CVE-2005-3657

The CVE-2005-3657 issue affects McAfee Security Center’s MCINSCTL.DLL ActiveX control. The McLog object (MCINSTALL.McLog) allows logging, but the control does not restrict which domains may load it because it does not use the IObjectSafetySiteLock API. This enables remote attackers to create or a...

[Full-disclosure] iDefense Security Advisory 12.20.05: McAfee Security Center MCINSCTL.DLL ActiveX Control File Overwrite

McAfee Security Center MCINSCTL.DLL ActiveX Control File Overwrite iDefense Security Advisory 12.20.05 http://www.idefense.com/intelligence/vulnerabilities/display.php?id=358 December 20, 2005 I. BACKGROUND McAfee VirusScan is an anti-virus software. More information is available from the vendor...

AxWebRemoveCtrl ActiveX Control Arbitrary Code Execution

The remote host contains an ActiveX control from SunnComm called AxWebRemoveCtrl. This control was likely installed by requesting an uninstaller for SunnComm's MediaMax digital rights management software used, for example, on select Sony CDs. By design, AxWebRemoveCtrl allows any website to cause...

CVE-2004-2635

An ActiveX control for McAfee Security Installer Control System 4.0.0.81 allows remote attackers to access the Windows registry via web pages that use the control's RegQueryValue method...

CVE-2004-2635: Undefined Security Weakness

An ActiveX control for McAfee Security Installer Control System 4.0.0.81 allows remote attackers to access the Windows registry via web pages that use the control's RegQueryValue method...

CVE-2005-3892

Gadu-Gadu 7.20 allows remote attackers to eavesdrop on a user via a web page that accesses the EasycallLite.oce ActiveX control, which can initiate an outgoing phone call and listen to the microphone...

CVE-2005-3892

Gadu-Gadu 7.20 is affected by CVE-2005-3892 due to an EasycallLite.oce ActiveX control that can be loaded by a web page to initiate an outgoing call and listen to the microphone, allowing remote eavesdropping. Affected product/version: Gadu-Gadu 7.20. Root cause involves the ActiveX control enabl...

CVE-2005-3892: Undefined Security Weakness

Gadu-Gadu 7.20 allows remote attackers to eavesdrop on a user via a web page that accesses the EasycallLite.oce ActiveX control, which can initiate an outgoing phone call and listen to the microphone...

CVE-2005-3693

The AxWebRemoveCtrl ActiveX control for uninstalling the SunnComm MediaMax DRM allows remote attackers to download and execute arbitrary code, a similar vulnerability to CVE-2005-3650...

CVE-2005-3693

CVE-2005-3693 concerns the AxWebRemoveCtrl ActiveX control from SunnComm used for uninstalling MediaMax DRM. The vulnerability enables remote attackers to download and execute arbitrary code via the control from an arbitrary URL when a user visits a malicious site. This is documented as an Active...

CVE-2005-3693

The AxWebRemoveCtrl ActiveX control for uninstalling the SunnComm MediaMax DRM allows remote attackers to download and execute arbitrary code, a similar vulnerability to CVE-2005-3650...

CVE-2005-3650

The CodeSupport.ocx ActiveX control, as used by Sony to uninstall the First4Internet XCP DRM, has "safe for scripting" enabled, which allows remote attackers to execute arbitrary code by calling vulnerable functions such as RebootMachine, IsAdministrator, and ExecuteCode...

CVE-2005-3650

The CVE-2005-3650 entry concerns the CodeSupport.ocx ActiveX control used by Sony to uninstall First4Internet XCP DRM. The vulnerability arises because the control’s “safe for scripting” setting enables remote attackers to call vulnerable methods (e.g., RebootMachine, IsAdministrator, ExecuteCode...

CVE-2005-3650

The CodeSupport.ocx ActiveX control, as used by Sony to uninstall the First4Internet XCP DRM, has "safe for scripting" enabled, which allows remote attackers to execute arbitrary code by calling vulnerable functions such as RebootMachine, IsAdministrator, and ExecuteCode...

CVE-2005-3650: Improper Control of Generation of Code

The CodeSupport.ocx ActiveX control, as used by Sony to uninstall the First4Internet XCP DRM, has "safe for scripting" enabled, which allows remote attackers to execute arbitrary code by calling vulnerable functions such as RebootMachine, IsAdministrator, and ExecuteCode...

First4Internet XCP Uninstallation CodeSupport.ocx ActiveX Control Arbitrary Code Execution

The remote host contains an ActiveX control from First4Internet called CodeSupport. This control was likely installed by requesting an uninstaller for Sony's XCP digital rights management software. CodeSupport is marked as safe for scripting and makes several methods available for any web page to...

First4Internet CodeSupport ActiveX controls incorrectly marked 'safe for scripting'

Overview An ActiveX control used to uninstall XCP Digital Rights Management DRM software made by First 4 Internet and distributed on some Sony BMG audio CDs is marked "Safe for scripting" Description XCP Digital Rights Management DRM software by First 4 Internet, which is distributed by some Sony...

Flaw in Certificate Enrollment Control (Q323172)

A vulnerability in the Certificate Enrollment ActiveX Control in Microsoft Windows 98, Windows 98 Second Edition, Windows Millennium, Windows NT 4.0, Windows 2000, and Windows XP allows remote attackers to delete digital certificates on a user's system via HTML. Impact of vulnerability: Denial of...

Buffer Overflow in Windows Troubleshooter ActiveX Control (826232)

A security vulnerability exists in the Microsoft Local Troubleshooter ActiveX control in Windows 2000. The vulnerability exists because the ActiveX control Tshoot.ocx contains a buffer overflow that could allow an attacker to run code of their choice on a user's system. To exploit this...

Vulnerability in Authenticode Verification Could Allow Remote Code Execution (823182)

There is a vulnerability in Authenticode that, under certain low memory conditions, could allow an ActiveX control to download and install without presenting the user with an approval dialog. To exploit this vulnerability, an attacker could host a malicious Web Site designed to exploit this...