CVE-2014-1816

Currently unrated

Key Information:

Vendor
Microsoft
Status
Xml Core Services
Vendor
CVE Published:
11 June 2014

Summary

Microsoft XML Core Services (aka MSXML) 3.0 and 6.0 does not properly restrict the information transmitted by Internet Explorer during a download action, which allows remote attackers to discover (1) full pathnames on the client system and (2) local usernames embedded in these pathnames via a crafted web site, aka "MSXML Entity URI Vulnerability."

References

https://docs.microsoft.com/en-us/security-updates/securit...
vendor-advisoryx_refsource_MS
http://www.securityfocus.com/bid/67895
vdb-entryx_refsource_BID
http://blogs.technet.com/b/srd/archive/2014/06/10/assessi...
x_refsource_CONFIRM

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database
.