Microsoft Internet Explorer before 10 allows remote attackers to obtain sensitive information about the existence of files and read certain data from files via a UNC share pathname in the SRC attribute of a SCRIPT element as demonstrated by reading a name-value pair from a local file via a \\\\127.0.0.1\\C$\\ sequence.