Vendor CVEs

Microsoft

All CVEs

18,135 total · sorted by risk

CVE	Vendor / Product	Risk	CVSS	EPSS	Published	Description
CVE-2003-0223	Microsoft Internet Information Server	0.01	—	0.17	Jun 9, 2003	Cross-site scripting vulnerability (XSS) in the ASP function responsible for redirection in Microsoft Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to embed a URL containing script in a redirection message.
CVE-2002-1564	Microsoft Internet Explorer	0.01	—	0.12	Jun 9, 2003	Internet Explorer 5.5 and 6.0 allows remote attackers to steal potentially sensitive information from cookies via a cookie that contains script which is executed when a page is loaded, aka the "Script within Cookies Reading Cookies" vulnerability.
CVE-2003-0224	Microsoft Internet Information Server	0.01	—	0.18	Jun 9, 2003	Buffer overflow in ssinc.dll for Microsoft Internet Information Services (IIS) 5.0 allows local users to execute arbitrary code via a web page with a Server Side Include (SSI) directive with a long filename, aka "Server Side Include Web Pages Buffer Overrun."
CVE-2003-0114	Microsoft Internet Explorer	0.01	—	0.15	May 12, 2003	The file upload control in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to automatically upload files from the local system via a web page containing a script to upload the files.
CVE-2003-0115	Microsoft Internet Explorer	0.01	—	0.12	May 12, 2003	Microsoft Internet Explorer 5.01, 5.5 and 6.0 does not properly check parameters that are passed during third party rendering, which could allow remote attackers to execute arbitrary web script, aka the "Third Party Plugin Rendering" vulnerability, a different vulnerability than…
CVE-2003-0110	Microsoft Proxy Server	0.01	—	0.18	May 5, 2003	The Winsock Proxy service in Microsoft Proxy Server 2.0 and the Microsoft Firewall service in Internet Security and Acceleration (ISA) Server 2000 allow remote attackers to cause a denial of service (CPU consumption or packet storm) via a spoofed, malformed packet to UDP port…
CVE-2003-0011	Microsoft Isa Server	0.01	—	0.13	Mar 24, 2003	Unknown vulnerability in the DNS intrusion detection application filter for Microsoft Internet Security and Acceleration (ISA) Server 2000 allows remote attackers to cause a denial of service (blocked traffic to DNS servers) via a certain type of incoming DNS request that is not…
CVE-2003-1326	Microsoft Internet Explorer	0.01	—	0.16	Feb 19, 2003	Microsoft Internet Explorer 5.5 and 6.0 allows remote attackers to bypass the cross-domain security model to run malicious script or arbitrary programs via dialog boxes, aka "Improper Cross Domain Security Validation with dialog box."
CVE-2002-1908	Microsoft IIS	0.01	—	0.14	Dec 31, 2002	Microsoft IIS 5.0 and 5.1 allows remote attackers to cause a denial of service (CPU consumption) via an HTTP request with a Host header that contains a large number of "/" (forward slash) characters.
CVE-2002-2101	Microsoft Outlook	0.01	—	0.11	Dec 31, 2002	Microsoft Outlook 2002 allows remote attackers to execute arbitrary JavaScript code, even when scripting is disabled, via an "about:" or "javascript:" URI in the href attribute of an "a" tag.
CVE-2002-2189	Activxperts Software Activwebserver	0.01	—	0.07	Dec 31, 2002	Cross-site scripting (XSS) vulnerability in ActiveXperts Software ActiveWebserver allows remote attackers to execute arbitrary web script via a link.
CVE-2002-2081	Microsoft Site Server	0.01	—	0.15	Dec 31, 2002	cphost.dll in Microsoft Site Server 3.0 allows remote attackers to cause a denial of service (disk consumption) via an HTTP POST of a file with a long TargetURL parameter, which causes Site Server to abort and leaves the uploaded file in c:\temp.
