Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.1
CVE-2014-0266: Windows browsers can be tricked to read data from other sites
CVE-2014-0266 · published 12 years ago
Summary
The XMLHTTP component built into Internet Explorer on Windows 7, 8, 8.1, and Windows RT can be misused to bypass the web page isolation rules that normally keep sites separate. An attacker who gets a user to visit a malicious page could cause the browser to steal information from other trusted sites. Apply the latest Windows updates or patches to close this gap.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| microsoft | windows_7 |
All versions
cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:* |
| microsoft | windows_8 |
All versions
cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:* |
| microsoft | windows_8.1 |
All versions
cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:* |
| microsoft | windows_rt |
All versions
cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:* |
| microsoft | windows_rt_8.1 |
All versions
cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:* |
| microsoft | windows_server_2003 |
All versions
cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:* |
| microsoft | windows_server_2008 |
r2 cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:* |
| microsoft | windows_server_2012 |
r2 cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* |
| microsoft | windows_vista |
All versions
cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:* |
| microsoft | windows_xp |
All versions
cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:*:* |
Original advisory text
The XMLHTTP ActiveX controls in XML Core Services 3.0 in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, ...
The XMLHTTP ActiveX controls in XML Core Services 3.0 in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to bypass the Same Origin Policy via a web page that is visited in Internet Explorer, aka "MSXML Information Disclosure Vulnerability."
References
- http://osvdb.org/103189 Broken Link
- http://secunia.com/advisories/56771 Third Party Advisory
- http://www.securitytracker.com/id/1029746 Third Party Advisory VDB Entry
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-00... Patch Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Severity
7.1
High
Type
CWE-200Information Exposure
Timeline
Published12 Feb 2014
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2014-0266 · NVD
Track software like this
Free during beta