Roman Shafigullin

The issue allows remote attackers to bypass the httpOnly flag on cookies, potentially obtaining sensitive information. This is due to improper validation of cookie name and value characters.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML. This can be exploited by attackers to execute malicious scripts on the client-side.

The issue allows remote attackers to obtain sensitive information from process memory via a crafted HTML document. An information disclosure vulnerability exists that could allow an attacker to gain access and read Internet Explorer's process memory. An attacker could exploit the vulnerability by constructing a specially crafted webpage that could allow information disclosure if a user viewed the webpage. An attacker who successfully exploited this issue could view content from Internet Explorer's process memory.