Unscored severity · published Dec 31, 2005
CVE-2005-4827
Internet Explorer 6.0, and possibly other versions, allows remote attackers to bypass the same origin security policy and make requests outside of the intended domain by calling…
–
CVSS
11.2%
EPSS
No
On KEV
Description
Internet Explorer 6.0, and possibly other versions, allows remote attackers to bypass the same origin security policy and make requests outside of the intended domain by calling open on an XMLHttpRequest object (Microsoft.XMLHTTP) and using tab, newline, and carriage return characters within the first argument (method name), which is supported by some proxy servers that convert tabs to spaces. NOTE: this issue can be leveraged to conduct referer spoofing, HTTP Request Smuggling, and other attacks.
Exploitation
Is it being used?
Exploit prediction (EPSS)11.2% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IE
IE · Microsoft
6; 6; 6; 6; 6; 6; +16 more · source: NVD
IE
Internet Explorer · Microsoft
6; 6.0; 6.0.2600; 6.0.2800; 6.0.2800.1106; 6.0.2900.2180 · source: NVD
NC
Network Camera Server Vb101 · Canon
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-4827
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-4827
Vendor Advisory
http://seclists.org/fulldisclosure/2007/Feb/0081.html
Exploit
http://www.securityfocus.com/archive/1/411585
www.securityfocus.com
http://www.securityfocus.com/archive/1/459172/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/14969
More from Network Camera Server Vb101
–
CVE-2007-2680
Cross-site scripting (XSS) vulnerability in the management interface in Canon Network Camera Server VB100 and VB101 with firmware 3.0 R69 and earlier, and VB150 with firmware 1.1…
–
CVE-2006-7065
Microsoft Internet Explorer allows remote attackers to cause a denial of service (crash) via an IFRAME with a certain XML file and XSL stylesheet that triggers a crash in…
–
CVE-2006-3354
Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (crash) by setting the Filter property of an ADODB.Recordset ActiveX object to certain values…
–
CVE-2006-2900
Internet Explorer 6 allows user-assisted remote attackers to read arbitrary files by tricking a user into typing the characters of the target filename in a text box and using the…
–
CVE-2006-1192
Microsoft Internet Explorer 5.01 through 6 allows remote attackers to conduct phishing attacks by spoofing the address bar and other parts of the trust UI via unknown methods that…