Microsoft Internet Explorer Archives

Winsage

October 7, 2025

U.S. CISA adds Oracle, Mozilla, Microsoft Windows, Linux Kernel, and Microsoft IE flaws to its Known Exploited Vulnerabilities catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) catalog, adding critical flaws from Oracle, Mozilla, Microsoft Windows, and the Linux Kernel. The newly added vulnerabilities include: - CVE-2010-3765: Mozilla Multiple Products Remote Code Execution Vulnerability - CVE-2010-3962: Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability - CVE-2011-3402: Microsoft Windows Remote Code Execution Vulnerability - CVE-2013-3918: Microsoft Windows Out-of-Bounds Write Vulnerability - CVE-2021-22555: Linux Kernel Heap Out-of-Bounds Write Vulnerability - CVE-2021-43226: Microsoft Windows Privilege Escalation Vulnerability - CVE-2025-61882: Oracle E-Business Suite Unspecified Vulnerability CVE-2025-61882 has a CVSS score of 9.8 and allows unauthenticated remote attackers to control the Oracle Concurrent Processing component, affecting versions 12.2.3 to 12.2.14 of the Oracle E-Business Suite. It was exploited by the Cl0p ransomware group, and Oracle has released an emergency patch. CVE-2013-3918 was previously used in the 2009 Aurora attack and later by the EQUATION group against government entities in Afghanistan. Federal agencies must address these vulnerabilities by October 27, 2025, as per Binding Operational Directive (BOD) 22-01, which also recommends private organizations review the KEV catalog.

Winsage

July 23, 2024

Windows users targeted with zero-day attacks via Internet Explorer

- CVE-2024-38112 is a vulnerability in the Microsoft MSHTML platform, allowing for a spoofing attack using malicious MHTML files. - The vulnerability was addressed in the July 2024 Patch Tuesday release, but remains significant due to delayed updates, legacy systems, and evolving attack techniques. - The Void Banshee group has been actively exploiting this vulnerability to distribute the Atlantida info-stealer, emphasizing the importance of timely security updates and patch management.

Winsage

July 10, 2024

Resurrecting Internet Explorer — the nasty threat impacting potentially millions of Windows 10 and 11 users

Check Point Research has identified a critical zero-day spoofing attack targeting Microsoft Internet Explorer on modern Windows 10/11 systems. The vulnerability, known as CVE-2024-38112, allows attackers to remotely execute code by tricking users into opening malicious Internet Shortcut (.url) files.