IE
Product
Internet Explorer 9
On CISA KEVExploited in the wildRansomware-linked
1,635
CVEs
43
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 330Medium 95Low 11
Watch
Add Internet Explorer 9 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-0949 | 6.5 | Jul 11 | A security feature bypass vulnerability exists when Microsoft Internet Explorer improperly handles requests involving UNC resources, aka "Internet Explorer Security Feature Bypass… Affected: 10; 11; 9 |
| CVE-2018-8113 | 6.5 | Jun 14 | A security feature bypass vulnerability exists in Internet Explorer that allows for bypassing Mark of the Web Tagging (MOTW), aka "Internet Explorer Security Feature Bypass… Affected: 11 |
| CVE-2017-8602 | 6.5 | Jul 11 | Microsoft browsers on Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, Windows 10 Gold, 1511, 1607, and 1703, and… Affected: 11 |
| CVE-2017-8592 | 6.5 | Jul 11 | Microsoft browsers on when Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, Windows RT 8.1, and Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703,… Affected: 9; 10; 11 |
| CVE-2017-8529 | 6.5 | Jun 15 | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, and Windows Server 2012 and R2 allow an attacker to detect specific files… Affected: 11; 9; 10 |
| CVE-2017-0064 | 6.5 | May 12 | A security feature bypass vulnerability exists in Internet Explorer that allows for bypassing Mixed Content warnings, aka "Internet Explorer Security Feature Bypass Vulnerability." Affected: 9; 10; 11 |
| CVE-2016-3245 | 6.5 | Jul 13 | Microsoft Internet Explorer 9 through 11 allows remote attackers to trick users into making TCP connections to a restricted port via a crafted web site, aka "Internet Explorer… Affected: 9; 10; 11 |
| CVE-2010-3330 | 6.5 | Oct 13 | Microsoft Internet Explorer 6 through 8 does not properly restrict script access to content from a different (1) domain or (2) zone, which allows remote attackers to obtain… Affected: 6; 7; 8 |
| CVE-2010-0488 | 6.5 | Mar 31 | Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 does not properly handle unspecified "encoding strings," which allows remote attackers to bypass the Same Origin Policy and… Affected: 7; 7; 6; 5.01; 6 |
| CVE-2008-3474 | 6.5 | Oct 15 | Microsoft Internet Explorer 6 and 7 does not properly determine the domain or security zone of origin of web script, which allows remote attackers to bypass the intended… Affected: 5.01; 6; 6; 7 |
| CVE-2006-7031 | 6.5 | Feb 23 | Microsoft Internet Explorer 6.0.2900 SP2 and earlier allows remote attackers to cause a denial of service (crash) via a table element with a CSS attribute that sets the position,… Affected: through 6.0.2900 |
| CVE-2019-1238 | 6.4 | Oct 10 | A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability' Affected: 11; 10; 9 |
| CVE-2019-1193 | 6.4 | Aug 14 | A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory Affected: 10; 11 |
| CVE-2020-1506 | 6.1 | Sep 11 | <p>An elevation of privilege vulnerability exists in the way that the Wininit.dll handles objects in memory Affected: 11 |
| CVE-2009-5159 | 6.1 | Mar 13 | Invision Power Board (aka IPB or IP.Board) 2.x through 3.0.4, when Internet Explorer 5 is used, allows XSS via a .txt attachment Affected: 5 |
| CVE-2018-8470 | 6.1 | Sep 13 | A security feature bypass vulnerability exists in Internet Explorer due to how scripts are handled that allows a universal cross-site scripting (UXSS) condition, aka "Internet… Affected: 11 |
| CVE-2016-7282 | 6.1 | Dec 20 | Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allows remote attackers to inject arbitrary web script or HTML via… Affected: 9; 10; 11 |
| CVE-2016-3212 | 6.1 | Jun 16 | The XSS Filter in Microsoft Internet Explorer 9 through 11 does not properly identify JavaScript, which makes it easier for remote attackers to conduct cross-site scripting (XSS)… Affected: 9; 10; 11 |
| CVE-2012-1872 | 6.1 | Jun 12 | Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 6 through 9 allows remote attackers to inject arbitrary web script or HTML via crafted character sequences… Affected: 6; 7; 8; 9 |
| CVE-2011-1252 | 6.1 | Jun 16 | Cross-site scripting (XSS) vulnerability in the SafeHTML function in the toStaticHTML API in Microsoft Internet Explorer 7 and 8, Office SharePoint Server 2007 SP2, Office… Affected: 7; 8 |
| CVE-2020-1315 | 5.3 | Jun 9 | An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory, aka 'Internet Explorer Information Disclosure Vulnerability' Affected: 11; 9 |
| CVE-2018-1000 | 5.3 | Apr 12 | An information disclosure vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Information Disclosure… Affected: 10; 11; 9 |
| CVE-2018-0981 | 5.3 | Apr 12 | An information disclosure vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Information Disclosure… Affected: 10; 11; 9 |
| CVE-2017-11919 | 5.3 | Dec 12 | ChakraCore, and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, and Windows 10 Gold, 1511, 1607,… Affected: 11 |
| CVE-2017-11906 | 5.3 | Dec 12 | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Windows 10 Gold, 1511, 1607, 1703,… Affected: 11; 9; 10 |
