CruiseWorks and Minna De Office vulnerable in access restrictions

Overview CruiseWorks and Minna De Office are groupware. They contain a vulnerability that the user's access restriction is not properly set. Impact An user with a standard privilege who logs into CruiseWorks or Minna De Office could possibly change the system configurations or information...

CVE-2008-2283

IDAutomation allows remote attackers to overwrite arbitrary files via the argument to the 1 SaveBarCode and 2 SaveEnhWMF methods in a the IDAuto.BarCode.1 ActiveX control in IDAutomationLinear6.dll aka IDAutomation Linear BarCode 1.6.0.6, b the IDAuto.Datamatrix.1 ActiveX control in...

Path traversal

Multiple absolute path traversal vulnerabilities in certain ActiveX controls in WatchFire AppScan 7.0 allow remote attackers to create or overwrite arbitrary files via a full pathname in the argument to the 1 CompactSave and 2 SaveSession method in one control, and the 3 saveRecordedExploreToFile...

CVE-2008-2015

CVE-2008-2015 affects WatchFire AppScan 7.0 ActiveX controls. The vulnerability is multiple absolute path traversal via full pathnames passed to the CompactSave, SaveSession, and saveRecordedExploreToFile methods in different controls, enabling remote creation/overwriting of arbitrary files and p...

CVE-2008-2015

Multiple absolute path traversal vulnerabilities in certain ActiveX controls in WatchFire AppScan 7.0 allow remote attackers to create or overwrite arbitrary files via a full pathname in the argument to the 1 CompactSave and 2 SaveSession method in one control, and the 3 saveRecordedExploreToFile...

Internet Explorer ActiveX Control hxvz.dll Memory Corruption (MS08-023; CVE-2008-1086)

A remote code execution vulnerability has been reported in Microsoft Internet Explorer. The flaw is located in the ActiveX Controls of the component hxvz.dll. The vulnerability is due to a memory corruption error in Microsoft Internet Explorer. A remote attacker could exploit this issue by...

CVE-2008-1647

The ChilkatHttp.ChilkatHttp.1 and ChilkatHttp.ChilkatHttpRequest.1 ActiveX controls in ChilkatHttp.dll 2.4.0.0, 2.3.0.0, and earlier in ChilkatHttp ActiveX expose the unsafe SaveLastError method, which allows remote attackers to overwrite arbitrary files. NOTE: some of these details are obtained...

Information disclosure

The ChilkatHttp.ChilkatHttp.1 and ChilkatHttp.ChilkatHttpRequest.1 ActiveX controls in ChilkatHttp.dll 2.4.0.0, 2.3.0.0, and earlier in ChilkatHttp ActiveX expose the unsafe SaveLastError method, which allows remote attackers to overwrite arbitrary files. NOTE: some of these details are obtained...

CVE-2008-1647

The CVE-2008-1647 entry concerns ChilkatHttp.ChilkatHttp.1 and ChilkatHttp.ChilkatHttpRequest.1 ActiveX controls in ChilkatHttp.dll versions 2.4.0.0, 2.3.0.0 and earlier. The vulnerability arises from exposing the unsafe SaveLastError method, which allows remote attackers to overwrite arbitrary f...

CVE-2008-1647

The ChilkatHttp.ChilkatHttp.1 and ChilkatHttp.ChilkatHttpRequest.1 ActiveX controls in ChilkatHttp.dll 2.4.0.0, 2.3.0.0, and earlier in ChilkatHttp ActiveX expose the unsafe SaveLastError method, which allows remote attackers to overwrite arbitrary files. NOTE: some of these details are obtained...

Design/Logic Flaw

The 1 ltmmCaptureCtrl Class, 2 ltmmConvertCtrl Class, and 3 ltmmPlayCtrl Class ActiveX controls ltmm15.dll 15.1.0.17 and earlier in LEADTOOLS Multimedia Toolkit 15 allow attackers to overwrite arbitrary files via the SaveSettingsToFile method...

CVE-2008-1605

The 1 ltmmCaptureCtrl Class, 2 ltmmConvertCtrl Class, and 3 ltmmPlayCtrl Class ActiveX controls ltmm15.dll 15.1.0.17 and earlier in LEADTOOLS Multimedia Toolkit 15 allow attackers to overwrite arbitrary files via the SaveSettingsToFile method...

CVE-2008-1605

CVE-2008-1605 affects LEADTOOLS Multimedia Toolkit 15 ActiveX controls (ltmmCaptureCtrl, ltmmConvertCtrl, ltmmPlayCtrl in ltmm15.dll

CVE-2008-1605

The 1 ltmmCaptureCtrl Class, 2 ltmmConvertCtrl Class, and 3 ltmmPlayCtrl Class ActiveX controls ltmm15.dll 15.1.0.17 and earlier in LEADTOOLS Multimedia Toolkit 15 allow attackers to overwrite arbitrary files via the SaveSettingsToFile method...

Adobe Flash Player may load arbitrary, malformed cross-domain policy files

Overview Adobe Flash Player may load arbitrary, malformed cross-domain policy files. This could allow an attacker to control cross-domain data loading, potentially allowing the attacker to gain access to sensitive information or to manipulate content in other domains. Description Adobe Flash Play...

Buffer overflow

Multiple buffer overflows in Adobe Form Designer 5.0 and Form Client 5.0 allow remote attackers to execute arbitrary code via unknown vectors in the 1 Adobe File Dialog Button FileDlg.dll and the 2 Adobe Copy to Server Object SvrCopy.dll ActiveX controls...

CVE-2007-6253

Multiple buffer overflows in Adobe Form Designer 5.0 and Form Client 5.0 allow remote attackers to execute arbitrary code via unknown vectors in the 1 Adobe File Dialog Button FileDlg.dll and the 2 Adobe Copy to Server Object SvrCopy.dll ActiveX controls...

Microsoft Office Web Components OWC.Spreadsheet.9 ActiveX Control overflow

Added: 03/12/2008 CVE: CVE-2006-4695 BID: 28135 OSVDB: 42711 Background Microsoft Office Web Components OWC are a group of OLE classes implemented as ActiveX controls. Problem A buffer overflow vulnerability in the OWC.Spreadsheet.9 ActiveX control allows command execution when a user loads a web...

CVE-2007-6253

Multiple buffer overflows in Adobe Form Designer 5.0 and Form Client 5.0 allow remote attackers to execute arbitrary code via unknown vectors in the 1 Adobe File Dialog Button FileDlg.dll and the 2 Adobe Copy to Server Object SvrCopy.dll ActiveX controls...

Adobe Form Designer and Advanced Form Client ActiveX controls contain multiple buffer overflows

Overview Adobe Form Designer and Advanced Form Client contain multiple ActiveX buffer overflows, which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description The Adobe Form Designer and Advanced Form Client software provide multiple ActiveX...