CVE-2006-5745
Unspecified vulnerability in the setRequestHeader method in the XMLHTTP (XML HTTP) ActiveX Control 4.0 in Microsoft XML Core Services 4.0 on Windows, when accessed by Internet Explorer, allows remote attackers to execute arbitrary code via crafted…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 76.1%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.
Description
Unspecified vulnerability in the setRequestHeader method in the XMLHTTP (XML HTTP) ActiveX Control 4.0 in Microsoft XML Core Services 4.0 on Windows, when accessed by Internet Explorer, allows remote attackers to execute arbitrary code via crafted arguments that lead to memory corruption, a different vulnerability than CVE-2006-4685. NOTE: some of these details are obtained from third party information.
- CVSS 2.0
- 7.6 HIGHAV:N/AC:H/Au:N/C:C/I:C/A:C
- EPSS
- 76.09% probability · 100th percentile
- CISA KEV
- Not listed
- Affected
- microsoft/xml core services
- Source
- cve@mitre.org
References
- http://blogs.securiteam.com/?p=717
- http://secunia.com/advisories/22687Vendor Advisory
- http://securitytracker.com/id?1017157
- http://www.iss.net/threats/239.html
- http://www.kb.cert.org/vuls/id/585137US Government Resource
- http://www.microsoft.com/technet/security/advisory/927892.mspx
- http://www.securityfocus.com/bid/20915Exploit
- http://www.us-cert.gov/cas/techalerts/TA06-318A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2006/4334
- http://xforce.iss.net/xforce/alerts/id/239Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-071
- https://exchange.xforce.ibmcloud.com/vulnerabilities/30004
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A104
- https://www.exploit-db.com/exploits/2743
- http://blogs.securiteam.com/?p=717
- http://secunia.com/advisories/22687Vendor Advisory
- http://securitytracker.com/id?1017157
- http://www.iss.net/threats/239.html
- http://www.kb.cert.org/vuls/id/585137US Government Resource
- http://www.microsoft.com/technet/security/advisory/927892.mspx
- http://www.securityfocus.com/bid/20915Exploit
- http://www.us-cert.gov/cas/techalerts/TA06-318A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2006/4334
- http://xforce.iss.net/xforce/alerts/id/239Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-071
- https://exchange.xforce.ibmcloud.com/vulnerabilities/30004
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A104
- https://www.exploit-db.com/exploits/2743
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.