CVE-2010-2193: Improper Input Validation

Multiple unspecified vulnerabilities in the CA 1 PSFormX and 2 WebScan ActiveX controls, as distributed on the CA Global Advisor web site until May 2009, allow remote attackers to execute arbitrary code via unknown vectors...

Disable ActiveX Controls

For a more fine-grained control over what features are allowed in the zone, click the Custom Level button. At this point, you can control the specific security options that apply to the current zone. For example ActiveX can be disabled by selecting Disable for Run ActiveX controls and plug-ins...

Microsoft Visual Basic Remote Code Execution Vulnerability (978213)

This host is missing a critical security update according to Microsoft Bulletin MS10-031. OpenVAS Vulnerability Test $Id: secpodms10-031.nasl 6413 2017-06-23 09:16:58Z cfischer $ Microsoft Visual Basic Remote Code Execution Vulnerability 978213 Authors: Antu Sanadi Copyright: Copyright c 2010...

Microsoft Visual Basic Remote Code Execution Vulnerability (978213)

This host is missing a critical security update according to Microsoft Bulletin MS10-031. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Design/Logic Flaw

The site-locking implementation in the SdcWebSecureBase interface in tgctlcm.dll in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance relies on a list of server domain names to restrict execution of ActiveX controls, which makes it easier for man-in-the-middle attackers to execute...

CVE-2010-0815

VBE6.DLL in Microsoft Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Visual Basic for Applications VBA, and VBA SDK 6.3 through 6.5 does not properly search for ActiveX controls that are embedded in documents, which allows remote attackers to execute arbitrary code via ...

CVE-2010-1911

The CVE affects Consona Live Assistance components (tgctlcm.dll via the SdcWebSecureBase interface). The vulnerability arises from gating ActiveX control execution on a maintained whitelist of server domain names, enabling MITM DNS hijacking to trigger arbitrary code execution. The description do...

Microsoft Patches Worm Holes in Mail Server, Visual Basic for Apps

Microsoft today issued patches for a pair of critical remote code execution vulnerabilities in Windows and Microsoft Office and urged affected users to apply the fixes as soon as possible. The most serious issue, addressed in the MS10-030 bulletin, affects Outlook Express, Windows Mail and Window...

Microsoft Visual Basic VBE6.DLL Stack Memory Corruption (MS10-031; CVE-2010-0815)

Microsoft Visual Basic VBA is a technology for developing client desktop packaged applications and integrating them with existing data and systems. Microsoft Office products include VBA and make use of VBA to perform certain functions. A remote code execution vulnerability has been reported in th...

Microsoft Security Bulletin MS10-031 - Critical Vulnerability in Microsoft Visual Basic for Applications Could Allow Remote Code Execution (978213)

Microsoft Security Bulletin MS10-031 - Critical Vulnerability in Microsoft Visual Basic for Applications Could Allow Remote Code Execution 978213 Published: May 11, 2010 Version: 1.0 General Information Executive Summary This security update resolves a privately reported vulnerability in Microsof...

CVE-2010-1911: Undefined Security Weakness

The site-locking implementation in the SdcWebSecureBase interface in tgctlcm.dll in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance relies on a list of server domain names to restrict execution of ActiveX controls, which makes it easier for man-in-the-middle attackers to execute...

MS10-031: Vulnerability in Microsoft Visual Basic for Applications Could Allow Remote Code Execution (978213)

A stack memory corruption vulnerability exists in the way that the installed version of Visual Basic for Applications VBA searches for ActiveX controls embedded in documents. If an attacker can trick a user on the affected system into opening a specially crafted document that supports VBA, this...

VulnCheck KEV: CVE-2007-2987

Multiple buffer overflows in certain ActiveX controls in sasatl.dll in Zenturi ProgramChecker allow remote attackers to execute arbitrary code via unspecified vectors, possibly involving the 1 DebugMsgLog or 2 DoFileProperties methods...

Update Protection against IBM Lotus Domino Web Access ActiveX Controls Buffer Overflow

A vulnerability has been reported in IBM Lotus Domino, a Web browser-based client platform that provides functionality similar to that of IBM Lotus Notes. The vulnerability is due to a boundary error while handling malformed data passed to the iNotes Web Access ActiveX controls. A remote attacker...

IBM Lotus Domino Web Access ActiveX Controls Buffer Overflow (CVE-2007-4474)

IBM Lotus Domino Web Access is a Web browser-based client platform that provides functionality similar to that of IBM Lotus Notes. With Lotus Domino Web Access, the user can send encrypted rich text e-mails, schedule meetings, manage tasks, collaborate with colleagues and so on. There exists a...

Google Researcher Ships Exploit to Defeat ASLR+DEP

A prominent security researcher has released an exploit that uses a new technique to defeat ALSR + DEP on Microsoft’s Windows operating system. The exploit, released by Google security researcher “SkyLined,” uses the ret-into-libc technique to bypass DEP Data Execution Prevention and launch code...

Internet Explorer Install Engine Buffer Overflow (CVE-2004-0216)

Microsoft Internet Explorer is a popular web browser bundled with the Microsoft Windows operating system. The browser is capable of communicating with HTTP and HTTPS compliant servers. The browser also has the capability to launch locally-installed libraries, or ActiveX controls, embedded in web...

Microsoft Internet Explorer HTML object memory corruption vulnerability

Overview An invalid pointer reference within Microsoft Internet Explorer may lead to execution of arbitrary code. Description Microsoft Internet Explorer contains a memory corruption vulnerability, which can result in an invalid pointer being accessed after an object is incorrectly initialized or...

Novell iPrint Client ActiveX Control Multiple Buffer Overflows (CVE-2008-2431)

Novell iPrint Client is an application that allows users to install and manage printers, or submit print job from a web browser. Novell iPrint Client is bundled with a set of ActiveX controls that implement various functions. There exist multiple buffer overflow vulnerabilities in Novell iPrint...

Special ActiveX repurposing attacks tips and techniques-vulnerability warning-the black bar safety net

Copyright c 2 0 0 9 Czy Invicta Hack01@Live! cn All rights reserved. == 0x00 Foreword In this article, I am not against ActiveX controls the basic attack scenarios will be discussed. I'm here to be discussed is the use of a lot of interesting tricks and techniques to the development and utilizati...