5.5 * * * : Security Vulnerabilities

Cpe Name:cpe:2.3:a:microsoft:internet_explorer:5.5:*:*:*:*:*:*:*

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2011-2382	20		2011-06-03	2021-07-23	4.3	None	Remote	Medium	Not required	Partial	None	None
Microsoft Internet Explorer 8 and earlier, and Internet Explorer 9 beta, does not properly restrict cross-zone drag-and-drop actions, which allows user-assisted remote attackers to read cookie files via vectors involving an IFRAME element with a SRC attribute containing a file: URL, as demonstrated by a Facebook game, related to a "cookiejacking" issue.
2	CVE-2010-5071	264	+Info	2011-12-07	2021-07-23	5.0	None	Remote	Low	Not required	Partial	None	None
The JavaScript implementation in Microsoft Internet Explorer 8.0 and earlier does not properly restrict the set of values contained in the object returned by the getComputedStyle method, which allows remote attackers to obtain sensitive information about visited web pages by calling this method.
3	CVE-2009-2954	20	DoS	2009-08-24	2021-07-23	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Internet Explorer 6.0.2900.2180 and earlier allows remote attackers to cause a denial of service (CPU consumption and application hang) via JavaScript code with a long string value for the hash property (aka location.hash), a related issue to CVE-2008-5715.
4	CVE-2009-2576	399	DoS	2009-07-22	2021-07-23	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Internet Explorer 6.0.2900.2180 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via a long Unicode string argument to the write method, a related issue to CVE-2009-2479. NOTE: it was later reported that 7.0.6000.16473 and earlier are also affected.
5	CVE-2009-2069	287		2009-06-15	2021-07-23	5.8	None	Remote	Medium	Not required	Partial	Partial	None
Microsoft Internet Explorer before 8 displays a cached certificate for a (1) 4xx or (2) 5xx CONNECT response page returned by a proxy server, which allows man-in-the-middle attackers to spoof an arbitrary https site by letting a browser obtain a valid certificate from this site during one request, and then sending the browser a crafted 502 response page upon a subsequent request.
6	CVE-2009-2057	287		2009-06-15	2021-07-23	5.8	None	Remote	Medium	Not required	Partial	Partial	None
Microsoft Internet Explorer before 8 uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack.
7	CVE-2007-5347	399	Exec Code Mem. Corr.	2007-12-12	2021-07-23	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Microsoft Internet Explorer 5.01 through 7 allows remote attackers to execute arbitrary code via "unexpected method calls to HTML objects," aka "DHTML Object Memory Corruption Vulnerability."
8	CVE-2007-5344	94	Exec Code Mem. Corr.	2007-12-12	2021-07-23	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Microsoft Internet Explorer 5.01 through 7 allows remote attackers to execute arbitrary code via a crafted website using Javascript that creates, modifies, deletes, and accesses document objects using the tags property, which triggers heap corruption, related to uninitialized or deleted objects, a different issue than CVE-2007-3902 and CVE-2007-3903, and a variant of "Uninitialized Memory Corruption Vulnerability."
9	CVE-2007-4848			2007-09-12	2021-07-23	4.3	None	Remote	Medium	Not required	Partial	None	None
Microsoft Internet Explorer 4.0 through 7 allows remote attackers to determine the existence of local files that have associated images via a res:// URI in the src property of a JavaScript Image object, as demonstrated by the URI for a bitmap image resource within a (1) .exe or (2) .dll file.
10	CVE-2007-3902	189	Exec Code Mem. Corr.	2007-12-12	2021-07-23	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Use-after-free vulnerability in the CRecalcProperty function in mshtml.dll in Microsoft Internet Explorer 5.01 through 7 allows remote attackers to execute arbitrary code by calling the setExpression method and then modifying the outerHTML property of an HTML element, one variant of "Uninitialized Memory Corruption Vulnerability."
11	CVE-2007-0612		DoS	2007-01-31	2021-07-23	7.8	None	Remote	Low	Not required	None	None	Complete
Multiple ActiveX controls in Microsoft Windows 2000, XP, 2003, and Vista allows remote attackers to cause a denial of service (Internet Explorer crash) by accessing the bgColor, fgColor, linkColor, alinkColor, vlinkColor, or defaultCharset properties in the (1) giffile, (2) htmlfile, (3) jpegfile, (4) mhtmlfile, (5) ODCfile, (6) pjpegfile, (7) pngfile, (8) xbmfile, (9) xmlfile, (10) xslfile, or (11) wdfile objects in (a) mshtml.dll; or the (12) TriEditDocument.TriEditDocument or (13) TriEditDocument.TriEditDocument.1 objects in (b) triedit.dll, which cause a NULL pointer dereference.
