Published: 07/02/2015 Updated: 12/10/2018

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 allows remote malicious users to bypass the Same Origin Policy and inject arbitrary web script or HTML via vectors involving an IFRAME element that triggers a redirect, a second IFRAME element that does not trigger a redirect, and an eval of a WindowProxy object, aka "Universal XSS (UXSS)."

Vulnerable Product	Search on Vulmon	Subscribe to Product
microsoft internet explorer 9
microsoft internet explorer 10
microsoft internet explorer 11

Proof of concept demonstration code for the universal cross site scripting vulnerability that affects Microsoft Internet Explorer as defined in CVE-2015-0072 ...

Universal xss PoC with multiple target sites (CVE-2015-0072)

Universal Cross Site Scripting PoC This is a PoC for CVE-2015-0072 for sequentialy get the targeted websites cookies Disclaimer This Proof of Concept is for educational purpose only Please do not use it against any system without prior permission You are responsible for yourself for what you do with this code Improvement In order for the exploit to work, the javascript inje

CWE-79 http://www.pcworld.com/article/2879372/dangerous-ie-vulnerability-opens-door-to-powerful-phishing-attacks.html https://nakedsecurity.sophos.com/2015/02/04/internet-explorer-has-a-cross-site-scripting-zero-day-bug/http://community.websense.com/blogs/securitylabs/archive/2015/02/05/another-day-another-zero-day-internet-explorer-s-turn-cve-2015-0072.aspx http://seclists.org/fulldisclosure/2015/Feb/0 http://innerht.ml/blog/ie-uxss.html http://www.securityfocus.com/bid/72489 http://packetstormsecurity.com/files/130308/Microsoft-Internet-Explorer-Universal-XSS-Proof-Of-Concept.html http://secunia.com/advisories/62658 http://www.securitytracker.com/id/1031888 https://exchange.xforce.ibmcloud.com/vulnerabilities/100606 http://www.securityfocus.com/archive/1/534662/100/0/threaded https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-018 https://nvd.nist.gov https://github.com/dbellavista/uxss-poc https://packetstormsecurity.com/files/130308/Microsoft-Internet-Explorer-Universal-XSS-Proof-Of-Concept.html

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2015-0072

Vulnerability Summary

Vulnerability Trend

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect