vulnwire
2.6low

CVE-2006-11921 exploit

Microsoft Internet Explorer 5.01 through 6 allows remote attackers to conduct phishing attacks by spoofing the address bar and other parts…

Published 20 y ago · modified 4 mo ago · JSON

CVSS
2.6
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
31.7%
percentile 98%
Public exploits
1
Exploit-DB

Microsoft Internet Explorer 5.01 through 6 allows remote attackers to conduct phishing attacks by spoofing the address bar and other parts of the trust UI via unknown methods that allow "window content to persist" after the user has navigated to another site, aka the "Address Bar Spoofing Vulnerability." NOTE: this is a different vulnerability than CVE-2006-1626.

Exploit prediction (EPSS)

31.74% probability of exploitation in the next 30 days, higher than 98% of all scored CVEs.

Exploits and detections

  • EDB-1838 Microsoft Internet Explorer - HTML Tag Memory Corruption (MS06-013) · dos · 2006-05-27

CVSS scores

Assigned byVersionScoreVector
NVD2.02.6AV:N/AC:H/Au:N/C:N/I:P/A:N

Classification

Weakness
  • CWE-20 Improper Input Validation

References

  • secunia.com /advisories/18957 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1498 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • securityreason.com /securityalert/670 · third-party-advisory, x_refsource_SREASON, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/25557 · vdb-entry, x_refsource_XF, x_transferred
  • securityfocus.com /bid/17460 · vdb-entry, x_refsource_BID, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1645 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • docs.microsoft.com /en-us/security-updates/securitybulletins/2006/ms06-013 · vendor-advisory, x_refsource_MS, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1336 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • vupen.com /english/advisories/2006/1318 · vdb-entry, x_refsource_VUPEN, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1740 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • securitytracker.com /id?1015899 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1725 · vdb-entry, signature, x_refsource_OVAL, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.