CVE-2007-1499: microsoft ie Cross-site Scripting

EPSS trend

Probability

29.97%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

+0.19 pp

From 29.78% on 18-09-2026

18-09-202618-10-2026

EPSS score

29.97%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

exploit-databaseremotewindowsVerified
Microsoft Internet Explorer 7 - NavCancel.HTM Cross-Site Scripting
Maturity: weaponized

References

18 links

www.securityfocus.com/bid/22966VDB EntryX Refsource BID
securityreason.com/securityalert/2448Third Party AdvisoryX Refsource SREASON
osvdb.org/35352VDB EntryX Refsource OSVDB
www.vupen.com/english/advisories/2007/0946VDB EntryX Refsource VUPEN
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1715VDB EntrySignatureX Refsource OVAL
secunia.com/advisories/25627Third Party AdvisoryX Refsource SECUNIAVendor Advisory
aviv.raffon.net/2007/03/14/PhishingUsingIE7LocalResourceVulnerability.aspxX Refsource MISCVendor Advisory
www.securityfocus.com/archive/1/471947/100/0/threadedVendor AdvisoryX Refsource HP
exchange.xforce.ibmcloud.com/vulnerabilities/33026VDB EntryX Refsource XF
securitytracker.com/id?1018235VDB EntryX Refsource SECTRACK

Show all 18 references

secunia.com/advisories/24535Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.vupen.com/english/advisories/2007/2153VDB EntryX Refsource VUPEN
www.us-cert.gov/cas/techalerts/TA07-163A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource
news.com.com/2100-1002_3-6167410.htmlX Refsource MISC
www.securityfocus.com/archive/1/462939/100/0/threadedMailing ListX Refsource BUGTRAQ
www.securityfocus.com/archive/1/462945/100/0/threadedMailing ListX Refsource BUGTRAQ
docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-033Vendor AdvisoryX Refsource MS
www.securityfocus.com/archive/1/462833/100/0/threadedMailing ListX Refsource BUGTRAQ

Related vulnerabilities

CVE-2003-1559microsoftie+115.80%18y ago14-07-2008 23:00Microsoft Internet Explorer 5.22, and other 5 through 6 SP1 versions, sends Referer headers containing https:// URLs in requests for http:// URLs, which allows remote attackers to obtain potentially sensitive information by reading Referer log data.CVE-2003-0701microsoftie+130.07%23y ago22-08-2003 04:00Buffer overflow in Internet Explorer 6 SP1 for certain languages that support double-byte encodings (e.g., Japanese) allows remote attackers to execute arbitrary code via the Type property of an Object tag, a variant of CVE-2003-0344.CVE-2003-0344microsoftie+181.31%23y ago06-06-2003 04:00Buffer overflow in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to execute arbitrary code via / (slash) characters in the Type property of an Object tag in a web page.CVE-2001-1497microsoftie+12.05%21y ago21-06-2005 04:00Microsoft Internet Explorer 4.0 through 6.0 could allow local users to differentiate between alphanumeric and non-alphanumeric characters used in a password by pressing certain control keys that jump between non-alphanumeric characters, which makes it easier to conduct a brute-force password guessing attack.CVE-2001-0665microsoftie12.09%24y ago09-03-2002 05:00Internet Explorer 6 and earlier allows remote attackers to cause certain HTTP requests to be automatically executed and appear to come from the user, which could allow attackers to gain privileges or execute operations within web-based services, aka the "HTTP Request Encoding vulnerability."CVE-2005-2087microsoftie+161.37%21y ago30-06-2005 04:00Internet Explorer 5.01 SP4 up to 6 on various Windows operating systems, including IE 6.0.2900.2180 on Windows XP, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not ActiveX controls, as demonstrated using the JVIEW Profiler (Javaprxy.dll). NOTE: the researcher says that the vendor could not reproduce this problem.

All vulnerabilities inie

CVE-2007-1499: microsoft ie Cross-site Scripting

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References