CVE-2002-2117	Microsoft Windows Xp	0.01	—	0.12	Dec 31, 2002	Microsoft Windows XP allows remote attackers to cause a denial of service (CPU consumption) by flooding UDP port 500 (ISAKMP).
CVE-2002-1694	Microsoft Internet Information Server	0.01	—	0.13	Dec 31, 2002	Microsoft Internet Information Server (IIS) 4.0 opens log files with FILE_SHARE_READ and FILE_SHARE_WRITE permissions, which could allow remote attackers to modify the log file contents while IIS is running.
CVE-2002-2328	Microsoft Windows 2000	0.01	—	0.17	Dec 31, 2002	Active Directory in Windows 2000, when supporting Kerberos V authentication and GSSAPI, allows remote attackers to cause a denial of service (hang) via an LDAP client that sets the page length to zero during a large request.
CVE-2002-1671	Microsoft Internet Explorer	0.01	—	0.12	Dec 31, 2002	Microsoft Internet Explorer 5.0, 5.01, and 5.5 allows remote attackers to monitor the contents of the clipboard via the getData method of the clipboardData object.
CVE-2002-1698	Microsoft Msn Messenger	0.01	—	0.16	Dec 31, 2002	Buffer overflow in Microsoft MSN Messenger Service 1.0 through 4.6 allows remote attackers to cause a denial of service (crash) via a long FN (font) argument in the message header.
CVE-2002-2077	Microsoft Windows 2000	0.01	—	0.16	Dec 31, 2002	The DCOM client in Windows 2000 before SP3 does not properly clear memory before sending an "alter context" request, which may allow remote attackers to obtain sensitive information by sniffing the session.
CVE-2002-1873	Microsoft Exchange 2000	0.01	—	0.14	Dec 31, 2002	Microsoft Exchange 2000, when used with Microsoft Remote Procedure Call (MSRPC), allows remote attackers to cause a denial of service (crash or memory consumption) via malformed MSRPC calls.
CVE-2002-1769	Microsoft Site Server	0.01	—	0.12	Dec 31, 2002	Microsoft Site Server 3.0 prior to SP4 installs a default user, LDAP_Anonymous, with a default password of LdapPassword_1, which allows remote attackers the "Log on locally" privilege.
CVE-2002-1795	Microsoft Terminal Services Advanced Client (TSAC)	0.01	—	0.17	Dec 31, 2002	Cross-site scripting (XSS) vulnerability in connect.asp in Microsoft Terminal Services Advanced Client (TSAC) ActiveX control allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVE-2002-2125	Microsoft Internet Explorer	0.01	—	0.08	Dec 31, 2002	Internet Explorer 6.0 does not warn users when an expired certificate authority (CA) certificate is submitted to the user and a newer CA certificate is in the user's local repository, which could allow remote attackers to decrypt web sessions via a man-in-the-middle (MITM)…
CVE-2002-1762	Microsoft Baseline Security Analyzer	0.01	—	0.16	Dec 31, 2002	Microsoft Baseline Security Analyzer (MBSA) 1.0 stores security scans in a known location C:\Documents and Settings\username\SecurityScans in plaintext, which could allow remote attackers to obtain sensitive information about the system via malicious active content such as…
CVE-2002-1717	Microsoft Internet Information Server	0.01	—	0.16	Dec 31, 2002	Microsoft Internet Information Server (IIS) 5.1 allows remote attackers to view path information via a GET request to (1) /_vti_pvt/access.cnf, (2) /_vti_pvt/botinfs.cnf, (3) /_vti_pvt/bots.cnf, or (4) /_vti_pvt/linkinfo.cnf.
CVE-2002-1918	Microsoft MDAC	0.01	—	0.16	Dec 31, 2002	Buffer overflow in Microsoft Active Data Objects (ADO) in Microsoft MDAC 2.5 through 2.7 allows remote attackers to have unknown impact with unknown attack vectors. NOTE: due to the lack of details available regarding this issue, perhaps it should be REJECTED.
