5.0.1 SP2 * * : Security Vulnerabilities

Cpe Name:cpe:2.3:a:microsoft:internet_explorer:5.0.1:sp2:*:*:*:*:*:*

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2011-2382	20		2011-06-03	2021-07-23	4.3	None	Remote	Medium	Not required	Partial	None	None
Microsoft Internet Explorer 8 and earlier, and Internet Explorer 9 beta, does not properly restrict cross-zone drag-and-drop actions, which allows user-assisted remote attackers to read cookie files via vectors involving an IFRAME element with a SRC attribute containing a file: URL, as demonstrated by a Facebook game, related to a "cookiejacking" issue.
2	CVE-2010-5071	264	+Info	2011-12-07	2021-07-23	5.0	None	Remote	Low	Not required	Partial	None	None
The JavaScript implementation in Microsoft Internet Explorer 8.0 and earlier does not properly restrict the set of values contained in the object returned by the getComputedStyle method, which allows remote attackers to obtain sensitive information about visited web pages by calling this method.
3	CVE-2009-2954	20	DoS	2009-08-24	2021-07-23	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Internet Explorer 6.0.2900.2180 and earlier allows remote attackers to cause a denial of service (CPU consumption and application hang) via JavaScript code with a long string value for the hash property (aka location.hash), a related issue to CVE-2008-5715.
4	CVE-2009-2576	399	DoS	2009-07-22	2021-07-23	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Internet Explorer 6.0.2900.2180 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via a long Unicode string argument to the write method, a related issue to CVE-2009-2479. NOTE: it was later reported that 7.0.6000.16473 and earlier are also affected.
5	CVE-2009-2069	287		2009-06-15	2021-07-23	5.8	None	Remote	Medium	Not required	Partial	Partial	None
Microsoft Internet Explorer before 8 displays a cached certificate for a (1) 4xx or (2) 5xx CONNECT response page returned by a proxy server, which allows man-in-the-middle attackers to spoof an arbitrary https site by letting a browser obtain a valid certificate from this site during one request, and then sending the browser a crafted 502 response page upon a subsequent request.
6	CVE-2009-2057	287		2009-06-15	2021-07-23	5.8	None	Remote	Medium	Not required	Partial	Partial	None
Microsoft Internet Explorer before 8 uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack.
7	CVE-2007-4848			2007-09-12	2021-07-23	4.3	None	Remote	Medium	Not required	Partial	None	None
Microsoft Internet Explorer 4.0 through 7 allows remote attackers to determine the existence of local files that have associated images via a res:// URI in the src property of a JavaScript Image object, as demonstrated by the URI for a bitmap image resource within a (1) .exe or (2) .dll file.
8	CVE-2006-5162		DoS Overflow	2006-10-05	2021-12-13	5.0	None	Remote	Low	Not required	None	None	Partial
wininet.dll in Microsoft Internet Explorer 6.0 SP2 and earlier allows remote attackers to cause a denial of service (unhandled exception and crash) via a long Content-Type header, which triggers a stack overflow.
9	CVE-2006-3638	119	DoS Exec Code Overflow Mem. Corr.	2006-08-08	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Microsoft Internet Explorer 5.01 and 6 does not properly handle uninitialized COM objects, which allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code, as demonstrated by the Nth function in the DirectAnimation.DATuple ActiveX control, aka "COM Object Instantiation Memory Corruption Vulnerability."
10	CVE-2006-2378		Exec Code Overflow	2006-06-13	2021-07-23	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Buffer overflow in the ART Image Rendering component (jgdw400.dll) in Microsoft Windows XP SP1 and Sp2, Server 2003 SP1 and earlier, and Windows 98 and Me allows remote attackers to execute arbitrary code via a crafted ART image that causes heap corruption.
11	CVE-2006-2094	362		2006-04-29	2021-07-23	5.1	None	Remote	High	Not required	Partial	Partial	Partial
Microsoft Internet Explorer before Windows XP Service Pack 2 and Windows Server 2003 Service Pack 1, when Prompt is configured in Security Settings, uses modal dialogs to verify that a user wishes to run an ActiveX control or perform other risky actions, which allows user-assisted remote attackers to construct a race condition that tricks a user into clicking an object or pressing keys that are actually applied to a "Yes" approval for executing the control.
