CVE-2007-3092

CriticalCVSS 9.3/10Last modified Jun 16, 2026

Description

Microsoft Internet Explorer 6 allows remote attackers to spoof the URL bar, and page properties including SSL certificates, by interrupting page loading through certain use of location DOM objects and setTimeout calls. NOTE: this issue can be leveraged for phishing and other attacks.

Metrics

CVSS 2.0 9.3/10AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0026.htmlBroken Link
http://lcamtuf.coredump.cx/ietrap2/Broken Link
http://osvdb.org/45437Broken Link
http://secunia.com/advisories/25564Not Applicable
http://securityreason.com/securityalert/2781Exploit, Third Party Advisory
http://securitytracker.com/id?1018193Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/470446/100/0/threadedThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/24298Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/34705VDB Entry
http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0026.htmlBroken Link
http://lcamtuf.coredump.cx/ietrap2/Broken Link
http://osvdb.org/45437Broken Link
http://secunia.com/advisories/25564Not Applicable
http://securityreason.com/securityalert/2781Exploit, Third Party Advisory
http://securitytracker.com/id?1018193Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/470446/100/0/threadedThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/24298Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/34705VDB Entry

Timeline

Published: Jun 6, 2007
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2007

CVE-2007-309310.0Unspecified vulnerability in the logging mechanism in Solaris Management Console (SMC) on Sun Solaris 8 through 10 before 20070605 allows re CVE-2007-30949.0Unspecified vulnerability in the authentication mechanism in Solaris Management Console (SMC) on Sun Solaris 8 through 10 before 20070605 al CVE-2007-30959.0Unspecified vulnerability in Symantec Reporting Server 1.0.197.0, and other versions before 1.0.224.0, as used in Symantec Client Security 3 CVE-2007-30966.8Directory traversal vulnerability in login.php in PBLang (PBL) 4.67.16.a and earlier, when magic_quotes_gpc is disabled, allows remote attac CVE-2007-30977.5my.activation.php3 in F5 FirePass 4100 SSL VPN allows remote attackers to execute arbitrary shell commands via shell metacharacters in the u CVE-2007-30985.0The SNMPc Server (crserv.exe) process in Castle Rock Computing SNMPc before 7.0.19 allows remote attackers to cause a denial of service (cra CVE-2007-30992.1usr/mgmt_ipc.c in iscsid in open-iscsi (iscsi-initiator-utils) before 2.0-865 checks the client's UID on the listening AF_LOCAL socket inste CVE-2007-31002.1usr/log.c in iscsid in open-iscsi (iscsi-initiator-utils) before 2.0-865 uses a semaphore with insecure permissions (world-writable/world-re CVE-2007-31014.3Multiple cross-site scripting (XSS) vulnerabilities in certain JSF applications in Apache MyFaces Tomahawk before 1.1.6 allow remote attacke CVE-2007-31024.3Unspecified vulnerability in the linux_audit_record_event function in OpenSSH 4.3p2, as used on Fedora Core 6 and possibly other systems, al CVE-2007-31036.2The init.d script for the X.Org X11 xfs font server on various Linux distributions might allow local users to change the permissions of arbi CVE-2007-31044.9The sysfs_readdir function in the Linux kernel 2.6, as used in Red Hat Enterprise Linux (RHEL) 4.5 and other distributions, allows users to