CVE-2015-0072

Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy and inject…

published February 7, 2015

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.4th percentile for exploit probability.

CVSS
—
EPSS
72%
Percentile
99.4
In the wild
Unconfirmed
What it is

Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy and inject arbitrary web script or HTML via vectors involving an IFRAME element that triggers a redirect, a second IFRAME element that does not trigger a redirect, and an eval of a WindowProxy object, aka "Universal XSS (UXSS)."

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.71698 · 99.4th percentile
Published
2015-02-07T18:00Z
EPSS history
Timeline
  • 07 FEB 18:00Z
    Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy and inject…
    cvelistv5