CVE-2002-1695	Symantec Norton Internet Security	0.01	—	0.14	Dec 31, 2002	Norton Internet Security 2001 opens log files with FILE_SHARE_READ and FILE_SHARE_WRITE permissions, which could allow remote attackers to modify the log file contents while Norton Internet Security is running.
CVE-2002-2311	Microsoft Internet Explorer	0.01	—	0.10	Dec 31, 2002	Microsoft Internet Explorer 6.0 and possibly others allows remote attackers to upload arbitrary file contents when users press a key corresponding to the JavaScript (1) event.ctrlKey or (2) event.shiftKey onkeydown event contained in a webpage. NOTE: it was reported that the…
CVE-2002-1718	Microsoft Internet Information Server	0.01	—	0.15	Dec 31, 2002	Microsoft Internet Information Server (IIS) 5.1 may allow remote attackers to view the contents of a Frontpage Server Extension (FPSE) file, as claimed using an HTTP request for colegal.htm that contains .. (dot dot) sequences.
CVE-2002-2380	Microsoft Network Firmware	0.01	—	0.11	Dec 31, 2002	NetDSL ADSL Modem 800 with Microsoft Network firmware 5.5.11 allows remote attackers to gain access to configuration menus by sniffing undocumented usernames and passwords from network traffic.
CVE-2002-2100	Microsoft Outlook	0.01	—	0.11	Dec 31, 2002	Microsoft Outlook 2002 allows remote attackers to embed bypass the file download restrictions for attachments via an HTML email message that uses an IFRAME to reference malicious content.
CVE-2002-1984	Microsoft Internet Explorer	0.01	—	0.09	Dec 31, 2002	Microsoft Internet Explorer 5.0.1 through 6.0 on Windows 2000 or Windows XP allows remote attackers to cause a denial of service (crash) via an OBJECT tag that contains a crafted CLASSID (CLSID) value of "CLSID:00022613-0000-0000-C000-000000000046".
CVE-2002-1932	Microsoft Windows 2000	0.01	—	0.13	Dec 31, 2002	Microsoft Windows XP and Windows 2000, when configured to send administrative alerts and the "Do not overwrite events (clear log manually)" option is set, does not notify the administrator when the log reaches its maximum size, which allows local users and remote attackers to…
CVE-2002-1716	Microsoft Office	0.01	—	0.14	Dec 31, 2002	The Host() function in the Microsoft spreadsheet component on Microsoft Office XP allows remote attackers to create arbitrary files using the SaveAs capability.
CVE-2002-1257	Microsoft Windows Nt	0.01	—	0.15	Dec 23, 2002	Microsoft Virtual Machine (VM) up to and including build 5.0.3805 allows remote attackers to execute arbitrary code by including a Java applet that invokes COM (Component Object Model) objects in a web site or an HTML mail.
CVE-2002-1260	Microsoft Windows Nt	0.01	—	0.16	Dec 23, 2002	The Java Database Connectivity (JDBC) APIs in Microsoft Virtual Machine (VM) 5.0.3805 and earlier allow remote attackers to bypass security checks and access database contents via an untrusted Java applet.
CVE-2002-1325	Microsoft Windows Nt	0.01	—	0.14	Dec 23, 2002	Microsoft Virtual Machine (VM) build 5.0.3805 and earlier allows remote attackers to determine a local user's username via a Java applet that accesses the user.dir system property, aka "User.dir Exposure Vulnerability."
CVE-2002-1258	Microsoft Windows Nt	0.01	—	0.15	Dec 23, 2002	Two vulnerabilities in Microsoft Virtual Machine (VM) up to and including build 5.0.3805, as used in Internet Explorer and other applications, allow remote attackers to read files via a Java applet with a spoofed location in the CODEBASE parameter in the APPLET tag, possibly due…
CVE-2002-1340	Microsoft Office Web Components	0.01	—	0.12	Dec 18, 2002	The "ConnectionFile" property in the DataSourceControl component in Office Web Components (OWC) 10 allows remote attackers to determine the existence of local files by detecting an exception.
