Concerning the recent Java vulnerability (Should I be disabling Java?), the most common advise seems to be to disable Java plug-ins in the browser.
However, Heise Security suggests that, when it comes to Internet Explorer, this might not be enough:
Tests carried out by our associates at heise Security found that Microsoft's flagship browser was still able to access the Java plugin even after it had been explicitly disabled. Users running IE are therefore advised to uninstall Java completely using the Add or Remove Programs option in Windows' Control Panel.
Is there really a known weakness by which a Java exploit could harm an IE user visiting a malicious website, even if the Java add-ons are disabled?