CVEvulnerability

CVE-2010-0494

4.3 MEDIUM Published 2010-03-31 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2010-03-31
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
Weaknesses
CWE-200

Description

Cross-domain vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 allows user-assisted remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted HTML document in a situation where the client user drags one browser window across another browser window, aka "HTML Element Cross-Domain Vulnerability."

Affected configurations

• microsoft internet explorer 7 • microsoft windows 2003 server • microsoft windows server 2003 • microsoft windows xp • microsoft windows server 2008 • microsoft windows vista • microsoft internet explorer 6 • microsoft internet explorer 8 • microsoft internet explorer 8.0.6001 • microsoft windows 7 • microsoft windows 2000

Related

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References