CVE-2002-1255	Microsoft Outlook	0.01	—	0.14	Dec 18, 2002	Microsoft Outlook 2002 allows remote attackers to cause a denial of service (repeated failure) via an email message with a certain invalid header field that is accessed using POP3, IMAP, or WebDAV, aka "E-mail Header Processing Flaw Could Cause Outlook 2002 to Fail."
CVE-2002-1262	Microsoft Internet Explorer	0.01	—	0.12	Dec 18, 2002	Internet Explorer 5.5 and 6.0 does not perform complete security checks on external caching, which allows remote attackers to read arbitrary files.
CVE-2002-1339	Microsoft Office Web Components	0.01	—	0.12	Dec 18, 2002	The "XMLURL" property in the Spreadsheet component of Office Web Components (OWC) 10 follows redirections, which allows remote attackers to determine the existence of local files based on exceptions, or to read WorkSheet XML files.
CVE-2002-1188	Microsoft Internet Explorer	0.01	—	0.12	Dec 11, 2002	Internet Explorer 5.01 through 6.0 allows remote attackers to identify the path to the Temporary Internet Files folder and obtain user information such as cookies via certain uses of the OBJECT tag, which are not subjected to the proper security checks, aka "Temporary Internet…
CVE-2002-1295	Microsoft Java implementation	0.01	—	0.15	Nov 29, 2002	The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to cause a denial of service (crash) and possibly conduct other unauthorized activities via applet tags in HTML that bypass Java class restrictions (such as private constructors) by…
CVE-2002-1293	Microsoft Java Virtual Machine	0.01	—	0.15	Nov 29, 2002	The Microsoft Java implementation, as used in Internet Explorer, provides a public load0() method for the CabCracker class (com.ms.vm.loader.CabCracker), which allows remote attackers to bypass the security checks that are performed by the load() method.
CVE-2002-1288	Microsoft Java Virtual Machine	0.01	—	0.17	Nov 29, 2002	The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to determine the current directory of the Internet Explorer process via the getAbsolutePath() method in a File() call.
CVE-2002-1290	Microsoft Java implementation	0.01	—	0.14	Nov 29, 2002	The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to read and modify the contents of the Clipboard via an applet that accesses the (1) ClipBoardGetText and (2) ClipBoardSetText methods of the INativeServices class.
CVE-2002-1294	Microsoft Internet Explorer	0.01	—	0.15	Nov 29, 2002	The Microsoft Java implementation, as used in Internet Explorer, can provide HTML object references to applets via Javascript, which allows remote attackers to cause a denial of service (crash due to illegal memory accesses) and possibly conduct other unauthorized activities via…
CVE-2002-1291	Microsoft Java Virtual Machine	0.01	—	0.18	Nov 29, 2002	The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to read arbitrary local files and network shares via an applet tag with a codebase set to a "file://%00" (null character) URL.
CVE-2002-1289	Microsoft Java implementation	0.01	—	0.16	Nov 29, 2002	The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to read restricted process memory, cause a denial of service (crash), and possibly execute arbitrary code via the getNativeServices function, which creates an instance of the…
CVE-2002-1180	Microsoft Internet Information Server	0.01	—	0.10	Nov 12, 2002	A typographical error in the script source access permissions for Internet Information Server (IIS) 5.0 does not properly exclude .COM files, which allows attackers with only write permissions to upload malicious .COM files, aka "Script Source Access Vulnerability."

CVE-2003-0223Jun 9, 2003
Microsoft
Internet Information Server
risk 0.01cvss —epss 0.17
Cross-site scripting vulnerability (XSS) in the ASP function responsible for redirection in Microsoft Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to embed a URL containing script in a redirection message.