12	CVE-2006-1303	94	Exec Code Mem. Corr.	2006-06-13	2021-07-23	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Multiple unspecified vulnerabilities in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allow remote attackers to execute arbitrary code by instantiating certain COM objects from Wmm2fxa.dll as ActiveX controls including (1) DXImageTransform.Microsoft.MMSpecialEffect1Input, (2) DXImageTransform.Microsoft.MMSpecialEffect1Input.1, (3) DXImageTransform.Microsoft.MMSpecialEffect2Inputs, (4) DXImageTransform.Microsoft.MMSpecialEffect2Inputs.1, (5) DXImageTransform.Microsoft.MMSpecialEffectInplace1Input, and (6) DXImageTransform.Microsoft.MMSpecialEffectInplace1Input.1, which causes memory corruption during garbage collection.
13	CVE-2006-1186		Exec Code Mem. Corr.	2006-04-11	2021-07-23	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via by instantiating the (1) Mdt2gddr.dll, (2) Mdt2dd.dll, and (3) Mdt2gddo.dll COM objects as ActiveX controls, which leads to memory corruption.
14	CVE-2006-0585		DoS	2006-02-08	2021-07-23	5.0	None	Remote	Low	Not required	None	None	Partial
jscript.dll in Microsoft Internet Explorer 6.0 SP1 and earlier allows remote attackers to cause a denial of service (application crash) via a Shockwave Flash object that contains ActionScript code that calls VBScript, which in turn calls the Javascript document.write function, which triggers a null dereference.
15	CVE-2005-2831		DoS Exec Code Mem. Corr.	2005-12-14	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, aka a variant of the "COM Object Instantiation Memory Corruption Vulnerability," a different vulnerability than CVE-2005-2127.
16	CVE-2005-0055		Exec Code Mem. Corr.	2005-05-02	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Internet Explorer 5.01, 5.5, and 6 does not properly validate buffers when handling certain DHTML methods including the createControlRange Javascript function, which allows remote attackers to execute arbitrary code, aka the "DHTML Method Heap Memory Corruption Vulnerability."
17	CVE-2005-0053		Exec Code	2005-05-02	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via drag and drop events, aka the "Drag-and-Drop Vulnerability."
18	CVE-2004-2090			2004-02-07	2021-07-23	5.0	None	Remote	Low	Not required	Partial	None	None
Microsoft Internet Explorer 5.0.1 through 6.0 allows remote attackers to determine the existence of arbitrary files via the VBScript LoadPicture method, which returns an error code if the file does not exist.
19	CVE-2004-1155			2004-12-31	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Internet Explorer 5.01 through 6 allows remote attackers to spoof arbitrary web sites by injecting content from one window into another window whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the "window injection" vulnerability. NOTE: later research shows that Internet Explorer 7 on Windows XP SP2 is also vulnerable.
20	CVE-2004-0842		DoS Overflow Mem. Corr.	2004-12-23	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Internet Explorer 6.0 SP1 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (application crash from "memory corruption") via certain malformed Cascading Style Sheet (CSS) elements that trigger heap-based buffer overflows, as demonstrated using the "<STYLE>@;/*" string, possibly due to a missing comment terminator that may cause an invalid length to trigger a large memory copy operation, aka the "CSS Heap Memory Corruption Vulnerability."
21	CVE-2004-0841			2004-12-23	2021-07-23	5.0	None	Remote	Low	Not required	None	Partial	None
Internet Explorer 6.x allows remote attackers to install arbitrary programs via mousedown events that call the Popup.show method and use drag-and-drop actions in a popup window, aka "HijackClick 3" and the "Script in Image Tag File Download Vulnerability."
22	CVE-2004-0839			2004-08-18	2021-07-23	5.0	None	Remote	Low	Not required	None	Partial	None
Internet Explorer in Windows XP SP2, and other versions including 5.01 and 5.5, allows remote attackers to install arbitrary programs via a web page that uses certain styles and the AnchorClick behavior, popup windows, and drag-and-drop capabilities to drop the program in the local startup folder, as demonstrated by "wottapoop.html".
23	CVE-2004-0719			2004-07-27	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Internet Explorer for Mac 5.2.3, Internet Explorer 6 on Windows XP, and possibly other versions, does not properly prevent a frame in one domain from injecting content into a frame that belongs to another domain, which facilitates web site spoofing and other attacks, aka the frame injection vulnerability.