| CVE-2017-11887 | 5.3 | Dec 12 | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Windows 10 Gold, 1511, 1607,… Affected: 11; 9; 10 |
| CVE-2017-11834 | 5.3 | Nov 15 | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Windows 10 Gold, 1511, 1607,… Affected: 11; 9; 10 |
| CVE-2016-7281 | 5.3 | Dec 20 | The Web Workers implementation in Microsoft Internet Explorer 10 and 11 and Microsoft Edge allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka… Affected: 10; 11 |
| CVE-2016-7278 | 5.3 | Dec 20 | Microsoft Internet Explorer 9 through 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Windows Hyperlink Object Library… Affected: 9; 10; 11 |
| CVE-2016-3391 | 5.3 | Oct 14 | Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow context-dependent attackers to discover credentials by leveraging access to a memory dump, aka "Microsoft Browser… Affected: 10; 11 |
| CVE-2016-3388 | 5.3 | Oct 14 | Microsoft Internet Explorer 10 and 11 and Microsoft Edge do not properly restrict access to private namespaces, which allows remote attackers to gain privileges via unspecified… Affected: 10; 11 |
| CVE-2016-3267 | 5.3 | Oct 14 | Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to determine the existence of unspecified files via a crafted web site, aka "Microsoft Browser… Affected: 9; 10; 11 |
| CVE-2016-7153 | 5.3 | Sep 6 | The HTTP/2 protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote attackers to obtain… Affected: All versions, or not specified |
| CVE-2016-7152 | 5.3 | Sep 6 | The HTTPS protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote attackers to obtain… Affected: All versions, or not specified |
| CVE-2016-3329 | 5.3 | Aug 9 | Microsoft Internet Explorer 9 through 11 and Edge allow remote attackers to determine the existence of files via a crafted webpage, aka "Internet Explorer Information Disclosure… Affected: 9; 10; 11 |
| CVE-2016-3327 | 5.3 | Aug 9 | Microsoft Internet Explorer 9 through 11 and Edge allow remote attackers to obtain sensitive information via a crafted web page, aka "Microsoft Browser Information Disclosure… Affected: 9; 10; 11 |
| CVE-2016-3326 | 5.3 | Aug 9 | Microsoft Internet Explorer 9 through 11 and Edge allow remote attackers to obtain sensitive information via a crafted web page, aka "Microsoft Browser Information Disclosure… Affected: 9; 10; 11 |
| CVE-2016-3277 | 5.3 | Jul 13 | Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information… Affected: 10; 11 |
| CVE-2016-3273 | 5.3 | Jul 13 | The XSS Filter in Microsoft Internet Explorer 9 through 11 and Microsoft Edge does not properly restrict JavaScript code, which allows remote attackers to obtain sensitive… Affected: 9; 10; 11 |
| CVE-2016-3261 | 5.3 | Jul 13 | Microsoft Internet Explorer 11 allows remote attackers to obtain sensitive information via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability." Affected: 11 |
| CVE-2016-0194 | 5.3 | May 11 | Microsoft Internet Explorer 10 and 11 allows remote attackers to bypass file permissions and obtain sensitive information via a crafted web site, aka "Internet Explorer… Affected: 10; 11 |
| CVE-2016-3292 | 5.0 | Sep 14 | Microsoft Internet Explorer 10 and 11 mishandles integrity settings and zone settings, which allows remote attackers to bypass a sandbox protection mechanism via a crafted web… Affected: 10; 11 |
| CVE-2017-0154 | 4.4 | Mar 17 | Microsoft Internet Explorer 11 on Windows 10, 1511, and 1606 and Windows Server 2016 does not enforce cross-domain policies, allowing attackers to access information from one… Affected: 11 |
| CVE-2020-1432 | 4.3 | Jul 14 | An information disclosure vulnerability exists when Skype for Business is accessed via Internet Explorer, aka 'Skype for Business via Internet Explorer Information Disclosure… Affected: 11 |
| CVE-2020-0706 | 4.3 | Feb 11 | An information disclosure vulnerability exists in the way that affected Microsoft browsers handle cross-origin requests, aka 'Microsoft Browser Information Disclosure… Affected: 10; 11 |
| CVE-2019-1357 | 4.3 | Oct 10 | A spoofing vulnerability exists when Microsoft Browsers improperly handle browser cookies, aka 'Microsoft Browser Spoofing Vulnerability' Affected: 10; 11 |
| CVE-2019-0608 | 4.3 | Oct 10 | A spoofing vulnerability exists when Microsoft Browsers does not properly parse HTTP content, aka 'Microsoft Browser Spoofing Vulnerability' Affected: 10; 11; 9 |
| CVE-2019-1220 | 4.3 | Sep 11 | A security feature bypass vulnerability exists when Microsoft Browsers fail to validate the correct Security Zone of requests for specific URLs, aka 'Microsoft Browser Security… Affected: 9; 10; 11 |
| CVE-2019-1192 | 4.3 | Aug 14 | A security feature bypass vulnerability exists when Microsoft browsers improperly handle requests of different origins Affected: 10; 11 |
| CVE-2019-0920 | 4.3 | Jun 12 | A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers Affected: 11; 10; 9 |
The 500 most important CVEs for this product (exploited first, then by severity)