CVE-2002-1564Jun 9, 2003
Microsoft
Internet Explorer
risk 0.01cvss —epss 0.12
Internet Explorer 5.5 and 6.0 allows remote attackers to steal potentially sensitive information from cookies via a cookie that contains script which is executed when a page is loaded, aka the "Script within Cookies Reading Cookies" vulnerability.
CVE-2003-0224Jun 9, 2003
Microsoft
Internet Information Server
risk 0.01cvss —epss 0.18
Buffer overflow in ssinc.dll for Microsoft Internet Information Services (IIS) 5.0 allows local users to execute arbitrary code via a web page with a Server Side Include (SSI) directive with a long filename, aka "Server Side Include Web Pages Buffer Overrun."
CVE-2003-0114May 12, 2003
Microsoft
Internet Explorer
risk 0.01cvss —epss 0.15
The file upload control in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to automatically upload files from the local system via a web page containing a script to upload the files.
CVE-2003-0115May 12, 2003
Microsoft
Internet Explorer
risk 0.01cvss —epss 0.12
Microsoft Internet Explorer 5.01, 5.5 and 6.0 does not properly check parameters that are passed during third party rendering, which could allow remote attackers to execute arbitrary web script, aka the "Third Party Plugin Rendering" vulnerability, a different vulnerability than…
CVE-2003-0110May 5, 2003
Microsoft
Proxy Server
risk 0.01cvss —epss 0.18
The Winsock Proxy service in Microsoft Proxy Server 2.0 and the Microsoft Firewall service in Internet Security and Acceleration (ISA) Server 2000 allow remote attackers to cause a denial of service (CPU consumption or packet storm) via a spoofed, malformed packet to UDP port…
CVE-2003-0011Mar 24, 2003
Microsoft
Isa Server
risk 0.01cvss —epss 0.13
Unknown vulnerability in the DNS intrusion detection application filter for Microsoft Internet Security and Acceleration (ISA) Server 2000 allows remote attackers to cause a denial of service (blocked traffic to DNS servers) via a certain type of incoming DNS request that is not…
CVE-2003-1326Feb 19, 2003
Microsoft
Internet Explorer
risk 0.01cvss —epss 0.16
Microsoft Internet Explorer 5.5 and 6.0 allows remote attackers to bypass the cross-domain security model to run malicious script or arbitrary programs via dialog boxes, aka "Improper Cross Domain Security Validation with dialog box."
CVE-2002-1908Dec 31, 2002
Microsoft
IIS
risk 0.01cvss —epss 0.14
Microsoft IIS 5.0 and 5.1 allows remote attackers to cause a denial of service (CPU consumption) via an HTTP request with a Host header that contains a large number of "/" (forward slash) characters.
CVE-2002-2101Dec 31, 2002
Microsoft
Outlook
risk 0.01cvss —epss 0.11
Microsoft Outlook 2002 allows remote attackers to execute arbitrary JavaScript code, even when scripting is disabled, via an "about:" or "javascript:" URI in the href attribute of an "a" tag.
CVE-2002-2189Dec 31, 2002
Activxperts Software
Activwebserver
risk 0.01cvss —epss 0.07
Cross-site scripting (XSS) vulnerability in ActiveXperts Software ActiveWebserver allows remote attackers to execute arbitrary web script via a link.
CVE-2002-2081Dec 31, 2002
Microsoft
Site Server
risk 0.01cvss —epss 0.15
cphost.dll in Microsoft Site Server 3.0 allows remote attackers to cause a denial of service (disk consumption) via an HTTP POST of a file with a long TargetURL parameter, which causes Site Server to abort and leaves the uploaded file in c:\temp.
CVE-2002-2117Dec 31, 2002
Microsoft
Windows Xp
risk 0.01cvss —epss 0.12
Microsoft Windows XP allows remote attackers to cause a denial of service (CPU consumption) by flooding UDP port 500 (ISAKMP).
