CVE-2017-0210: high-severity vulnerability in Microsoft Corporation Internet Explorer
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply updates per vendor instructions.
Internet Explorer fails to properly enforce cross-domain security rules, allowing an attacker to steal information from one website and inject it into another. This can lead to unauthorized access to sensitive data or malicious modifications in your browser.
The vulnerability occurs due to improper enforcement of cross-domain policies in Internet Explorer, allowing Same-Origin Policy bypass. An attacker can craft a malicious webpage that, when visited by a target, reads data from another domain and injects it into the victim's context, resulting in information disclosure or privilege escalation within the browser's security model.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.