24	CVE-2004-0566		Exec Code Overflow	2004-07-27	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Integer overflow in imgbmp.cxx for Windows 2000 allows remote attackers to execute arbitrary code via a BMP image with a large bfOffBits value.
25	CVE-2004-0526			2004-08-06	2021-07-23	5.0	None	Remote	Low	Not required	None	Partial	None
Unknown versions of Internet Explorer and Outlook allow remote attackers to spoof a legitimate URL in the status bar via A HREF tags with modified "alt" values that point to the legitimate site, combined with an image map whose href points to the malicious site, which facilitates a "phishing" attack.
26	CVE-2003-1328		Exec Code Bypass	2003-02-19	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The showHelp() function in Microsoft Internet Explorer 5.01, 5.5, and 6.0 supports certain types of pluggable protocols that allow remote attackers to bypass the cross-domain security model and execute arbitrary code, aka "Improper Cross Domain Security Validation with ShowHelp functionality."
27	CVE-2003-1326		Bypass	2003-02-19	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Microsoft Internet Explorer 5.5 and 6.0 allows remote attackers to bypass the cross-domain security model to run malicious script or arbitrary programs via dialog boxes, aka "Improper Cross Domain Security Validation with dialog box."
28	CVE-2003-1048	119	DoS Overflow	2004-07-27	2021-07-23	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Double free vulnerability in mshtml.dll for certain versions of Internet Explorer 6.x allows remote attackers to cause a denial of service (application crash) via a malformed GIF image.
29	CVE-2003-1028		Bypass	2004-01-20	2021-07-23	5.0	None	Remote	Low	Not required	Partial	None	None
The download function of Internet Explorer 6 SP1 allows remote attackers to obtain the cache directory name via an HTTP response with an invalid ContentType and a .htm file, which could allow remote attackers to bypass security mechanisms that rely on random names, as demonstrated by threadid10008.
30	CVE-2003-1027			2004-01-20	2021-07-23	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Internet Explorer 5.01 through 6 SP1 allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by using method caching (SaveRef) to access the window.moveBy method, which is otherwise inaccessible, as demonstrated by HijackClickV2, a different vulnerability than CVE-2003-0823, aka the "Function Pointer Drag and Drop Vulnerability."
31	CVE-2003-1026	264	Bypass	2004-01-20	2021-07-23	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions via a javascript protocol URL in a sub-frame, which is added to the history list and executed in the top window's zone when the history.back (back) function is called, as demonstrated by BackToFramedJpu, aka the "Travel Log Cross Domain Vulnerability."
32	CVE-2003-0838		Exec Code Bypass	2003-11-17	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Internet Explorer allows remote attackers to bypass zone restrictions to inject and execute arbitrary programs by creating a popup window and inserting ActiveX object code with a "data" tag pointing to the malicious code, which Internet Explorer treats as HTML or Javascript, but later executes as an HTA application, a different vulnerability than CVE-2003-0532, and as exploited using the QHosts Trojan horse (aka Trojan.Qhosts, QHosts-1, VBS.QHOSTS, or aolfix.exe).
33	CVE-2003-0823			2004-02-03	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Internet Explorer 6 SP1 and earlier allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by calling the window.moveBy method, aka HijackClick, a different vulnerability than CVE-2003-1027.
34	CVE-2003-0817		Bypass	2004-02-03	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions and read arbitrary files via an XML object.
35	CVE-2003-0816		Bypass	2004-02-03	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions by (1) using the NavigateAndFind method to load a file: URL containing Javascript, as demonstrated by NAFfileJPU, (2) using the window.open method to load a file: URL containing Javascript, as demonstrated using WsOpenFileJPU, (3) setting the href property in the base tag for the _search window, as demonstrated using WsBASEjpu, (4) loading the search window into an Iframe, as demonstrated using WsFakeSrc, (5) caching a javascript: URL in the browser history, then accessing that URL in the same frame as the target domain, as demonstrated using WsOpenJpuInHistory, NAFjpuInHistory, BackMyParent, BackMyParent2, and RefBack, aka the "Script URLs Cross Domain" vulnerability.
36	CVE-2003-0815		Bypass	2004-02-03	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and read arbitrary files by (1) modifying the createTextRange method and using CreateLink, as demonstrated using LinkillerSaveRef, LinkillerJPU, and Linkiller, or (2) modifying the createRange method and using the FIND dialog to select text, as demonstrated using Findeath, aka the "Function Pointer Override Cross Domain" vulnerability.