12	CVE-2006-5884			2006-11-14	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Multiple unspecified vulnerabilities in DirectAnimation ActiveX controls for Microsoft Internet Explorer 5.01 through 6 have unknown impact and remote attack vectors, possibly related to (1) Danim.dll and (2) Lmrt.dll, a different set of vulnerabilities than CVE-2006-4446 and CVE-2006-4777.
13	CVE-2006-5162		DoS Overflow	2006-10-05	2021-12-13	5.0	None	Remote	Low	Not required	None	None	Partial
wininet.dll in Microsoft Internet Explorer 6.0 SP2 and earlier allows remote attackers to cause a denial of service (unhandled exception and crash) via a long Content-Type header, which triggers a stack overflow.
14	CVE-2006-4687	119	Exec Code Overflow Mem. Corr.	2006-11-14	2021-07-23	5.1	None	Remote	High	Not required	Partial	Partial	Partial
Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via crafted layout combinations involving DIV tags and HTML CSS float properties that trigger memory corruption, aka "HTML Rendering Memory Corruption Vulnerability."
15	CVE-2006-2094	362		2006-04-29	2021-07-23	5.1	None	Remote	High	Not required	Partial	Partial	Partial
Microsoft Internet Explorer before Windows XP Service Pack 2 and Windows Server 2003 Service Pack 1, when Prompt is configured in Security Settings, uses modal dialogs to verify that a user wishes to run an ActiveX control or perform other risky actions, which allows user-assisted remote attackers to construct a race condition that tricks a user into clicking an object or pressing keys that are actually applied to a "Yes" approval for executing the control.
16	CVE-2006-1191		+Info	2006-04-11	2021-07-23	4.0	None	Remote	High	Not required	Partial	Partial	None
Microsoft Internet Explorer 5.01 through 6 does not always correctly identify the domain that is associated with a browser window, which allows remote attackers to obtain sensitive cross-domain information and spoof sites by running script after the user has navigated to another site.
17	CVE-2006-1190		Exec Code	2006-04-11	2021-07-23	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Microsoft Internet Explorer 5.01 through 6 does not always return the correct IOleClientSite information when dynamically creating an embedded object, which could cause Internet Explorer to run the object in the wrong security context or zone, and allow remote attackers to execute arbitrary code.
18	CVE-2006-1189	119	Exec Code Overflow Mem. Corr.	2006-04-11	2021-07-23	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Buffer overflow in URLMON.DLL in Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via a crafted URL with an International Domain Name (IDN) using double-byte character sets (DBCS), aka the "Double Byte Character Parsing Memory Corruption Vulnerability."
19	CVE-2006-1188		Exec Code Mem. Corr.	2006-04-11	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via HTML elements with a certain crafted tag, which leads to memory corruption.
20	CVE-2006-1186		Exec Code Mem. Corr.	2006-04-11	2021-07-23	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via by instantiating the (1) Mdt2gddr.dll, (2) Mdt2dd.dll, and (3) Mdt2gddo.dll COM objects as ActiveX controls, which leads to memory corruption.
21	CVE-2006-0585		DoS	2006-02-08	2021-07-23	5.0	None	Remote	Low	Not required	None	None	Partial
jscript.dll in Microsoft Internet Explorer 6.0 SP1 and earlier allows remote attackers to cause a denial of service (application crash) via a Shockwave Flash object that contains ActionScript code that calls VBScript, which in turn calls the Javascript document.write function, which triggers a null dereference.
22	CVE-2005-3240	362	Exec Code	2005-12-31	2021-07-23	5.1	None	Remote	High	Not required	Partial	Partial	Partial
Race condition in Microsoft Internet Explorer allows user-assisted attackers to overwrite arbitrary files and possibly execute code by tricking a user into performing a drag-and-drop action from certain objects, such as file objects within a folder view, then predicting the drag action, and re-focusing to a malicious window.
23	CVE-2005-2831		DoS Exec Code Mem. Corr.	2005-12-14	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, aka a variant of the "COM Object Instantiation Memory Corruption Vulnerability," a different vulnerability than CVE-2005-2127.
24	CVE-2005-2087	399	DoS Exec Code	2005-07-05	2021-07-23	5.0	None	Remote	Low	Not required	None	None	Partial
Internet Explorer 5.01 SP4 up to 6 on various Windows operating systems, including IE 6.0.2900.2180 on Windows XP, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not ActiveX controls, as demonstrated using the JVIEW Profiler (Javaprxy.dll). NOTE: the researcher says that the vendor could not reproduce this problem.
