N/A

Microsoft Internet Explorer 6 executes web script from URIs of arbitrary scheme names ending with the "script" character sequence, using the (1) vbscript: handler for scheme names with 7 through 9 characters, and the (2) javascript: handler for scheme names with 10 or more characters, which might allow remote attackers to bypass certain XSS protection schemes. NOTE: other researchers dispute the significance of this issue, stating "this only works when typed in the address bar.

N/A

N/A

Microsoft Internet Explorer安全漏洞

Microsoft Internet Explorer（IE）是美国微软（Microsoft）公司的一款Windows操作系统附带的Web浏览器。 Microsoft Internet Explorer 6 执行任意计划名并以"script"字符序列结尾的URIs中的web脚本，运行(1) vbscript:具有7至9字符的计划名的处理器,以及(2) javascript:具有10或更多字符的计划名的处理器, 这会允许远程攻击者绕过某些XSS保护计划。 注意：其他研究人员质疑此问题的严重性。

N/A

N/A