CVE-2002-1694Dec 31, 2002
Microsoft
Internet Information Server
risk 0.01cvss —epss 0.13
Microsoft Internet Information Server (IIS) 4.0 opens log files with FILE_SHARE_READ and FILE_SHARE_WRITE permissions, which could allow remote attackers to modify the log file contents while IIS is running.
CVE-2002-2328Dec 31, 2002
Microsoft
Windows 2000
risk 0.01cvss —epss 0.17
Active Directory in Windows 2000, when supporting Kerberos V authentication and GSSAPI, allows remote attackers to cause a denial of service (hang) via an LDAP client that sets the page length to zero during a large request.
CVE-2002-1671Dec 31, 2002
Microsoft
Internet Explorer
risk 0.01cvss —epss 0.12
Microsoft Internet Explorer 5.0, 5.01, and 5.5 allows remote attackers to monitor the contents of the clipboard via the getData method of the clipboardData object.
CVE-2002-1698Dec 31, 2002
Microsoft
Msn Messenger
risk 0.01cvss —epss 0.16
Buffer overflow in Microsoft MSN Messenger Service 1.0 through 4.6 allows remote attackers to cause a denial of service (crash) via a long FN (font) argument in the message header.
CVE-2002-2077Dec 31, 2002
Microsoft
Windows 2000
risk 0.01cvss —epss 0.16
The DCOM client in Windows 2000 before SP3 does not properly clear memory before sending an "alter context" request, which may allow remote attackers to obtain sensitive information by sniffing the session.
CVE-2002-1873Dec 31, 2002
Microsoft
Exchange 2000
risk 0.01cvss —epss 0.14
Microsoft Exchange 2000, when used with Microsoft Remote Procedure Call (MSRPC), allows remote attackers to cause a denial of service (crash or memory consumption) via malformed MSRPC calls.
CVE-2002-1769Dec 31, 2002
Microsoft
Site Server
risk 0.01cvss —epss 0.12
Microsoft Site Server 3.0 prior to SP4 installs a default user, LDAP_Anonymous, with a default password of LdapPassword_1, which allows remote attackers the "Log on locally" privilege.
CVE-2002-1795Dec 31, 2002
Microsoft
Terminal Services Advanced Client (TSAC)
risk 0.01cvss —epss 0.17
Cross-site scripting (XSS) vulnerability in connect.asp in Microsoft Terminal Services Advanced Client (TSAC) ActiveX control allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVE-2002-2125Dec 31, 2002
Microsoft
Internet Explorer
risk 0.01cvss —epss 0.08
Internet Explorer 6.0 does not warn users when an expired certificate authority (CA) certificate is submitted to the user and a newer CA certificate is in the user's local repository, which could allow remote attackers to decrypt web sessions via a man-in-the-middle (MITM)…
CVE-2002-1762Dec 31, 2002
Microsoft
Baseline Security Analyzer
risk 0.01cvss —epss 0.16
Microsoft Baseline Security Analyzer (MBSA) 1.0 stores security scans in a known location C:\Documents and Settings\username\SecurityScans in plaintext, which could allow remote attackers to obtain sensitive information about the system via malicious active content such as…
CVE-2002-1717Dec 31, 2002
Microsoft
Internet Information Server
risk 0.01cvss —epss 0.16
Microsoft Internet Information Server (IIS) 5.1 allows remote attackers to view path information via a GET request to (1) /_vti_pvt/access.cnf, (2) /_vti_pvt/botinfs.cnf, (3) /_vti_pvt/bots.cnf, or (4) /_vti_pvt/linkinfo.cnf.
CVE-2002-1918Dec 31, 2002
Microsoft
MDAC
risk 0.01cvss —epss 0.16
Buffer overflow in Microsoft Active Data Objects (ADO) in Microsoft MDAC 2.5 through 2.7 allows remote attackers to have unknown impact with unknown attack vectors. NOTE: due to the lack of details available regarding this issue, perhaps it should be REJECTED.
