CVE-2006-5745

EPSS 75.9%

Unspecified vulnerability in the setRequestHeader method in the XMLHTTP (XML HTTP) ActiveX Control 4.0 in Microsoft XML Core Services 4.0 on Windows, when accessed by Internet Explorer, allows remote attackers to execute arbitrary code via crafted arguments that lead to memory corruption, a different vulnerability than CVE-2006-4685. NOTE: some of these details are obtained from third party information.

Affected products

n/a · n/a

public PoCs found — 4

exploitdbwww.exploit-db.com/exploits/16532unverified cve_referencewww.exploit-db.com/exploits/2743unverified exploitdbwww.exploit-db.com/exploits/2749unverified exploitdbwww.exploit-db.com/exploits/2753unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://blogs.securiteam.com/?p=717 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-071 http://secunia.com/advisories/22687 http://securitytracker.com/id?1017157 https://exchange.xforce.ibmcloud.com/vulnerabilities/30004 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A104 https://www.exploit-db.com/exploits/2743 http://www.iss.net/threats/239.html http://www.kb.cert.org/vuls/id/585137 http://www.microsoft.com/technet/security/advisory/927892.mspx http://www.securityfocus.com/bid/20915 http://www.us-cert.gov/cas/techalerts/TA06-318A.html