6 allow user-assisted attackers to execute arbitrary code by (1) overlaying a malicious new window above a file download box, then (2) using a keyboard shortcut and delaying the display of the file download box…
- CVE-2005-3945Dec 1, 2005risk 0.01cvss —epss 0.12
The SynAttackProtect protection in Microsoft Windows 2003 before SP1 and Windows 2000 before SP4 with Update Roll-up uses a hash of predictable data, which allows remote attackers to cause a denial of service (CPU consumption) via a flood of SYN packets that produce identical…
- CVE-2005-3595Nov 16, 2005risk 0.01cvss —epss 0.16
By default Microsoft Windows XP Home Edition installs with a blank password for the Administrator account, which allows remote attackers to gain control of the computer.
- CVE-2005-3312Oct 26, 2005risk 0.01cvss —epss 0.12
The HTML rendering engine in Microsoft Internet Explorer 6.0 allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML in corrupted images and other files such as .GIF, JPG, and WAV, which is rendered as HTML when the user clicks on the link, even though the…
- CVE-2005-2126Oct 21, 2005risk 0.01cvss —epss 0.14
The FTP client in Windows XP SP1 and Server 2003, and Internet Explorer 6 SP1 on Windows 2000 SP4, when "Enable Folder View for FTP Sites" is enabled and the user manually initiates a file transfer, allows user-assisted, remote FTP servers to overwrite files in arbitrary…
- CVE-2005-1981Aug 10, 2005risk 0.01cvss —epss 0.07
Unknown vulnerability in Microsoft Windows 2000 Server and Windows Server 2003 domain controllers allows remote authenticated users to cause a denial of service (system crash) via a crafted Kerberos message.
- CVE-2005-2304Jul 19, 2005risk 0.01cvss —epss 0.09
Microsoft MSN Messenger 9.0 and Internet Explorer 6.0 allows remote attackers to cause a denial of service (crash) via an image with an ICC Profile with a large Tag Count.
- CVE-2005-2274Jul 13, 2005risk 0.01cvss —epss 0.10
Microsoft Internet Explorer 6.0 does not clearly associate a Javascript dialog box with the web page that generated it, which allows remote attackers to spoof a dialog box from a trusted site and facilitates phishing attacks, aka the "Dialog Origin Spoofing Vulnerability."
- CVE-2005-2225Jul 12, 2005risk 0.01cvss —epss 0.16
Microsoft MSN Messenger allows remote attackers to cause a denial of service via a plaintext message containing the ".pif" string, which is interpreted as a malicious file extension and causes users to be kicked from a group conversation. NOTE: it has been reported that Gaim is…
- CVE-2005-2226Jul 12, 2005risk 0.01cvss —epss 0.13
Microsoft Outlook Express 6.0 leaks the default news server account when a user responds to a "watched" conversation thread, which could allow remote attackers to obtain sensitive information.
- CVE-2005-2224Jul 12, 2005risk 0.01cvss —epss 0.18
aspnet_wp.exe in Microsoft ASP.NET web services allows remote attackers to cause a denial of service (CPU consumption from infinite loop) via a crafted SOAP message to an RPC/Encoded method.
- CVE-2005-0360Jul 5, 2005risk 0.01cvss —epss 0.12
The Microsoft Log Sink Class ActiveX control in pkmcore.dll is marked as "safe for scripting" for Internet Explorer, which allows remote attackers to create or append to arbitrary files.
- CVE-2005-0563Jun 14, 2005risk 0.01cvss —epss 0.14
Cross-site scripting (XSS) vulnerability in Microsoft Outlook Web Access (OWA) component in Exchange Server 5.5 allows remote attackers to inject arbitrary web script or HTML via an email message with an encoded javascript: URL ("javAsc ript:") in an IMG tag.
- CVE-2005-1214Jun 14, 2005risk 0.01cvss —epss 0.13
Microsoft Agent allows remote attackers to spoof trusted Internet content and execute arbitrary code by disguising security prompts on a malicious Web page.
