CVE-2007-1499

Published: Mar 17, 2007Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Microsoft Internet Explorer 7.0 on Windows XP and Vista allows remote attackers to conduct phishing attacks and possibly execute arbitrary code via a res: URI to navcancl.htm with an arbitrary URL as an argument, which displays the URL in the location bar of the "Navigation Canceled" page and injects the script into the "Refresh the page" link, aka Navigation Cancel Page Spoofing Vulnerability."

Affected (1)

Products: Microsoft: Ie

1 product

Configuration A

1 platform

Running on/with	Platform Versions
Microsoft Windows Vista	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microsoft Ie	Version 7.0

Running on/with	Platform Versions
Microsoft Windows Xp	All versions

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (36)

http://aviv.raffon.net/2007/03/14/PhishingUsingIE7LocalResourceVulnerability.aspx

Source: cve@mitre.org

Vendor Advisory

http://news.com.com/2100-1002_3-6167410.html

Source: cve@mitre.org

http://osvdb.org/35352

Source: cve@mitre.org

http://secunia.com/advisories/24535

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/25627

Source: cve@mitre.org

Vendor Advisory

http://securityreason.com/securityalert/2448

Source: cve@mitre.org

http://securitytracker.com/id?1018235

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/462833/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/462939/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/462945/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/471947/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/22966

Source: cve@mitre.org

http://www.us-cert.gov/cas/techalerts/TA07-163A.html

Source: cve@mitre.org

US Government Resource

http://www.vupen.com/english/advisories/2007/0946

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2007/2153

Source: cve@mitre.org

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-033

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/33026

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1715

Source: cve@mitre.org

http://aviv.raffon.net/2007/03/14/PhishingUsingIE7LocalResourceVulnerability.aspx

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://news.com.com/2100-1002_3-6167410.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://osvdb.org/35352

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/24535

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/25627

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://securityreason.com/securityalert/2448

Source: af854a3a-2127-422b-91ae-364da2661108

http://securitytracker.com/id?1018235

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/462833/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/462939/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/462945/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/471947/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/22966

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.us-cert.gov/cas/techalerts/TA07-163A.html

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

http://www.vupen.com/english/advisories/2007/0946

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2007/2153

Source: af854a3a-2127-422b-91ae-364da2661108

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-033

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/33026

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1715

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.