CVE-2004-0380

The MHTML protocol handler in Microsoft Outlook Express 5.5 SP2 through Outlook Express 6 SP1 allows remote attackers to bypass domain restrictions and execute arbitrary code, as demonstrated on Internet Explorer using script in a compiled help (CHM) file that references the InfoTech Storage (ITS) protocol handlers such as (1) ms-its, (2) ms-itss, (3) its, or (4) mk:@MSITStore, aka the "MHTML URL Processing Vulnerability."

• http://secunia.com/advisories/10523
• http://www.k-otik.net/bugtraq/02.18.InternetExplorer.php
• http://www.kb.cert.org/vuls/id/323070US Government Resource
• http://www.securityfocus.com/archive/1/354447Patch, Vendor Advisory
• http://www.securityfocus.com/archive/1/358913Exploit, Patch, Vendor Advisory
• http://www.securityfocus.com/bid/9105
• http://www.securityfocus.com/bid/9658
• http://www.us-cert.gov/cas/techalerts/TA04-104A.htmlUS Government Resource
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-013
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15705
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1010
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1028
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A882
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A990
• http://secunia.com/advisories/10523
• http://www.k-otik.net/bugtraq/02.18.InternetExplorer.php
• http://www.kb.cert.org/vuls/id/323070US Government Resource
• http://www.securityfocus.com/archive/1/354447Patch, Vendor Advisory
• http://www.securityfocus.com/archive/1/358913Exploit, Patch, Vendor Advisory
• http://www.securityfocus.com/bid/9105
• http://www.securityfocus.com/bid/9658
• http://www.us-cert.gov/cas/techalerts/TA04-104A.htmlUS Government Resource
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-013
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15705
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1010
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1028
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A882
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A990

Published

May 4, 2004

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2004-0374Interchange before 5.0.1 allows remote attackers to "expose …
• CVE-2004-0375SYMNDIS.SYS in Symantec Norton Internet Security 2003 and 20…
• CVE-2004-0376oftpd 0.3.6 and earlier allows remote attackers to cause a d…
• CVE-2004-0377Buffer overflow in the win32_stat function for (1) ActiveSta…
• CVE-2004-0378Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2004-0379Multiple cross-site scripting (XSS) vulnerabilities in Micro…
• CVE-2004-0381mysqlbug in MySQL allows local users to overwrite arbitrary …
• CVE-2004-0382Unknown vulnerability in the CUPS printing system in Mac OS …
• CVE-2004-0383Unknown vulnerability in Mail for Mac OS X 10.3.3 and 10.2.8…
• CVE-2004-0385Heap-based buffer overflow in Oracle 9i Application Server W…
• CVE-2004-0386Buffer overflow in the HTTP parser for MPlayer 1.0pre3 and e…
• CVE-2004-0387Stack-based buffer overflow in the RT3 plugin, as used in Re…