CVE-2014-1816: microsoft xml_core_services
Vulnerability summary
CVE-2014-1816 is a medium (CVSS 4.3) vulnerability in microsoft xml_core_services. EPSS estimates a 14.36% chance of exploitation in the next 30 days, higher than 96.5% of scored vulnerabilities.
Timeline
- 11-06-2014PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Microsoft XML Core Services (aka MSXML) 3.0 and 6.0 does not properly restrict the information transmitted by Internet Explorer during a download action, which allows remote attackers to discover (1) full pathnames on the client system and (2) local usernames embedded in these pathnames via a crafted web site, aka "MSXML Entity URI Vulnerability."
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
14.36%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
0.00 pp
From 14.36% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Microsoft1 product
- xml_core_services3.0 | 6.0
1 vendor · 1 product
References
4 links
docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-033Vendor AdvisoryX Refsource MS- blogs.technet.com/b/srd/archive/2014/06/10/assessing-risk-for-the-june-2014-security-updates.aspxX Refsource CONFIRMVendor Advisory