Unscored severity · published Mar 17, 2007
CVE-2007-1499
Microsoft Internet Explorer 7.0 on Windows XP and Vista allows remote attackers to conduct phishing attacks and possibly execute arbitrary code via a res: URI to navcancl.htm with…
–
CVSS
30%
EPSS
No
On KEV
Description
Microsoft Internet Explorer 7.0 on Windows XP and Vista allows remote attackers to conduct phishing attacks and possibly execute arbitrary code via a res: URI to navcancl.htm with an arbitrary URL as an argument, which displays the URL in the location bar of the "Navigation Canceled" page and injects the script into the "Refresh the page" link, aka Navigation Cancel Page Spoofing Vulnerability."
Exploitation
Is it being used?
Exploit prediction (EPSS)30.0% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IE
IE · Microsoft
7.0; 7.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-1499
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-1499
Vendor Advisory
http://aviv.raffon.net/2007/03/14/PhishingUsingIE7LocalResourceVulnerability.aspx
news.com.com
http://news.com.com/2100-1002_3-6167410.html
osvdb.org
http://osvdb.org/35352
Vendor Advisory
http://secunia.com/advisories/24535
Vendor Advisory
http://secunia.com/advisories/25627
securityreason.com
http://securityreason.com/securityalert/2448
More from IE
8.8
CVE-2012-4792
Microsoft Internet Explorer Use-After-Free Vulnerability
8.8
CVE-2006-3730
Integer overflow in Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a 0x7fffffff…
–
CVE-2012-1545
Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, allows remote attackers to bypass Protected Mode or cause a denial of service (memory corruption) by leveraging…
–
CVE-2010-5071
The JavaScript implementation in Microsoft Internet Explorer 8.0 and earlier does not properly restrict the set of values contained in the object returned by the getComputedStyle…
–
CVE-2002-2435
The Cascading Style Sheets (CSS) implementation in Microsoft Internet Explorer 8.0 and earlier does not properly handle the :visited pseudo-class, which allows remote attackers to…