25	CVE-2005-1990		DoS Exec Code Mem. Corr.	2005-08-10	2021-07-23	5.1	None	Remote	High	Not required	Partial	Partial	Partial
Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not ActiveX controls, including (1) devenum.dll, (2) diactfrm.dll, (3) wmm2filt.dll, (4) fsusd.dll, (5) dmdskmgr.dll, (6) browsewm.dll, (7) browseui.dll, (8) shell32.dll, (9) mshtml.dll, (10) inetcfg.dll, (11) infosoft.dll, (12) query.dll, (13) syncui.dll, (14) clbcatex.dll, (15) clbcatq.dll, (16) comsvcs.dll, and (17) msconf.dll, which causes memory corruption, aka "COM Object Instantiation Memory Corruption Vulnerability," a different vulnerability than CVE-2005-2087.
26	CVE-2005-1989		Exec Code +Info	2005-08-10	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Unknown vulnerability in Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to obtain information and possibly execute code when browsing from a web site to a web folder view using WebDAV, aka "Web Folder Behaviors Cross-Domain Vulnerability".
27	CVE-2005-1988		Exec Code Mem. Corr.	2005-08-10	2021-07-23	5.1	None	Remote	High	Not required	Partial	Partial	Partial
Unknown vulnerability in Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to execute arbitrary code via a web site or an HTML e-mail containing a crafted JPEG image that causes memory corruption, aka "JPEG Image Rendering Memory Corruption Vulnerability".
28	CVE-2005-0555		Exec Code Overflow Mem. Corr.	2005-04-12	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Buffer overflow in the Content Advisor in Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a crafted Content Advisor file, aka "Content Advisor Memory Corruption Vulnerability."
29	CVE-2005-0554		DoS Exec Code Overflow Mem. Corr.	2005-05-02	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Buffer overflow in the URL processor of Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a URL with a long hostname, aka "URL Parsing Memory Corruption Vulnerability."
30	CVE-2005-0056		Exec Code +Info	2005-05-02	2021-07-23	5.1	None	Remote	High	Not required	Partial	Partial	Partial
Internet Explorer 5.01, 5.5, and 6 does not properly validate certain URLs in Channel Definition Format (CDF) files, which allows remote attackers to obtain sensitive information or execute arbitrary code, aka the "Channel Definition Format (CDF) Cross Domain Vulnerability."
31	CVE-2005-0055		Exec Code Mem. Corr.	2005-05-02	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Internet Explorer 5.01, 5.5, and 6 does not properly validate buffers when handling certain DHTML methods including the createControlRange Javascript function, which allows remote attackers to execute arbitrary code, aka the "DHTML Method Heap Memory Corruption Vulnerability."
32	CVE-2005-0054		Exec Code	2005-05-02	2021-07-23	5.1	None	Remote	High	Not required	Partial	Partial	Partial
Internet Explorer 5.01, 5.5, and 6 allows remote attackers to spoof a less restrictive security zone and execute arbitrary code via an HTML page containing URLs that contain hostnames that have been double hex encoded, which are decoded twice to generate a malicious hostname, aka the "URL Decoding Zone Spoofing Vulnerability."
33	CVE-2005-0053		Exec Code	2005-05-02	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via drag and drop events, aka the "Drag-and-Drop Vulnerability."
34	CVE-2004-2383		Bypass	2004-12-31	2021-07-23	5.1	None	Remote	High	Not required	Partial	Partial	Partial
Microsoft Internet Explorer 5.0 through 6.0 allows remote attackers to bypass cross-frame scripting restrictions and capture keyboard events from other domains via an HTML document with Javascript that is outside a frameset that includes the target domain, then forcing the frameset to maintain focus. NOTE: the discloser claimed that the vendor does not categorize this as a vulnerability, but it can be used in a spoofing scenario; the discloser provides alternate scenarios. Spoofing scenarios are currently included in CVE.
35	CVE-2004-2291		Exec Code	2004-12-31	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Microsoft Windows Internet Explorer 5.5 and 6.0 allows remote attackers to execute arbitrary code via an embedded script that uses Shell Helper objects and a shortcut (link) to execute the target script.
36	CVE-2004-2219			2004-12-31	2021-07-23	2.6	None	Remote	High	Not required	None	Partial	None
Microsoft Internet Explorer 6 allows remote attackers to spoof the address bar to facilitate phishing attacks via Javascript that uses an invalid URI, modifies the Location field, then uses history.back to navigate to the previous domain, aka NullyFake.
37	CVE-2004-2090			2004-02-07	2021-07-23	5.0	None	Remote	Low	Not required	Partial	None	None
Microsoft Internet Explorer 5.0.1 through 6.0 allows remote attackers to determine the existence of arbitrary files via the VBScript LoadPicture method, which returns an error code if the file does not exist.
