CVE-2006-4704

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 45.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-11-01 · updated 2026-06-16

Description

Cross-zone scripting vulnerability in the WMI Object Broker (WMIScriptUtils.WMIObjectBroker2) ActiveX control (WmiScriptUtils.dll) in Microsoft Visual Studio 2005 allows remote attackers to bypass Internet zone restrictions and execute arbitrary code by instantiating dangerous objects, aka "WMI Object Broker Vulnerability."

Affected products

Microsoft Visual Studio .Net: 2005

References

http://blogs.technet.com/msrc/archive/2006/11/01/microsoft-security-advisory-927709-posted.aspx
http://research.eeye.com/html/alerts/zeroday/20061031.html
http://secunia.com/advisories/22603
http://securitytracker.com/id?1017142
http://www.kb.cert.org/vuls/id/854856
http://www.microsoft.com/technet/security/advisory/927709.mspx
http://www.securityfocus.com/archive/1/454201/100/0/threaded
http://www.securityfocus.com/archive/1/454969/100/200/threaded
http://www.securityfocus.com/bid/20797
http://www.securityfocus.com/bid/20843
http://www.securityfocus.com/data/vulnerabilities/exploits/0day_ie.pdf
http://www.us-cert.gov/cas/techalerts/TA06-346A.html

Get alerted when CVE-2006-4704 or the next vulnerability affects your stack