maxthon vulnerabilities

Products

• maxthon browser 5
• maxthon 3
• maxthon cloud browser 1

Latest maxthon CVEs

Newest publication first

1. CVE-2019-16647 Unquoted Search Path in Maxthon 5.1.0 to 5.2.7 Browser for Windows.

   Published 2019-10-29

   High·CVSS 7.2 EPSS 2.0%

   Unquoted Search Path in Maxthon 5.1.0 to 5.2.7 Browser for Windows.

2. CVE-2014-1449 The Maxthon Cloud Browser application before 4.1.6.2000 for Android allows remote attackers to spoof the address bar via crafted JavaScript code that uses the history API.

   Published 2014-12-25

   Medium·CVSS 5.0 EPSS 1.9%

   The Maxthon Cloud Browser application before 4.1.6.2000 for Android allows remote attackers to spoof the address bar via crafted JavaScript code that uses the history API.

3. CVE-2010-5246 Multiple untrusted search path vulnerabilities in Maxthon Browser 1.6.7.35 and 2.5.15 allow local users to gain privileges via a Trojan horse (1) RSRC32.dll or (2) dwmapi.dll file in the current worki...

   Published 2012-09-07

   Medium·CVSS 6.9 EPSS 0.42%

   Multiple untrusted search path vulnerabilities in Maxthon Browser 1.6.7.35 and 2.5.15 allow local users to gain privileges via a Trojan horse (1) RSRC32.dll or (2) dwmapi.dll file in the current working directory, as demonstrated by a directory that contains a .html file. NOTE: t...

4. CVE-2009-3018 Maxthon Browser 3.0.0.145 Alpha with Ultramode does not properly block javascript: and data: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (X...

   Published 2009-08-31

   Medium·CVSS 4.3 EPSS 1.1%

   Maxthon Browser 3.0.0.145 Alpha with Ultramode does not properly block javascript: and data: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header that contains...

5. CVE-2009-3006 Maxthon Browser 2.5.3.80 UNICODE allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated....

   Published 2009-08-28

   Medium·CVSS 4.3 EPSS 1.0%

   Maxthon Browser 2.5.3.80 UNICODE allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed login fo...

6. CVE-2008-3667 Stack-based buffer overflow in Maxthon Browser 2.0 and earlier allows remote attackers to execute arbitrary code via a long Content-type HTTP header.

   Published 2008-08-13

   Medium·CVSS 6.8 EPSS 6.9% Public exploit

   Stack-based buffer overflow in Maxthon Browser 2.0 and earlier allows remote attackers to execute arbitrary code via a long Content-type HTTP header.

7. CVE-2006-6985 Cross-domain vulnerability in Maxthon 1.5.6 build 42 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the a...

   Published 2007-02-09

   Medium·CVSS 5.0 EPSS 1.2%

   Cross-domain vulnerability in Maxthon 1.5.6 build 42 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references...

8. CVE-2005-1090 Directory traversal vulnerability in the readFile and writeFile API for Maxthon 1.2.0 and 1.2.1 allows remote attackers to read or write arbitrary files.

   Published 2005-04-13

   Medium·CVSS 6.4 EPSS 1.9%

   Directory traversal vulnerability in the readFile and writeFile API for Maxthon 1.2.0 and 1.2.1 allows remote attackers to read or write arbitrary files.

9. CVE-2005-0905 Maxthon 1.2.0 allows remote malicious web sites to obtain potentially sensitive data from the search bar via the m2_search_text property.

   Published 2005-03-29

   Low·CVSS 2.6 EPSS 2.3% Public exploit

   Maxthon 1.2.0 allows remote malicious web sites to obtain potentially sensitive data from the search bar via the m2_search_text property.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.