CVE-2002-1695Dec 31, 2002
Symantec
Norton Internet Security
risk 0.01cvss —epss 0.14
Norton Internet Security 2001 opens log files with FILE_SHARE_READ and FILE_SHARE_WRITE permissions, which could allow remote attackers to modify the log file contents while Norton Internet Security is running.
CVE-2002-2311Dec 31, 2002
Microsoft
Internet Explorer
risk 0.01cvss —epss 0.10
Microsoft Internet Explorer 6.0 and possibly others allows remote attackers to upload arbitrary file contents when users press a key corresponding to the JavaScript (1) event.ctrlKey or (2) event.shiftKey onkeydown event contained in a webpage. NOTE: it was reported that the…
CVE-2002-1718Dec 31, 2002
Microsoft
Internet Information Server
risk 0.01cvss —epss 0.15
Microsoft Internet Information Server (IIS) 5.1 may allow remote attackers to view the contents of a Frontpage Server Extension (FPSE) file, as claimed using an HTTP request for colegal.htm that contains .. (dot dot) sequences.
CVE-2002-2380Dec 31, 2002
Microsoft
Network Firmware
risk 0.01cvss —epss 0.11
NetDSL ADSL Modem 800 with Microsoft Network firmware 5.5.11 allows remote attackers to gain access to configuration menus by sniffing undocumented usernames and passwords from network traffic.
CVE-2002-2100Dec 31, 2002
Microsoft
Outlook
risk 0.01cvss —epss 0.11
Microsoft Outlook 2002 allows remote attackers to embed bypass the file download restrictions for attachments via an HTML email message that uses an IFRAME to reference malicious content.
CVE-2002-1984Dec 31, 2002
Microsoft
Internet Explorer
risk 0.01cvss —epss 0.09
Microsoft Internet Explorer 5.0.1 through 6.0 on Windows 2000 or Windows XP allows remote attackers to cause a denial of service (crash) via an OBJECT tag that contains a crafted CLASSID (CLSID) value of "CLSID:00022613-0000-0000-C000-000000000046".
CVE-2002-1932Dec 31, 2002
Microsoft
Windows 2000
risk 0.01cvss —epss 0.13
Microsoft Windows XP and Windows 2000, when configured to send administrative alerts and the "Do not overwrite events (clear log manually)" option is set, does not notify the administrator when the log reaches its maximum size, which allows local users and remote attackers to…
CVE-2002-1716Dec 31, 2002
Microsoft
Office
risk 0.01cvss —epss 0.14
The Host() function in the Microsoft spreadsheet component on Microsoft Office XP allows remote attackers to create arbitrary files using the SaveAs capability.
CVE-2002-1257Dec 23, 2002
Microsoft
Windows Nt
risk 0.01cvss —epss 0.15
Microsoft Virtual Machine (VM) up to and including build 5.0.3805 allows remote attackers to execute arbitrary code by including a Java applet that invokes COM (Component Object Model) objects in a web site or an HTML mail.
CVE-2002-1260Dec 23, 2002
Microsoft
Windows Nt
risk 0.01cvss —epss 0.16
The Java Database Connectivity (JDBC) APIs in Microsoft Virtual Machine (VM) 5.0.3805 and earlier allow remote attackers to bypass security checks and access database contents via an untrusted Java applet.
CVE-2002-1325Dec 23, 2002
Microsoft
Windows Nt
risk 0.01cvss —epss 0.14
Microsoft Virtual Machine (VM) build 5.0.3805 and earlier allows remote attackers to determine a local user's username via a Java applet that accesses the user.dir system property, aka "User.dir Exposure Vulnerability."
CVE-2002-1258Dec 23, 2002
Microsoft
Windows Nt
risk 0.01cvss —epss 0.15
Two vulnerabilities in Microsoft Virtual Machine (VM) up to and including build 5.0.3805, as used in Internet Explorer and other applications, allow remote attackers to read files via a Java applet with a spoofed location in the CODEBASE parameter in the APPLET tag, possibly due…
CVE-2002-1340Dec 18, 2002
Microsoft
Office Web Components
risk 0.01cvss —epss 0.12
The "ConnectionFile" property in the DataSourceControl component in Office Web Components (OWC) 10 allows remote attackers to determine the existence of local files by detecting an exception.
