7.0 * * * : Security Vulnerabilities

Cpe Name:cpe:2.3:a:microsoft:internet_explorer:7.0:*:*:*:*:*:*:*

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	# of Exploits	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2012-1545	119		DoS Overflow Mem. Corr. Bypass	2012-03-09	2021-07-23	5.8	None	Remote	Medium	Not required	None	Partial	Partial
Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, allows remote attackers to bypass Protected Mode or cause a denial of service (memory corruption) by leveraging access to a Low integrity process, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012.
2	CVE-2011-2382	20			2011-06-03	2021-07-23	4.3	None	Remote	Medium	Not required	Partial	None	None
Microsoft Internet Explorer 8 and earlier, and Internet Explorer 9 beta, does not properly restrict cross-zone drag-and-drop actions, which allows user-assisted remote attackers to read cookie files via vectors involving an IFRAME element with a SRC attribute containing a file: URL, as demonstrated by a Facebook game, related to a "cookiejacking" issue.
3	CVE-2010-5071	264		+Info	2011-12-07	2021-07-23	5.0	None	Remote	Low	Not required	Partial	None	None
The JavaScript implementation in Microsoft Internet Explorer 8.0 and earlier does not properly restrict the set of values contained in the object returned by the getComputedStyle method, which allows remote attackers to obtain sensitive information about visited web pages by calling this method.
4	CVE-2010-1991	399		DoS	2010-05-20	2021-07-23	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Internet Explorer 6.0.2900.2180, 7, and 8.0.7600.16385 executes a mail application in situations where an IFRAME element has a mailto: URL in its SRC attribute, which allows remote attackers to cause a denial of service (excessive application launches) via an HTML document with many IFRAME elements.
5	CVE-2010-1127			DoS Exec Code	2010-03-26	2021-07-23	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Internet Explorer 6 and 7 does not initialize certain data structures during execution of the createElement method, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted JavaScript code, as demonstrated by setting the (1) outerHTML or (2) value property of an object returned by createElement.
6	CVE-2009-2433	119	1	DoS Overflow	2009-07-10	2021-07-23	4.3	None	Remote	Medium	Not required	None	None	Partial
Stack-based buffer overflow in the AddFavorite method in Microsoft Internet Explorer allows remote attackers to cause a denial of service (application crash) and possibly have unspecified other impact via a long URL in the first argument.
7	CVE-2009-2069	287			2009-06-15	2021-07-23	5.8	None	Remote	Medium	Not required	Partial	Partial	None
Microsoft Internet Explorer before 8 displays a cached certificate for a (1) 4xx or (2) 5xx CONNECT response page returned by a proxy server, which allows man-in-the-middle attackers to spoof an arbitrary https site by letting a browser obtain a valid certificate from this site during one request, and then sending the browser a crafted 502 response page upon a subsequent request.
8	CVE-2009-2057	287			2009-06-15	2021-07-23	5.8	None	Remote	Medium	Not required	Partial	Partial	None
Microsoft Internet Explorer before 8 uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack.
9	CVE-2008-2281				2008-05-18	2021-07-23	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Cross-zone scripting vulnerability in the Print Table of Links feature in Internet Explorer 6.0, 7.0, and 8.0b allows user-assisted remote attackers to inject arbitrary web script or HTML in the Local Machine Zone via an HTML document with a link containing JavaScript sequences, which are evaluated by a resource script when a user prints this document.
10	CVE-2008-1545	20			2008-03-28	2021-07-23	4.3	None	Remote	Medium	Not required	None	Partial	None
The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 7 does not restrict the dangerous Transfer-Encoding HTTP request header, which allows remote attackers to conduct HTTP request splitting and HTTP request smuggling attacks via a POST containing a "Transfer-Encoding: chunked" header and a request body with an incorrect chunk size.
11	CVE-2007-5347	399		Exec Code Mem. Corr.	2007-12-12	2021-07-23	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Microsoft Internet Explorer 5.01 through 7 allows remote attackers to execute arbitrary code via "unexpected method calls to HTML objects," aka "DHTML Object Memory Corruption Vulnerability."
12	CVE-2007-5344	94		Exec Code Mem. Corr.	2007-12-12	2021-07-23	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Microsoft Internet Explorer 5.01 through 7 allows remote attackers to execute arbitrary code via a crafted website using Javascript that creates, modifies, deletes, and accesses document objects using the tags property, which triggers heap corruption, related to uninitialized or deleted objects, a different issue than CVE-2007-3902 and CVE-2007-3903, and a variant of "Uninitialized Memory Corruption Vulnerability."
13	CVE-2007-4848				2007-09-12	2021-07-23	4.3	None	Remote	Medium	Not required	Partial	None	None
Microsoft Internet Explorer 4.0 through 7 allows remote attackers to determine the existence of local files that have associated images via a res:// URI in the src property of a JavaScript Image object, as demonstrated by the URI for a bitmap image resource within a (1) .exe or (2) .dll file.
