High severity · published Jan 13, 2016
CVE-2016-0002
The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, allow remote attackers to execute…
7.5
CVSS
23.4%
EPSS
No
On KEV
Description
The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, allow remote attackers to execute arbitrary code via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability."
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)23.4% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
Jscript · Microsoft
5.7; 5.8 · source: NVD
VB
Vbscript · Microsoft
5.7; 5.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-0002
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-0002
www.securitytracker.com
http://www.securitytracker.com/id/1034648
www.securitytracker.com
http://www.securitytracker.com/id/1034650
docs.microsoft.com
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-001
docs.microsoft.com
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-003
www.verisign.com
https://www.verisign.com/en_US/security-services/security-intelligence/vulnerability-reports/articles/index.xhtml?id=1215
More from Jscript
7.5
CVE-2016-0189
Microsoft Internet Explorer Memory Corruption Vulnerability
8.8
CVE-2011-0663
Multiple integer overflows in the Microsoft (1) JScript 5.6 through 5.8 and (2) VBScript 5.6 through 5.8 scripting engines allow remote attackers to execute arbitrary code via a…
7.5
CVE-2016-3207
The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code…
7.5
CVE-2016-3206
The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code…
7.5
CVE-2016-3205
The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code…