Information disclosure in Microsoft Internet Explorer

CVE-2010-1258

Microsoft Internet Explorer 6, 7, and 8 does not properly determine the origin of script code, which allows remote attackers to execute script in an unintended domain or security zone, and obtain sensitive information, via unspecified vectors, aka "Event Handler Cross-Domain Vulnerability."

Vulnerability class: Information Disclosure

EPSS: 0.170 (96.8th percentile) — read the EPSS interpretation.

Affected products

Microsoft Internet_explorer — versions 8, 6, 7
Microsoft Windows_2003_server
Microsoft Windows_7
Microsoft Windows_server_2003
Microsoft Windows_server_2008
Microsoft Windows_vista
Microsoft Windows_xp
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

secure@microsoft.com (signature, x_refsource_OVAL, vdb-entry)
secure@microsoft.com (US Government Resource, x_refsource_CERT, third-party-advisory)
secure@microsoft.com (x_refsource_MS, vendor-advisory)