14	CVE-2007-3903	399		Exec Code Mem. Corr.	2007-12-12	2021-07-23	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code via uninitialized or deleted objects used in repeated calls to the (1) cloneNode or (2) nodeValue JavaScript function, a different issue than CVE-2007-3902 and CVE-2007-5344, a variant of "Uninitialized Memory Corruption Vulnerability."
15	CVE-2007-3902	189		Exec Code Mem. Corr.	2007-12-12	2021-07-23	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Use-after-free vulnerability in the CRecalcProperty function in mshtml.dll in Microsoft Internet Explorer 5.01 through 7 allows remote attackers to execute arbitrary code by calling the setExpression method and then modifying the outerHTML property of an HTML element, one variant of "Uninitialized Memory Corruption Vulnerability."
16	CVE-2007-3893	399		Exec Code Mem. Corr.	2007-10-09	2021-07-23	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Unspecified vulnerability in Microsoft Internet Explorer 5.01 through 7 allows remote attackers to execute arbitrary code via unspecified vectors involving memory corruption from an unhandled error.
17	CVE-2007-3892	94			2007-10-09	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Microsoft Internet Explorer 5.01 through 7 allows remote attackers to spoof the URL address bar and other "trust UI" components via unspecified vectors, a different issue than CVE-2007-1091 and CVE-2007-3826.
18	CVE-2007-3670	79		Exec Code XSS	2007-07-10	2021-07-23	4.3	None	Remote	Medium	Not required	None	Partial	None
Argument injection vulnerability in Microsoft Internet Explorer, when running on systems with Firefox installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a (1) FirefoxURL or (2) FirefoxHTML URI, which are inserted into the command line that is created when invoking firefox.exe. NOTE: it has been debated as to whether the issue is in Internet Explorer or Firefox. As of 20070711, it is CVE's opinion that IE appears to be failing to properly delimit the URL argument when invoking Firefox, and this issue could arise with other protocol handlers in IE as well. However, Mozilla has stated that it will address the issue with a "defense in depth" fix that will "prevent IE from sending Firefox malicious data."
19	CVE-2007-3550	94		DoS	2007-07-03	2021-07-23	7.8	None	Remote	Low	Not required	None	None	Complete
DISPUTED Microsoft Internet Explorer 6.0 and 7.0 allows remote attackers to fill Zones with arbitrary domains using certain metacharacters such as wildcards via JavaScript, which results in a denial of service (website suppression and resource consumption), aka "Internet Explorer Zone Domain Specification Dos and Page Suppressing". NOTE: this issue has been disputed by a third party, who states that the zone settings cannot be manipulated.
20	CVE-2007-3497				2007-06-29	2021-07-23	5.0	None	Remote	Low	Not required	Partial	None	None
Microsoft Internet Explorer 7 allows remote attackers to determine the existence of page history via the history.length JavaScript variable.
21	CVE-2007-3164				2007-06-11	2021-07-23	5.8	None	Remote	Medium	Not required	Partial	Partial	None
Microsoft Internet Explorer 7, when prompting for HTTP Basic Authentication for an IDN web site, uses ACE labels for the domain name in the status bar, but uses internationalized labels for this name in the authentication dialog, which might allow remote attackers to perform phishing attacks if the user misinterprets confusable characters in the internationalized labels, as demonstrated by displaying xn--theshmogroup-bgk.com only in the status bar.
22	CVE-2007-2161			DoS	2007-04-22	2022-02-19	4.3	None	Remote	Medium	Not required	None	None	Partial
Microsoft Internet Explorer 7 allows remote attackers to cause a denial of service (browser hang) via JavaScript that matches a regular expression against a long string, as demonstrated using /(.)*/.
23	CVE-2007-1094			DoS	2007-02-26	2021-12-13	7.8	None	Remote	Low	Not required	None	None	Complete
Microsoft Internet Explorer 7 allows remote attackers to cause a denial of service (NULL dereference and application crash) via JavaScript onUnload handlers that modify the structure of a document.
24	CVE-2005-4843			DoS	2005-12-31	2021-07-23	7.8	None	Remote	Low	Not required	None	None	Complete
The SmartConnect Class control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of the class associated with the control's CLSID, which is not intended for use within Internet Explorer.
25	CVE-2005-4842			DoS	2005-12-31	2021-07-23	7.1	None	Remote	Medium	Not required	None	None	Complete
The System Monitor Source Properties control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of the class associated with the control's CLSID, which is not intended for use within Internet Explorer.
26	CVE-2005-4841			DoS	2005-12-31	2021-07-23	7.1	None	Remote	Medium	Not required	None	None	Complete
The Outlook Progress Ctl control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of the class associated with the control's CLSID, which is not intended for use within Internet Explorer.
27	CVE-2002-2435	200		+Info	2011-12-07	2021-07-23	4.3	None	Remote	Medium	Not required	Partial	None	None
The Cascading Style Sheets (CSS) implementation in Microsoft Internet Explorer 8.0 and earlier does not properly handle the :visited pseudo-class, which allows remote attackers to obtain sensitive information about visited web pages via a crafted HTML document, a related issue to CVE-2010-2264.

Total number of vulnerabilities : 27 Page : 1 (This Page)