Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Microsoft Browser Information Disclosure Vulnerability."

The version of Microsoft Edge installed on the remote Windows host is missing Cumulative Security Update 3204062. It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities. An unauthenticated, remote attacker can exploit these vulnerabilities by convincing a user to visit a specially crafted website, resulting in the execution of arbitrary code in the context of the current user.

The version of Internet Explorer installed on the remote Windows host is missing Cumulative Security Update 3204059. It is, therefore, affected by multiple vulnerabilities, the most severe of which are remote code execution vulnerabilities. An unauthenticated, remote attacker can exploit these vulnerabilities by convincing a user to visit a specially crafted website, resulting in the execution of arbitrary code in the context of the current user.

ID	Name	Product	Family	Type	Severity
95809	MS16-145: Cumulative Security Update for Microsoft Edge (3204062)	Nessus	Windows : Microsoft Bulletins	Local	high
95764	MS16-144: Cumulative Security Update for Internet Explorer (3204059)	Nessus	Windows : Microsoft Bulletins	Local	high

Detections

Analytics

CVE-2016-7282

medium

Tenable Plugins

high

high