CVE-2014-1816

Microsoft XML Core Services (aka MSXML) 3.0 and 6.0 does not properly restrict the information transmitted by Internet Explorer during a download action, which…

published June 11, 2014

CVSS

—

EPSS

14%

Percentile

96.6

In the wild

Unconfirmed

What it is

Microsoft XML Core Services (aka MSXML) 3.0 and 6.0 does not properly restrict the information transmitted by Internet Explorer during a download action, which allows remote attackers to discover (1) full pathnames on the client system and (2) local usernames embedded in these pathnames via a crafted web site, aka "MSXML Entity URI Vulnerability."

The record

Technical detail

CVSS: Not scored
CVSS v4.0: Not supplied
EPSS: 0.14355 · 96.6th percentile
Published: 2014-06-11T01:00Z

EPSS history

Timeline

11 JUN 01:00Z
Microsoft XML Core Services (aka MSXML) 3.0 and 6.0 does not properly restrict the information transmitted by Internet Explorer during a download action, which…
cvelistv5