CVE-2013-7331

The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share pathnames, intranet hostnames, and intranet IP addresses by examining error codes, as demonstrated by a res:// URL, and exploited in the wild in February 2014.

• CWE-209
• CWE-209

• http://www.fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.htmlThird Party Advisory
• http://www.kb.cert.org/vuls/id/539289Third Party Advisory, US Government Resource
• http://www.securitytracker.com/id/1030818Third Party Advisory, VDB Entry
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-052Patch, Vendor Advisory
• https://soroush.secproject.com/blog/2013/04/microsoft-xmldom-in-ie-can-divulge-information-of-local-drivenetwork-in-error-messages/Exploit
• http://www.fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.htmlThird Party Advisory
• http://www.kb.cert.org/vuls/id/539289Third Party Advisory, US Government Resource
• http://www.securitytracker.com/id/1030818Third Party Advisory, VDB Entry
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-052Patch, Vendor Advisory
• https://soroush.secproject.com/blog/2013/04/microsoft-xmldom-in-ie-can-divulge-information-of-local-drivenetwork-in-error-messages/Exploit
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-7331US Government Resource

Published

Feb 26, 2014

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-7325An issue exists in uscan in devscripts before 2.13.19, which…8.8
• CVE-2013-7326Cross-site scripting (XSS) vulnerability in vTiger CRM 5.4.0…
• CVE-2013-7327The gdImageCrop function in ext/gd/gd.c in PHP 5.5.x before …
• CVE-2013-7328Multiple integer signedness errors in the gdImageCrop functi…
• CVE-2013-7329The CGI::Application module before 4.50_50 and 4.50_51 for P…
• CVE-2013-7330Jenkins before 1.502 allows remote authenticated users to co…
• CVE-2013-7332The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.…
• CVE-2013-7333A vulnerability in version 0.90 of the Open Floodlight SDN c…7.5
• CVE-2013-7334Cross-site request forgery (CSRF) vulnerability in ImageCMS …
• CVE-2013-7335Open redirect vulnerability in DotNetNuke (DNN) before 6.2.9…
• CVE-2013-7336The qemuMigrationWaitForSpice function in qemu/qemu_migratio…
• CVE-2013-7338Python before 3.3.4 RC1 allows remote attackers to cause a d…