CVE-2002-1255Dec 18, 2002
Microsoft
Outlook
risk 0.01cvss —epss 0.14
Microsoft Outlook 2002 allows remote attackers to cause a denial of service (repeated failure) via an email message with a certain invalid header field that is accessed using POP3, IMAP, or WebDAV, aka "E-mail Header Processing Flaw Could Cause Outlook 2002 to Fail."
CVE-2002-1262Dec 18, 2002
Microsoft
Internet Explorer
risk 0.01cvss —epss 0.12
Internet Explorer 5.5 and 6.0 does not perform complete security checks on external caching, which allows remote attackers to read arbitrary files.
CVE-2002-1339Dec 18, 2002
Microsoft
Office Web Components
risk 0.01cvss —epss 0.12
The "XMLURL" property in the Spreadsheet component of Office Web Components (OWC) 10 follows redirections, which allows remote attackers to determine the existence of local files based on exceptions, or to read WorkSheet XML files.
CVE-2002-1188Dec 11, 2002
Microsoft
Internet Explorer
risk 0.01cvss —epss 0.12
Internet Explorer 5.01 through 6.0 allows remote attackers to identify the path to the Temporary Internet Files folder and obtain user information such as cookies via certain uses of the OBJECT tag, which are not subjected to the proper security checks, aka "Temporary Internet…
CVE-2002-1295Nov 29, 2002
Microsoft
Java implementation
risk 0.01cvss —epss 0.15
The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to cause a denial of service (crash) and possibly conduct other unauthorized activities via applet tags in HTML that bypass Java class restrictions (such as private constructors) by…
CVE-2002-1293Nov 29, 2002
Microsoft
Java Virtual Machine
risk 0.01cvss —epss 0.15
The Microsoft Java implementation, as used in Internet Explorer, provides a public load0() method for the CabCracker class (com.ms.vm.loader.CabCracker), which allows remote attackers to bypass the security checks that are performed by the load() method.
CVE-2002-1288Nov 29, 2002
Microsoft
Java Virtual Machine
risk 0.01cvss —epss 0.17
The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to determine the current directory of the Internet Explorer process via the getAbsolutePath() method in a File() call.
CVE-2002-1290Nov 29, 2002
Microsoft
Java implementation
risk 0.01cvss —epss 0.14
The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to read and modify the contents of the Clipboard via an applet that accesses the (1) ClipBoardGetText and (2) ClipBoardSetText methods of the INativeServices class.
CVE-2002-1294Nov 29, 2002
Microsoft
Internet Explorer
risk 0.01cvss —epss 0.15
The Microsoft Java implementation, as used in Internet Explorer, can provide HTML object references to applets via Javascript, which allows remote attackers to cause a denial of service (crash due to illegal memory accesses) and possibly conduct other unauthorized activities via…
CVE-2002-1291Nov 29, 2002
Microsoft
Java Virtual Machine
risk 0.01cvss —epss 0.18
The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to read arbitrary local files and network shares via an applet tag with a codebase set to a "file://%00" (null character) URL.
CVE-2002-1289Nov 29, 2002
Microsoft
Java implementation
risk 0.01cvss —epss 0.16
The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to read restricted process memory, cause a denial of service (crash), and possibly execute arbitrary code via the getNativeServices function, which creates an instance of the…
CVE-2002-1180Nov 12, 2002
Microsoft
Internet Information Server
risk 0.01cvss —epss 0.10
A typographical error in the script source access permissions for Internet Information Server (IIS) 5.0 does not properly exclude .COM files, which allows attackers with only write permissions to upload malicious .COM files, aka "Script Source Access Vulnerability."

Page 334 of 363