CVE-2005-2274

LowCVSS 2.6/10Last modified Jun 16, 2026

Description

Microsoft Internet Explorer 6.0 does not clearly associate a Javascript dialog box with the web page that generated it, which allows remote attackers to spoof a dialog box from a trusted site and facilitates phishing attacks, aka the "Dialog Origin Spoofing Vulnerability."

Metrics

CVSS 2.0 2.6/10AV:N/AC:H/Au:N/C:N/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/15491Exploit, Vendor Advisory
http://secunia.com/advisories/15492Vendor Advisory
http://secunia.com/multiple_browsers_dialog_origin_vulnerability_test/Exploit
http://secunia.com/secunia_research/2005-9/advisory/Vendor Advisory
http://www.microsoft.com/technet/security/advisory/902333.mspxVendor Advisory
http://secunia.com/advisories/15491Exploit, Vendor Advisory
http://secunia.com/advisories/15492Vendor Advisory
http://secunia.com/multiple_browsers_dialog_origin_vulnerability_test/Exploit
http://secunia.com/secunia_research/2005-9/advisory/Vendor Advisory
http://www.microsoft.com/technet/security/advisory/902333.mspxVendor Advisory

Timeline

Published: Jul 13, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-22764.3Cross-site scripting (XSS) vulnerability in Novell Groupwise WebAccess 6.5 before July 11, 2005 allows remote attackers to inject arbitrary CVE-2005-227710.0Bluetooth FTP client (BTFTP) in Nokia Affix 2.1.2 and 3.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters i CVE-2005-22787.2Stack-based buffer overflow in the IMAP daemon (imapd) in MailEnable Professional 1.54 allows remote authenticated users to execute arbitrar CVE-2005-22795.0Cisco ONS 15216 Optical Add/Drop Multiplexer (OADM) running firmware 2.2.2 and earlier allows remote attackers to cause a denial of service CVE-2005-22805.0Cisco Security Agent (CSA) 4.5 allows remote attackers to cause a denial of service (system crash) via a crafted IP packet.CVE-2005-22817.5WebEOC before 6.0.2 uses a weak encryption scheme for passwords, which makes it easier for attackers to crack passwords.CVE-2005-22824.3Multiple cross-site scripting (XSS) vulnerabilities in WebEOC before 6.0.2 allow remote attackers to inject arbitrary web script and HTML vi CVE-2005-22832.1WebEOC before 6.0.2 does not properly restrict the size of an uploaded file, which allows remote authenticated users to cause a denial of se CVE-2005-22847.5Multiple SQL injection vulnerabilities in WebEOC before 6.0.2 allow remote attackers to modify SQL statements via unknown attack vectors.CVE-2005-22855.0WebEOC before 6.0.2 stores sensitive information in locations such as URIs, web pages, and configuration files, which allows remote attacker CVE-2005-228610.0WebEOC before 6.0.2 does not properly check user authorization, which allows remote attackers to gain privileges via a direct request to a r CVE-2005-22875.0SoftiaCom wMailServer 1.0 and 2.0 allows remote attackers to cause a denial of service (application crash) via a large TCP packet with a lea