CVE-2010-0255
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
15Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 37%
Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, 7, and 8 does not prevent rendering of non-HTML local files as HTML documents, which allows remote attackers to bypass intended access restrictions and read arbitrary files via vectors involving JavaScript exploit code that constructs a reference to a file://127.0.0.1 URL, aka the dynamic OBJECT tag vulnerability, as demonstrated by obtaining the data from an index.dat file, a variant of CVE-2009-1140 and related to CVE-2008-1448.
Produtos afetados
n/a · n/aReferências
http://blogs.technet.com/msrc/archive/2010/02/03/security-advisory-980088-released.aspxhttp://isc.sans.org/diary.html?n&storyid=8152http://osvdb.org/62156https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-035https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7145http://support.avaya.com/css/P8/documents/100089747http://www.coresecurity.com/content/internet-explorer-dynamic-object-taghttp://www.microsoft.com/technet/security/advisory/980088.mspxhttp://www.securityfocus.com/archive/1/509345/100/0/threadedhttp://www.securityfocus.com/bid/38055http://www.securityfocus.com/bid/38056http://www.us-cert.gov/cas/techalerts/TA10-159B.html