- CVE-2005-1207Jun 14, 2005risk 0.01cvss —epss 0.07
Buffer overflow in the Web Client service in Microsoft Windows XP and Windows Server 2003 allows remote authenticated users to execute arbitrary code via a crafted WebDAV request containing special parameters.
- CVE-2005-0488Jun 14, 2005risk 0.01cvss —epss 0.17
Certain BSD-based Telnet clients, including those used on Solaris and SuSE Linux, allow remote malicious Telnet servers to read sensitive environment variables via the NEW-ENVIRON option with a SEND ENV_USERVAR command.
- CVE-2005-1792Jun 1, 2005risk 0.01cvss —epss 0.07
Memory leak in Windows Management Instrumentation (WMI) service allows attackers to cause a denial of service (memory consumption and crash) by creating security contexts more quickly than they can be cleared from the RPC cache.
- CVE-2005-1793Jun 1, 2005risk 0.01cvss —epss 0.07
User32.DLL in Microsoft Windows 98SE, and possibly other operating systems, allows local and remote attackers to cause a denial of service (crash) via an icon (.ico) bitmap file with large width and height values.
- CVE-2005-1829May 28, 2005risk 0.01cvss —epss 0.13
Microsoft Internet Explorer 6 SP2 allows remote attackers to cause a denial of service (infinite loop and application crash) via two embedded files that call each other.
- CVE-2005-1683May 20, 2005risk 0.01cvss —epss 0.15
Buffer overflow in winword.exe 10.2627.6714 and earlier in Microsoft Word for the Macintosh, before SP3 for Word 2002, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted mcw file.
- CVE-2005-0558May 2, 2005risk 0.01cvss —epss 0.15
Buffer overflow in Microsoft Word 2000, Word 2002, and Word 2003 allows remote attackers to execute arbitrary code via a crafted document.
- CVE-2005-0954May 2, 2005risk 0.01cvss —epss 0.15
Windows Explorer and Internet Explorer in Windows 2000 SP1 allows remote attackers to cause a denial of service (CPU consumption) via a malformed Windows Metafile (WMF) file.
- CVE-2005-1052May 2, 2005risk 0.01cvss —epss 0.09
Microsoft Outlook 2003 and Outlook Web Access (OWA) 2003 do not properly display comma separated addresses in the From field in an e-mail message, which could allow remote attackers to spoof e-mail addresses.
- CVE-2005-0500May 2, 2005risk 0.01cvss —epss 0.11
Internet Explorer 6.0 on Windows XP SP2 allows remote attackers to spoof the domain name of a URL in a titlebar for a script-initiated popup window, which could facilitate phishing attacks.
- CVE-2005-0509Mar 14, 2005risk 0.01cvss —epss 0.16
Multiple cross-site scripting (XSS) vulnerabilities in the Mono 1.0.5 implementation of ASP.NET (.Net) allow remote attackers to inject arbitrary HTML or web script via Unicode representations for ASCII fullwidth characters that are converted to normal ASCII characters,…
- CVE-2004-0892Jan 27, 2005risk 0.01cvss —epss 0.17
Microsoft Proxy Server 2.0 and Microsoft ISA Server 2000 (which is included in Small Business Server 2000 and Small Business Server 2003 Premium Edition) allows remote attackers to spoof trusted Internet content on a specially crafted webpage via spoofed reverse DNS lookup…
- CVE-2005-0110Jan 14, 2005risk 0.01cvss —epss 0.07
Internet Explorer 6 on Windows XP SP2 allows remote attackers to bypass the file download warning dialog and possibly trick an unknowledgeable user into executing arbitrary code via a web page with a body element containing an onclick tag, as demonstrated using the createElement…
- CVE-2004-1133Jan 10, 2005risk 0.01cvss —epss 0.10
Multiple cross-site scripting (XSS) vulnerabilities in Microsoft W3Who ISAPI (w3who.dll) allow remote attackers to inject arbitrary HTML and web script via (1) HTTP headers such as "Connection" or (2) invalid parameters whose values are echoed in the resulting error message.
