CVE-2008-4699

Insecure method vulnerability in the ActiveX control PAWWeb11.ocx in Peachtree Accounting 2004 allows remote attackers to execute arbitrary programs via the ExecutePreferredApplication method...

CVE-2008-4699: Undefined Security Weakness

Insecure method vulnerability in the ActiveX control PAWWeb11.ocx in Peachtree Accounting 2004 allows remote attackers to execute arbitrary programs via the ExecutePreferredApplication method...

CVE-2008-0581

Geert Moernaut LSrunasE allows local users to gain privileges by obtaining the encrypted password from a batch file, and constructing a modified batch file that specifies this password in the /password switch and specifies an arbitrary program in the /command switch...

CVE-2008-0581

Geert Moernaut LSrunasE allows local users to gain privileges by obtaining the encrypted password from a batch file, and constructing a modified batch file that specifies this password in the /password switch and specifies an arbitrary program in the /command switch...

HP Info Center ActiveX Control Multiple Remote Vulnerabilities

The remote host contains the HP Quick Launch Button software, part of the HP Info Center software installed by default on many HP and Compaq laptop models. The version of this software on the remote host includes an ActiveX control that reportedly contains three insecure methods - 'GetRegValue',...

CVE-2007-6331: Improper Limitation of a Pathname to a Restricted Directory

Absolute path traversal vulnerability in the HPInfoDLL.HPInfo.1 ActiveX control in HPInfoDLL.dll 1.0, as shipped with HP Info Center hpinfocenter.exe 1.0.1.1 in HP Quick Launch Button QLBCTRL.exe, aka QLB 6.3 and earlier allows remote attackers to execute arbitrary programs via the first argument...

PT-2007-6950 · Invensys · Invensys Wonderware Intouch

Name of the Vulnerable Software and Affected Versions: Invensys Wonderware InTouch version 8.0 Description: The issue allows remote authenticated attackers, and possibly anonymous users, to execute arbitrary programs due to insecure permissions set on a NetDDE share. Recommendations: For Invensys...

CVE-2007-6033: Incorrect Permission Assignment for Critical Resource

Invensys Wonderware InTouch 8.0 creates a NetDDE share with insecure permissions Everyone/Full Control, which allows remote authenticated attackers, and possibly anonymous users, to execute arbitrary programs...

CVE-2002-2401: Undefined Security Weakness

NT Virtual DOS Machine NTVDM.EXE in Windows 2000, NT and XP does not verify user execution permissions for 16-bit executable files, which allows local users to bypass the loader and execute arbitrary programs...

CVE-2002-2352: Undefined Security Weakness

The NBActiveX.ocx ActiveX control in NeoBook 4 allows remote attackers to install and execute arbitrary programs...

CVE-2007-4891

CVE-2007-4891 concerns the PDWizard.ocx ActiveX control in Microsoft Visual Studio 6.0. Affected component: PDWizard.ocx (Visual Studio 6.0) with versions 6.0.0.9782 and earlier. Root cause: the PDWizard.ocx ActiveX control exposes dangerous methods (StartProcess, SyncShell, SaveAs, CABDefaultURL...

CVE-2007-0161

The CVE-2007-0161 entry concerns the HP PML Driver HPZ12 (HPZipm12.exe) used in HP all‑in‑one drivers. It states that insecure SERVICE_CHANGE_CONFIG DACL permissions on the driver allow a local user to gain privileges and run arbitrary programs by modifying the binpath, a scenario related to CVE-...

CVE-2007-0161: Undefined Security Weakness

The PML Driver HPZ12 HPZipm12.exe in the HP all-in-one drivers, as used by multiple HP products, uses insecure SERVICECHANGECONFIG DACL permissions, which allows local users to gain privileges and execute arbitrary programs, as demonstrated by modifying the binpath argument, a related issue to...

CVE-2006-6661

Variable overwrite vulnerability in blog.php in PHP-Update 2.7 and earlier allows remote attackers to overwrite arbitrary program variables and execute arbitrary PHP code via multiple vectors that use the extract function, as demonstrated by the 1 f, 2 newmessage, 3 newusername, 4 adminuser, and ...

CVE-2006-6661

Variable overwrite vulnerability in blog.php in PHP-Update 2.7 and earlier allows remote attackers to overwrite arbitrary program variables and execute arbitrary PHP code via multiple vectors that use the extract function, as demonstrated by the 1 f, 2 newmessage, 3 newusername, 4 adminuser, and ...

CVE-2006-1771: Undefined Security Weakness

Directory traversal vulnerability in misc in pbcs.dll in SAXoTECH SAXoPRESS, aka Saxotech Online formerly Publicus allows remote attackers to read arbitrary files and possibly execute arbitrary programs via a .. dot dot in the url parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in vtibin/vtiadm/fpadmdll.dll in Microsoft FrontPage Server Extensions 2002 and SharePoint Team Services allows remote attackers to inject arbitrary web script or HTML, then leverage the attack to execute arbitrary programs or create new accounts, via the 1...

CVE-2006-0015: Undefined Security Weakness

Cross-site scripting XSS vulnerability in vtibin/vtiadm/fpadmdll.dll in Microsoft FrontPage Server Extensions 2002 and SharePoint Team Services allows remote attackers to inject arbitrary web script or HTML, then leverage the attack to execute arbitrary programs or create new accounts, via the 1...

CVE-2006-1485: Undefined Security Weakness

gm-upload.cgi in Greymatter 1.3.1 allows remote authenticated users with upload privileges to execute arbitrary programs by uploading files to locations within the web root. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-0845: Undefined Security Weakness

Leif M. Wright's Blog 3.5 allows remote authenticated users with administrative privileges to execute arbitrary programs, including shell commands, by configuring the sendmail path to a malicious pathname...