38	CVE-2004-1922		DoS	2004-04-11	2021-07-23	2.6	None	Remote	High	Not required	None	None	Partial
Microsoft Internet Explorer 5.5 and 6.0 allocates memory based on the memory size written in the BMP file instead of the actual BMP file size, which allows remote attackers to cause a denial of service (memory consumption) via a small BMP file with has a large memory size.
39	CVE-2004-1376		Dir. Trav.	2004-12-30	2021-07-23	5.0	None	Remote	Low	Not required	None	Partial	None
Directory traversal vulnerability in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote malicious FTP servers to overwrite arbitrary files via .. (dot dot) sequences in filenames returned from a LIST command.
40	CVE-2004-1155			2004-12-31	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Internet Explorer 5.01 through 6 allows remote attackers to spoof arbitrary web sites by injecting content from one window into another window whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the "window injection" vulnerability. NOTE: later research shows that Internet Explorer 7 on Windows XP SP2 is also vulnerable.
41	CVE-2004-0845		+Info	2004-11-03	2021-07-23	6.4	None	Remote	Low	Not required	Partial	Partial	None
Internet Explorer 5.01, 5.5, and 6 does not properly cache SSL content, which allows remote attackers to obtain information or spoof content via a web site with the same host name as the target web site, whose content is cached and reused when the user visits the target web site.
42	CVE-2004-0843			2004-11-03	2021-07-23	5.0	None	Remote	Low	Not required	None	Partial	None
Internet Explorer 5.5 and 6 does not properly handle plug-in navigation, which allows remote attackers to alter displayed address bars and thereby spoof web pages, facilitating phishing attacks, aka the "Plug-in Navigation Address Bar Spoofing Vulnerability."
43	CVE-2004-0842		DoS Overflow Mem. Corr.	2004-12-23	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Internet Explorer 6.0 SP1 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (application crash from "memory corruption") via certain malformed Cascading Style Sheet (CSS) elements that trigger heap-based buffer overflows, as demonstrated using the "<STYLE>@;/*" string, possibly due to a missing comment terminator that may cause an invalid length to trigger a large memory copy operation, aka the "CSS Heap Memory Corruption Vulnerability."
44	CVE-2004-0841			2004-12-23	2021-07-23	5.0	None	Remote	Low	Not required	None	Partial	None
Internet Explorer 6.x allows remote attackers to install arbitrary programs via mousedown events that call the Popup.show method and use drag-and-drop actions in a popup window, aka "HijackClick 3" and the "Script in Image Tag File Download Vulnerability."
45	CVE-2004-0839			2004-08-18	2021-07-23	5.0	None	Remote	Low	Not required	None	Partial	None
Internet Explorer in Windows XP SP2, and other versions including 5.01 and 5.5, allows remote attackers to install arbitrary programs via a web page that uses certain styles and the AnchorClick behavior, popup windows, and drag-and-drop capabilities to drop the program in the local startup folder, as demonstrated by "wottapoop.html".
46	CVE-2004-0719			2004-07-27	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Internet Explorer for Mac 5.2.3, Internet Explorer 6 on Windows XP, and possibly other versions, does not properly prevent a frame in one domain from injecting content into a frame that belongs to another domain, which facilitates web site spoofing and other attacks, aka the frame injection vulnerability.
47	CVE-2004-0566		Exec Code Overflow	2004-07-27	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Integer overflow in imgbmp.cxx for Windows 2000 allows remote attackers to execute arbitrary code via a BMP image with a large bfOffBits value.
48	CVE-2004-0549		Exec Code	2004-08-06	2021-07-23	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
The WebBrowser ActiveX control, or the Internet Explorer HTML rendering engine (MSHTML), as used in Internet Explorer 6, allows remote attackers to execute arbitrary code in the Local Security context by using the showModalDialog method and modifying the location to execute code such as Javascript, as demonstrated using (1) delayed HTTP redirect operations, and an HTTP response with a Location: header containing a "URL:" prepended to a "ms-its" protocol URI, or (2) modifying the location attribute of the window, as exploited by the Download.ject (aka Scob aka Toofer) using the ADODB.Stream object.
49	CVE-2004-0526			2004-08-06	2021-07-23	5.0	None	Remote	Low	Not required	None	Partial	None
Unknown versions of Internet Explorer and Outlook allow remote attackers to spoof a legitimate URL in the status bar via A HREF tags with modified "alt" values that point to the legitimate site, combined with an image map whose href points to the malicious site, which facilitates a "phishing" attack.
50	CVE-2004-0216		Exec Code Overflow	2004-11-03	2021-07-23	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Integer overflow in the Install Engine (inseng.dll) for Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious website or HTML email with a long .CAB file name, which triggers the integer overflow when calculating a buffer length and leads to a heap-based buffer overflow.

Total number of vulnerabilities : 148 Page : 1 (This Page)2 3