- CVE-2004-1173Dec 31, 2004risk 0.01cvss —epss 0.12
Internet Explorer 6 allows remote attackers to bypass the popup blocker via the document object model (DOM) methods in the DHTML Dynamic HTML (DHTML) Editing Component (DEC) and Javascript that calls showModalDialog.
- CVE-2004-2307Dec 31, 2004risk 0.01cvss —epss 0.15
Microsoft Internet Explorer 6.0.2600 on Windows XP allows remote attackers to cause a denial of service (browser crash) via a shell: URI with double backslashes (\\) in an HTML tag such as IFRAME or A.
- CVE-2004-2476Dec 31, 2004risk 0.01cvss —epss 0.09
Microsoft Internet Explorer 6.0 allows remote attackers to cause a denial of service (infinite loop and crash) via an IFRAME with "?" as the file source.
- CVE-2004-2219Dec 31, 2004risk 0.01cvss —epss 0.08
Microsoft Internet Explorer 6 allows remote attackers to spoof the address bar to facilitate phishing attacks via Javascript that uses an invalid URI, modifies the Location field, then uses history.back to navigate to the previous domain, aka NullyFake.
- CVE-2004-2011Dec 31, 2004risk 0.01cvss —epss 0.07
msxml3.dll in Internet Explorer 6.0.2600.0 allows remote attackers to cause a denial of service (crash) via a single & (ampersand) in a link, which triggers a parsing error, possibly due to missing portions of the URI.
- CVE-2004-2694Dec 31, 2004risk 0.01cvss —epss 0.09
Microsoft Outlook Express 6.0 allows remote attackers to bypass intended access restrictions, load content from arbitrary sources into the Outlook context, and facilitate phishing attacks via a "BASE HREF" with the target set to "_top".
- CVE-2004-2179Dec 31, 2004risk 0.01cvss —epss 0.12
asycpict.dll, as used in Microsoft products such as Front Page 97 and 98, allows remote attackers to cause a denial of service (hang) via a JPEG image with maximum height and width values.
- CVE-2004-1155Dec 31, 2004risk 0.01cvss —epss 0.13
Internet Explorer 5.01 through 6 allows remote attackers to spoof arbitrary web sites by injecting content from one window into another window whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the "window…
- CVE-2004-2482Dec 31, 2004risk 0.01cvss —epss 0.13
Microsoft Outlook 2000 and 2003, when configured to use Microsoft Word 2000 or 2003 as the e-mail editor and when forwarding e-mail, does not properly handle an opening OBJECT tag that does not have a closing OBJECT tag, which causes Outlook to automatically download the URI in…
- CVE-2004-2643Dec 31, 2004risk 0.01cvss —epss 0.07
Directory traversal vulnerability in Microsoft cabarc allows remote attackers to overwrite files via "../" sequences in file names in a CAB archive.
- CVE-2004-1376Dec 30, 2004risk 0.01cvss —epss 0.09
Directory traversal vulnerability in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote malicious FTP servers to overwrite arbitrary files via .. (dot dot) sequences in filenames returned from a LIST command.
- CVE-2004-0867Dec 23, 2004risk 0.01cvss —epss 0.17
Mozilla Firefox 0.9.2 allows web sites to set cookies for country-specific top-level domains, such as .ltd.uk, .plc.uk, and .sch.uk, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session. NOTE: it was later reported that 2.x is…
- CVE-2004-0610Dec 6, 2004risk 0.01cvss —epss 0.15
The Web administration interface in Microsoft MN-500 Wireless Router allows remote attackers to cause a denial of service (connection refusal) via a large number of open HTTP connections.
Page 282 of 314