CVE-2018-8470

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A security feature bypass vulnerability exists in Internet Explorer due to how scripts are handled that allows a universal cross-site scripting (UXSS) condition, aka "Internet Explorer Security Feature Bypass Vulnerability." This affects Internet Explorer 11.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
MicrosoftInternet Explorer 11Windows 10 for 32-bit Systems; Windows 10 for x64-based Systems; Windows 10 Version 1607 for 32-bit Systems; Windows 10 Version 1607 for x64-based Systems; Windows 10 Version 1703 for 32-bit Systems; Windows 10 Version 1703 for x64-based Systems; Windows 10 Version 1709 for 32-bit Systems; Windows 10 Version 1709 for x64-based Systems; Windows 10 Version 1803 for 32-bit Systems; Windows 10 Version 1803 for x64-based Systems; Windows 7 for 32-bit Systems Service Pack 1; Windows 7 for x64-based Systems Service Pack 1; Windows 8.1 for 32-bit systems; Windows 8.1 for x64-based systems; Windows RT 8.1; Windows Server 2008 R2 for x64-based Systems Service Pack 1; Windows Server 2012 R2; Windows Server 2016

References

Timeline

Published
Sep 13, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-84717.8An elevation of privilege vulnerability exists in the way that the Microsoft RemoteFX Virtual GPU miniport driver handles objects in memory,CVE-2018-84725.5An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory, allowiCVE-2018-84737.5A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory CorruptioCVE-2018-84747.5A security feature bypass vulnerability exists when Lync for Mac 2011 fails to properly sanitize specially crafted messages, aka "Lync for MCVE-2018-84758.8A remote code execution vulnerability exists when Windows does not properly handle specially crafted image files, aka "Windows Remote Code ECVE-2018-84769.8A remote code execution vulnerability exists in the way that Windows Deployment Services TFTP Server handles objects in memory, aka "WindowsCVE-2018-84775.5An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel InformationCVE-2018-84795.6A spoofing vulnerability exists for the Azure IoT Device Provisioning for the C SDK library using the HTTP protocol on Windows platform, akaCVE-2018-84805.4An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request tCVE-2018-84813.1An information disclosure vulnerability exists when Windows Media Player improperly discloses file information, aka "Windows Media Player InCVE-2018-84823.1An information disclosure vulnerability exists when Windows Media Player improperly discloses file information, aka "Windows Media Player InCVE-2018-84847.8An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "
CVE-2018-8470: Medium severity, CVSS 6.1 | Vulnix