CVE-2001-1325

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Internet Explorer 5.0 and 5.5, and Outlook Express 5.0 and 5.5, allow remote attackers to execute scripts when Active Scripting is disabled by including the scripts in XML stylesheets (XSL) that are referenced using an IFRAME tag, possibly due to a vulnerability in Windows Scripting Host (WSH).

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/archive/1/3AE02004.57FDF958%40guninski.com
http://www.securityfocus.com/bid/2633Exploit, Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/6448
http://www.securityfocus.com/archive/1/3AE02004.57FDF958%40guninski.com
http://www.securityfocus.com/bid/2633Exploit, Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/6448

Timeline

Published: Apr 20, 2001
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2001

CVE-2001-13267.5Eudora 5.1 allows remote attackers to execute arbitrary code when the "Use Microsoft Viewer" option is enabled and the "allow executables in CVE-2001-13274.6pmake before 2.1.35 in Turbolinux 6.05 and earlier is installed with setuid root privileges, which could allow local users to gain privilege CVE-2001-13287.5Buffer overflow in ypbind daemon in Solaris 5.4 through 8 allows remote attackers to execute arbitrary code.CVE-2001-13297.2Buffer overflow in rsh on AIX 4.2.0.0 may allow local users to gain root privileges via a long command line argument.CVE-2001-13307.2Buffer overflow in rsh on AIX 4.2.0.0 may allow local users to gain root privileges via a long command line argument.CVE-2001-13311.2mandb in the man-db package before 2.3.16-3 allows local users to overwrite arbitrary files via the command line options (1) -u or (2) -c, w CVE-2001-13327.5Buffer overflows in Linux CUPS before 1.1.6 may allow remote attackers to execute arbitrary code.CVE-2001-13331.2Linux CUPS before 1.1.6 does not securely handle temporary files, possibly due to a symlink vulnerability that could allow local users to ov CVE-2001-13345.0Block_render_url.class in PHPSlash 0.6.1 allows remote attackers with PHPSlash administrator privileges to read arbitrary files by creating CVE-2001-13355.0Directory traversal vulnerability in CesarFTP 0.98b and earlier allows remote authenticated users (such as anonymous) to read arbitrary file CVE-2001-13367.5CesarFTP 0.98b and earlier stores usernames and passwords in plaintext in the settings.ini file, which allows attackers to gain privileges.CVE-2001-13375.0Beck IPC GmbH IPC@CHIP Embedded-Webserver allows remote attackers to cause a denial of service via a long HTTP request.