Internet Explorer vulnerabilities

Internet Explorer 4.01 allows remote attackers to read arbitrary files by pasting a file name into the file upload control, known as untrusted scripted paste.

Internet Explorer 4.0 allows remote attackers to cause a denial of service (crash) via HTML code that contains a long CLASSID parameter in an OBJECT tag.

Buffer overflow in Internet Explorer 4.0 may lead to unauthorized access to the system.

Use after free in Internet Explorer allows an authorized attacker to elevate privileges locally. The flaw may be exploited to gain higher privileges on the system.

Internet Explorer 5.0 records the username and password for FTP servers in the URL history, which could allow local users to read the information from another user's index.dat or people physically observing another user to read the information from the status bar when the user hovers the mouse over a link.

Internet Explorer 5.0 does not properly reset the username/password cache for Web sites that do not use standard cache controls. This could allow users on the same system to access restricted web sites that were visited by other users.

Internet Explorer 5.0 allows a remote server to read arbitrary files on the client's file system using the Microsoft Scriptlet Component.

The setup wizard for Internet Explorer 5.0 disables the screen saver and the Task Scheduler Service, which may lead to security risks. If a failure occurs during an unattended installation, the system could be exposed to users with physical access.

Internet Explorer 3 records a history of all URLs visited by a user in DAT files located in the Temporary Internet Files and History folders. These files are not cleared when the 'Clear History' option is selected and are not visible when browsing the folders due to tailored displays.