37	CVE-2003-0814		Exec Code Bypass	2004-02-03	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and execute Javascript by setting the window's "href" to the malicious Javascript, then calling execCommand("Refresh") to refresh the page, aka BodyRefreshLoadsJPU or the "ExecCommand Cross Domain" vulnerability.
38	CVE-2003-0809		Exec Code	2003-11-17	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Internet Explorer 5.01 through 6.0 does not properly handle object tags returned from a Web server during XML data binding, which allows remote attackers to execute arbitrary code via an HTML e-mail message or web page.
39	CVE-2003-0532		Exec Code	2003-08-27	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Internet Explorer 5.01 SP3 through 6.0 SP1 does not properly determine object types that are returned by web servers, which could allow remote attackers to execute arbitrary code via an object tag with a data parameter to a malicious file hosted on a server that returns an unsafe Content-Type, aka the "Object Type" vulnerability.
40	CVE-2003-0531			2003-08-27	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Internet Explorer 5.01 SP3 through 6.0 SP1 allows remote attackers to access and execute script in the My Computer domain using the browser cache via crafted Content-Type and Content-Disposition headers, aka the "Browser Cache Script Execution in My Computer Zone" vulnerability.
41	CVE-2003-0530		Exec Code Overflow	2003-08-27	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Buffer overflow in the BR549.DLL ActiveX control for Internet Explorer 5.01 SP3 through 6.0 SP1 allows remote attackers to execute arbitrary code.
42	CVE-2003-0513		Dir. Trav. Bypass	2004-04-15	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Microsoft Internet Explorer allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" (encoded dot dot) directory traversal sequences in a URL, which causes Internet Explorer to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same server as the target application.
43	CVE-2003-0233		Exec Code Overflow	2003-05-12	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Heap-based buffer overflow in plugin.ocx for Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to execute arbitrary code via the Load() method, a different vulnerability than CVE-2003-0115.
44	CVE-2003-0116			2003-05-12	2021-07-23	5.0	None	Remote	Low	Not required	Partial	None	None
Microsoft Internet Explorer 5.01, 5.5 and 6.0 does not properly check the Cascading Style Sheet input parameter for Modal dialogs, which allows remote attackers to read files on the local system via a web page containing script that creates a dialog and then accesses the target files, aka "Modal Dialog script execution."
45	CVE-2003-0115			2003-05-12	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Microsoft Internet Explorer 5.01, 5.5 and 6.0 does not properly check parameters that are passed during third party rendering, which could allow remote attackers to execute arbitrary web script, aka the "Third Party Plugin Rendering" vulnerability, a different vulnerability than CVE-2003-0233.
46	CVE-2003-0114			2003-05-12	2021-07-23	5.0	None	Remote	Low	Not required	Partial	None	None
The file upload control in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to automatically upload files from the local system via a web page containing a script to upload the files.
47	CVE-2003-0113		Exec Code Overflow	2003-05-12	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Buffer overflow in URLMON.DLL in Microsoft Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to execute arbitrary code via an HTTP response containing long values in (1) Content-type and (2) Content-encoding fields.
48	CVE-2002-2435	200	+Info	2011-12-07	2021-07-23	4.3	None	Remote	Medium	Not required	Partial	None	None
The Cascading Style Sheets (CSS) implementation in Microsoft Internet Explorer 8.0 and earlier does not properly handle the :visited pseudo-class, which allows remote attackers to obtain sensitive information about visited web pages via a crafted HTML document, a related issue to CVE-2010-2264.
49	CVE-2002-2031			2002-12-31	2021-07-23	5.0	None	Remote	Low	Not required	Partial	None	None
Internet Explorer 5.0, 5.0.1 and 5.5 with JavaScript execution enabled allows remote attackers to determine the existence of arbitrary files via a script tag with a src parameter that references a non-JavaScript file, then using the onError event handler to monitor the results.
50	CVE-2002-1984		DoS	2002-12-31	2021-07-23	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Internet Explorer 5.0.1 through 6.0 on Windows 2000 or Windows XP allows remote attackers to cause a denial of service (crash) via an OBJECT tag that contains a crafted CLASSID (CLSID) value of "CLSID:00022613-0000-0000-C000-000000000046".

Total number of vulnerabilities : 66 Page : 1 (This Page)2