« Volver al listado

CVE-2015-1686

Estado: ModificadaMedia (4.3)—

The Microsoft (1) VBScript 5.6 through 5.8 and (2) JScript 5.6 through 5.8 engines, as used in Internet Explorer 8 through 11 and other products, allow remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "VBScript and JScript ASLR Bypass."

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Microsoft — Internet ExplorerMicrosoft — Vbscript

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-1686",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-05-13T10:59:17.710",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/74530",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1032282",
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-043",
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-053",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/74530",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1032282",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-043",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-053",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Microsoft (1) VBScript 5.6 through 5.8 and (2) JScript 5.6 through 5.8 engines, as used in Internet Explorer 8 through 11 and other products, allow remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka \"VBScript and JScript ASLR Bypass.\""
    },
    {
      "lang": "es",
      "value": "Los motores Microsoft (1) VBScript 5.6 hasta 5.8 y (2) JScript 5.6 hasta 5.8, utilizados en Internet Explorer 8 hasta 11 y otros productos, permiten a atacantes remotos evadir el mecanismo de protección ASLR a través de un sitio web manipulado, también conocido como 'evasión de ASLR de VBScript y JScript.'"
    }
  ],
  "lastModified": "2026-06-17T00:22:49.293",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A52E757F-9B41-43B4-9D67-3FEDACA71283"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C043EDDD-41BF-4718-BDCF-158BBBDB6360"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D5808661-A082-4CBE-808C-B253972487B4"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D7809F78-8D56-4925-A8F9-4119B973A667"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:vbscript:5.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6D5EF0A1-84C5-472B-9FFA-1D6052CD656B"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:vbscript:5.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0061E11D-9293-401A-BA38-85AD0C4A04E3"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:vbscript:5.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1C94EA55-F0DE-4A45-A020-9F7FE2A3745B"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com"
}