IE
Product
Internet Explorer 9
On CISA KEVExploited in the wildRansomware-linked
1,635
CVEs
43
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 330Medium 95Low 11
Watch
Add Internet Explorer 9 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-1004 | 8.8 | Apr 12 | A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution Vulnerability." This… Affected: 9 |
| CVE-2017-8625 | 8.8 | Aug 8 | Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to bypass Device Guard User Mode Code Integrity (UMCI) policies due to Internet… Affected: 11 |
| CVE-2016-7283 | 8.8 | Dec 20 | Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet… Affected: 9; 10; 11 |
| CVE-2016-3324 | 8.8 | Sep 14 | Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet… Affected: 9; 10; 11 |
| CVE-2016-3297 | 8.8 | Sep 14 | Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web… Affected: 9; 10; 11 |
| CVE-2016-3260 | 8.8 | Jul 13 | The Microsoft (1) JScript 9, (2) VBScript, and (3) Chakra JavaScript engines, as used in Microsoft Internet Explorer 11, Microsoft Edge, and other products, allow remote attackers… Affected: 11 |
| CVE-2016-3259 | 8.8 | Jul 13 | The Microsoft (1) JScript 9, (2) VBScript, and (3) Chakra JavaScript engines, as used in Microsoft Internet Explorer 9 through 11, Microsoft Edge, and other products, allow remote… Affected: 9; 10; 11 |
| CVE-2016-3248 | 8.8 | Jul 13 | The Microsoft (1) JScript 9, (2) VBScript, and (3) Chakra JavaScript engines, as used in Microsoft Internet Explorer 9 through 11, Microsoft Edge, and other products, allow remote… Affected: 9; 10; 11 |
| CVE-2016-3204 | 8.8 | Jul 13 | The Microsoft (1) JScript 5.8 and 9 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary… Affected: 9; 10; 11 |
| CVE-2016-3213 | 8.8 | Jun 16 | The Web Proxy Auto Discovery (WPAD) protocol implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012… Affected: 9; 10; 11 |
| CVE-2016-3211 | 8.8 | Jun 16 | Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet… Affected: 9; 10; 11 |
| CVE-2016-3210 | 8.8 | Jun 16 | The Microsoft (1) JScript and (2) VBScript engines, as used in Internet Explorer 11, allow remote attackers to execute arbitrary code or cause a denial of service (memory… Affected: 11 |
| CVE-2016-0200 | 8.8 | Jun 16 | Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet… Affected: 9; 10; 11 |
| CVE-2016-0199 | 8.8 | Jun 16 | Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet… Affected: 9; 10; 11 |
| CVE-2016-0188 | 8.8 | May 11 | The User Mode Code Integrity (UMCI) implementation in Device Guard in Microsoft Internet Explorer 11 allows remote attackers to bypass a code-signing protection mechanism via… Affected: 11 |
| CVE-2016-0069 | 8.8 | Feb 18 | Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Internet Explorer Elevation of Privilege… Affected: 9; 10; 11 |
| CVE-2016-0068 | 8.8 | Feb 18 | Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Internet Explorer Elevation of Privilege… Affected: 9; 10; 11 |
| CVE-2016-0072 | 8.8 | Feb 10 | Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet… Affected: 9; 10; 11 |
| CVE-2016-0071 | 8.8 | Feb 10 | Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer… Affected: 9 |
| CVE-2016-0067 | 8.8 | Feb 10 | Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet… Affected: 9; 10; 11 |
| CVE-2016-0064 | 8.8 | Feb 10 | Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer… Affected: 10 |
| CVE-2016-0063 | 8.8 | Feb 10 | Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet… Affected: 9; 10; 11 |
| CVE-2016-0062 | 8.8 | Feb 10 | Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka… Affected: 11 |
| CVE-2016-0061 | 8.8 | Feb 10 | Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web… Affected: 9; 10; 11 |
| CVE-2016-0060 | 8.8 | Feb 10 | Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web… Affected: 9; 10; 11 |
| CVE-2013-0090 | 8.8 | Mar 13 | Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted… Affected: 6; 7; 8; 9; 10 |
| CVE-2012-4775 | 8.8 | Nov 14 | Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site, aka "CTreeNode Use After Free… Affected: 9 |
| CVE-2010-3328 | 8.8 | Oct 13 | Use-after-free vulnerability in the CAttrArray::PrivateFind function in mshtml.dll in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code by… Affected: 6; 7; 8 |
