CVE Vulnerability Advisory Database

[Affected Scope] Windows 10, 11, and Windows Server environments utilizing the legacy JScript9 engine, particularly with Internet Explorer mode enabled

[Impact] Remote Code Execution (RCE) and full system compromise via specially crafted malicious web pages

[Mitigation] Apply the Microsoft August 2024 security updates immediately and disable legacy IE scripting engines where applicable

[Affected Scope] Microsoft Internet Explorer 11 running on various Windows operating system environments

[Impact] An attacker can remotely test and verify the presence of specific files on the local disk, gathering critical intelligence for multi-stage targeted attacks

[Mitigation] Apply the official Microsoft cumulative security updates or disable Internet Explorer in favor of modern secure browsers

[Affected Scope] Internet Explorer 9, 10, and 11 running on Microsoft Windows environments.

[Impact] Successful exploitation allows remote attackers to execute arbitrary code (RCE) with the privileges of the active user by enticing them to visit a specially crafted website.

[Mitigation] Apply the official Microsoft cumulative security updates immediately, or disable VBScript execution in Internet Explorer as a temporary workaround.

[Affected Scope] Microsoft Internet Explorer 9, 10, and 11 running on Windows environments

[Impact] Attackers can bypass the Same-Origin Policy (SOP) to access sensitive information across domains and inject malicious scripts, leading to elevation of privilege

[Mitigation] Apply the official Microsoft cumulative security updates immediately, or disable Internet Explorer and transition to modern browsers like Microsoft Edge

[Affected Scope] Microsoft Internet Explorer versions 9 through 11

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site

[Mitigation] Apply official Microsoft security updates, disable Internet Explorer, and transition to modern browsers like Microsoft Edge

[Affected Scope] Microsoft Internet Explorer versions 9, 10, and 11 running on Windows operating systems.

[Impact] Remote attackers can bypass ASLR and extract sensitive process memory data by enticing users to visit a specially crafted malicious website.

[Mitigation] Apply the latest cumulative Windows security updates, disable Internet Explorer, and transition to modern secure browsers.

[Affected Scope] Microsoft Internet Explorer 10, 11 and legacy Microsoft Edge

[Impact] Remote attackers can execute arbitrary code and gain full system control when a user visits a maliciously crafted webpage containing specific CSS tokens and JavaScript

[Mitigation] Apply the official Microsoft cumulative security updates immediately, or disable Internet Explorer and transition to modern Chromium-based browsers

[Affected Scope] Internet Explorer 9 through 11 and Internet Messaging API on Windows Vista SP2, Server 2008 SP2/R2 SP1, and Windows 7 SP1.

[Impact] Remote attackers can determine the existence of arbitrary local files via a crafted website, facilitating targeted secondary attacks.

[Mitigation] Apply official Microsoft security updates (MS16-118, MS16-126) and disable legacy Internet Explorer components.

[Affected Scope] Microsoft Internet Explorer 9, 10, and 11, and Microsoft Edge

[Impact] Remote attackers can determine the presence of specific applications, MIME types, and security software on the host system via crafted web content

[Mitigation] Apply official Microsoft security updates (MS16-104, MS16-105) or transition to modern Chromium-based browsers

[Affected Scope] Microsoft JScript 5.8 and VBScript 5.7/5.8 engines utilized in Internet Explorer 9 through 11

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (memory corruption) via a specially crafted website

[Mitigation] Apply official Microsoft security updates (MS16-051, MS16-053) or restrict VBScript/JScript execution via registry configurations

[Affected Scope] Microsoft Internet Explorer versions 9 through 11

[Impact] Remote attackers can determine the existence of specific local files via crafted JavaScript code, facilitating targeted reconnaissance for secondary attacks

[Mitigation] Apply the MS16-037 cumulative security update or transition to Microsoft Edge and restrict legacy IE mode

[Affected Scope] Microsoft Internet Explorer versions 7 through 11

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (memory corruption) via a crafted website

[Mitigation] Immediately apply the MS15-093 cumulative security update and transition from legacy browsers to modern secure alternatives

[Affected Scope] Microsoft Internet Explorer 11 browser environments.

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (DoS) via memory corruption by enticing users to visit a crafted website.

[Mitigation] Apply the MS15-065 cumulative security update, disable Internet Explorer 11, and transition to modern browsers like Microsoft Edge.

[Affected Scope] Microsoft Internet Explorer 10 and 11 browsers utilizing the JScript 9 scripting engine.

[Impact] Remote attackers can execute arbitrary code or trigger a denial of service (DoS) via memory corruption by enticing a user to visit a specially crafted website.

[Mitigation] Apply the official Microsoft MS15-065 security update immediately, and transition legacy environments to modern, secure browsers.

[Affected Scope] Microsoft Internet Explorer 9, 10, and 11

[Impact] Attackers can bypass Address Space Layout Randomization (ASLR) protections via crafted web content, significantly increasing the success rate of subsequent Remote Code Execution (RCE) attacks

[Mitigation] Apply the MS15-009 cumulative security update, transition to Microsoft Edge, and enforce system-wide exploit mitigations (Force ASLR)

[Affected Scope] Microsoft Internet Explorer versions 7 through 11 running on Windows environments.

[Impact] Remote attackers can bypass browser sandbox restrictions, elevate privileges, and execute arbitrary code on the host system via crafted web content.

[Mitigation] Apply the MS14-056 cumulative security update immediately, or transition to modern browsers and disable legacy Internet Explorer components.

[Affected Scope] Microsoft Internet Explorer versions 6 through 11

[Impact] Remote attackers can bypass sandbox restrictions and elevate privileges to execute arbitrary code in the context of the current user

[Mitigation] Apply the MS14-051 cumulative security update, disable Internet Explorer, and transition to modern secure browsers like Microsoft Edge

[Affected Scope] Microsoft.XMLDOM ActiveX control and Internet Explorer on Microsoft Windows 8.1 and earlier

[Impact] Remote attackers can determine the existence of local pathnames, UNC shares, intranet hostnames, and IP addresses via error code analysis

[Mitigation] Apply the MS14-052 cumulative security update or restrict ActiveX execution in Internet Explorer

[Affected Scope] Microsoft Internet Explorer 9 and 10 browsers

[Impact] Remote attackers can execute arbitrary code with user privileges when a victim visits a specially crafted webpage

[Mitigation] Apply official cumulative security updates, disable Internet Explorer, and migrate to modern secure browsers

[Affected Scope] Internet Explorer and the icardie.dll ActiveX control running on Windows XP, Vista, 7, 8, 8.1, and Windows Server 2003, 2008, 2012

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (system crash) by enticing users to visit a specially crafted malicious web page

[Mitigation] Apply the official Microsoft MS13-090 security patch or configure the ActiveX Kill Bit for the icardie.dll control via the registry