CVE-2011-2019

CriticalCVSS 9.3/10Last modified Jun 16, 2026

Description

Untrusted search path vulnerability in Microsoft Internet Explorer 9 on Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains an HTML file, aka "Internet Explorer Insecure Library Loading Vulnerability."

Metrics

CVSS 2.0 9.3/10AV:N/AC:M/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-426

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.us-cert.gov/cas/techalerts/TA11-347A.htmlThird Party Advisory, US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-099Patch, Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13884Tool Signature
http://www.us-cert.gov/cas/techalerts/TA11-347A.htmlThird Party Advisory, US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-099Patch, Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13884Tool Signature

Timeline

Published: Dec 14, 2011
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-20204.3Cross-site scripting (XSS) vulnerability in TIBCO iProcess Engine before 11.1.3 and iProcess Workspace before 11.3.1 allows remote attackers CVE-2011-20214.3Session fixation vulnerability in TIBCO iProcess Engine before 11.1.3 and iProcess Workspace before 11.3.1 allows remote attackers to hijack CVE-2011-20226.9The agp_generic_remove_memory function in drivers/char/agp/generic.c in the Linux kernel before 2.6.38.5 does not validate a certain start p CVE-2011-20234.3Cross-site scripting (XSS) vulnerability in functions/mime.php in SquirrelMail before 1.4.22 allows remote attackers to inject arbitrary web CVE-2011-202410.0Cisco Network Registrar before 7.2 has a default administrative password, which makes it easier for remote attackers to obtain access via a CVE-2011-20397.6The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect VPN Client) before 2.3.185 on Windows, and on Windows CVE-2011-20409.3The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect VPN Client) before 2.5.3041, and 3.0.x before 3.0.629 CVE-2011-20417.2The Start Before Logon (SBL) functionality in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect VPN Client) before 2.3.254 on Win CVE-2011-20425.0The Sybase SQL Anywhere database component in Cisco CiscoWorks Common Services 3.x and 4.x before 4.1 allows remote attackers to obtain pote CVE-2011-20547.5A vulnerability in the Cisco ASA that could allow a remote attacker to successfully authenticate using the Cisco AnyConnect VPN client if th CVE-2011-20577.5The cat6000-dot1x component in Cisco IOS 12.2 before 12.2(33)SXI7 does not properly handle (1) a loop between a dot1x enabled port and an op CVE-2011-20587.5The cat6000-dot1x component in Cisco IOS 12.2 before 12.2(33)SXI7 does not properly handle an external loop between a pair of dot1x enabled