| CVE-2009-1547 | 8.8 | Oct 14 | Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via a crafted data stream header that triggers… Affected: 5.01; 6; 6; 7; 8 |
| CVE-2009-1532 | 8.8 | Jun 10 | Microsoft Internet Explorer 8 for Windows XP SP2 and SP3; 8 for Server 2003 SP2; 8 for Vista Gold, SP1, and SP2; and 8 for Server 2008 SP2 does not properly handle objects in… Affected: 8 |
| CVE-2009-0554 | 8.8 | Apr 15 | Microsoft Internet Explorer 5.01 SP4, 6 SP1, 6 and 7 on Windows XP SP2 and SP3, 6 and 7 on Windows Server 2003 SP1 and SP2, 7 on Windows Vista Gold and SP1, and 7 on Windows… Affected: 6; 7; 5.01; 6 |
| CVE-2008-3475 | 8.8 | Oct 15 | Microsoft Internet Explorer 6 does not properly handle errors related to using the componentFromPoint method on xml objects that have been (1) incorrectly initialized or (2)… Affected: 5.01; 6; 6; 7.0 |
| CVE-2008-0077 | 8.8 | Feb 12 | Use-after-free vulnerability in Microsoft Internet Explorer 6 SP1, 6 SP2, and and 7 allows remote attackers to execute arbitrary code by assigning malformed values to certain… Affected: 6; 6; 7 |
| CVE-2006-3730 | 8.8 | Jul 21 | Integer overflow in Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a 0x7fffffff… Affected: 6.0 |
| CVE-2018-8357 | 8.3 | Aug 15 | An elevation of privilege vulnerability exists in Microsoft browsers allowing sandbox escape, aka "Microsoft Browser Elevation of Privilege Vulnerability." This affects Internet… Affected: 11 |
| CVE-2016-3353 | 8.3 | Sep 14 | Microsoft Internet Explorer 9 through 11 mishandles .url files from the Internet zone, which allows remote attackers to bypass intended access restrictions via a crafted file, aka… Affected: 9; 10; 11 |
| CVE-1999-0468 | 8.2 | Apr 9 | Internet Explorer 5.0 allows a remote server to read arbitrary files on the client's file system using the Microsoft Scriptlet Component Affected: 5.0 |
| CVE-2015-6184 | 8.1 | Mar 9 | The CAttrArray object implementation in Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and… Affected: 7; 8; 9; 10; 11; 11 |
| CVE-2012-1539 | 8.1 | Nov 14 | Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site, aka "CTreePos Use After Free Vulnerability." Affected: 9 |
| CVE-2012-1879 | 8.1 | Jun 12 | Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by attempting to access an undefined… Affected: 7; 8; 9; 6 |
| CVE-2011-0346 | 8.1 | Jan 7 | Use-after-free vulnerability in the ReleaseInterface function in MSHTML.DLL in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code or cause a… Affected: 6; 7; 8 |
| CVE-2010-0492 | 8.1 | Mar 31 | Use-after-free vulnerability in mstime.dll in Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code via vectors related to the TIME2 behavior, the… Affected: 8; 8.0.6001 |
| CVE-2010-0248 | 8.1 | Jan 22 | Microsoft Internet Explorer 6, 6 SP1, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1)… Affected: 8; 8.0.6001; 7; 7.0; 7.0.5730; 7.0.5730.11; +21 more |
| CVE-2009-3671 | 8.1 | Dec 9 | Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly… Affected: 5.0.1; 6; 6; 7; 8 |
| CVE-2009-2529 | 8.1 | Oct 14 | Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, 7, and 8 does not properly handle argument validation for unspecified variables, which allows remote attackers to execute arbitrary… Affected: 5.01; 6; 6; 7; 8 |
| CVE-2009-2502 | 8.1 | Oct 14 | Buffer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002… Affected: 6 |
| CVE-2009-1529 | 8.1 | Jun 10 | Microsoft Internet Explorer 7 for Windows XP SP2 and SP3; 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2; and 7 for Server 2008 SP2 does not properly handle objects in… Affected: 6; 7; 6; 5.01; 5.01; 8 |
| CVE-2009-0551 | 8.1 | Apr 15 | Microsoft Internet Explorer 6 SP1, 6 and 7 on Windows XP SP2 and SP3, 6 and 7 on Windows Server 2003 SP1 and SP2, 7 on Windows Vista Gold and SP1, and 7 on Windows Server 2008… Affected: 6; 7; 6 |
| CVE-2016-0160 | 7.8 | Apr 12 | Microsoft Internet Explorer 11 mishandles DLL loading, which allows local users to gain privileges via a crafted application, aka "DLL Loading Remote Code Execution Vulnerability." Affected: 11 |
| CVE-2016-0041 | 7.8 | Feb 10 | Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold and 1511, and… Affected: 10; 11 |
The 500 most important CVEs for this product (exploited first, then by severity)