CVE-2007-0319

Multiple stack-based buffer overflows in the Motive ActiveEmailTest.EmailData ActiveUtils EmailData ActiveX control in ActiveUtils.dll in Motive Service Activation Manager 5.1 and Self Service Manager 5.1 and earlier allow remote attackers to execute arbitrary code via unspecified vectors...

CVE-2007-2240

The IBM Lenovo Access Support acpRunner ActiveX control, as distributed in acpcontroller.dll before 1.2.8.0 and possibly acpir.dll before 1.0.0.9 Automated Solutions 1.0 before fix pack 1, does not properly validate digital signatures of downloaded software, which makes it easier for remote...

CVE-2007-2240

The CVE-2007-2240 issue affects the IBM/Lenovo Automated Solutions package’s acpRunner ActiveX control (AcpController.dll before 1.2.8.0 and possibly Acpir.dll before 1.0.0.9). The control fails to properly validate digital signatures of downloaded software, enabling remote attackers to spoof dow...

CVE-2007-2929

The CVE-2007-2929 issue affects the IBM/Lenovo Access Support acpRunner ActiveX control, distributed with AcpController.dll prior to version 1.2.8.0 (and possibly acpir.dll prior to 1.0.0.9). The ActiveX control exposes unsafe methods to arbitrary web domains, enabling remote attackers to downloa...

CVE-2007-0319

The CVE-2007-0319 entry concerns Motive Communications’ ActiveUtils EmailData ActiveX control (ActiveEmailTest.EmailData in ActiveUtils.dll) used by Motive Service Activation Manager 5.1 and Self Service Manager 5.1 and earlier. It describes multiple stack-based buffer overflows that could allow ...

Microsoft DirectX Media SDK DXTLIPI.DLL ActiveX缓冲区溢出漏洞

Microsoft DirectX Media SDK是一组底层应用程序编程接口API。 Microsoft DirectX Media SDK DXTLIP.DLL ActiveX控件存在缓冲区溢出，远程攻击者可以利用漏洞以链接此库的应用程序执行任意指令。 问题是DXTLIP.DLL ActiveX控件在处理"SourceUrl"方法时缺少充分的边界检查，提交超长字符串作为参数数据，并诱使用户访问，可导致缓冲区溢出，精心构建提交数据可能以链接此库的应用程序执行任意指令。 Microsoft DirectX Media SDK 6.0 目前没有详细解决方案提供：...

Memory corruption

Unspecified vulnerability in the pdwizard.ocx ActiveX object for Internet Explorer 5.01, 6 SP1, and 7 allows remote attackers to execute arbitrary code via unknown vectors related to Microsoft Visual Basic 6 objects and memory corruption, aka "ActiveX Object Memory Corruption Vulnerability."...

Design/Logic Flaw

The tblinf32.dll aka vstlbinf.dll ActiveX control for Internet Explorer 5.01, 6 SP1, and 7 uses an incorrect IObjectsafety implementation, which allows remote attackers to execute arbitrary code by requesting the HelpString property, involving a crafted DLL file argument to the TypeLibInfoFromFil...

CVE-2007-2216

The tblinf32.dll aka vstlbinf.dll ActiveX control for Internet Explorer 5.01, 6 SP1, and 7 uses an incorrect IObjectsafety implementation, which allows remote attackers to execute arbitrary code by requesting the HelpString property, involving a crafted DLL file argument to the TypeLibInfoFromFil...

CVE-2007-2216

Summary: CVE-2007-2216 affects the tblinf32.dll ActiveX control in Internet Explorer (versions 5.01, 6 SP1, 7). The vulnerability stems from an incorrect IObjectsafety implementation, enabling remote code execution when a user loads a crafted web page. The attack path involves a crafted DLL argum...

CVE-2007-3041

CVE-2007-3041 describes a remote code execution vulnerability in the Internet Explorer ActiveX object pdwizard.ocx (used by IE 5.01, 6 SP1, and 7). The flaw is an unspecified memory corruption issue in the ActiveX control that could be triggered by a specially crafted web page, allowing an attack...

Buffer overflow

Buffer overflow in the Live Picture Corporation DXSurface.LivePicture.FlashPix.1 DirectTransform FlashPix ActiveX control in DXTLIPI.DLL 6.0.2.827, as packaged in Microsoft DirectX Media 6.0 SDK, allows remote attackers to execute arbitrary code via a long SourceUrl property value...

CVE-2007-4336

Buffer overflow in the Live Picture Corporation DXSurface.LivePicture.FlashPix.1 DirectTransform FlashPix ActiveX control in DXTLIPI.DLL 6.0.2.827, as packaged in Microsoft DirectX Media 6.0 SDK, allows remote attackers to execute arbitrary code via a long SourceUrl property value...

CVE-2007-4336

The CVE-2007-4336 entry concerns a buffer overflow in the Live Picture Corporation DXSurface.LivePicture.FlashPix.1 (DirectTransform FlashPix) ActiveX control, packaged in DXTLIPI.DLL version 6.0.2.827 within Microsoft DirectX Media 6.0 SDK. The vulnerability arises from processing a long SourceU...

Motive Communications ActiveUtils EmailData ActiveX control stack buffer overflows

Overview The Motive Communications ActiveUtils EmailData ActiveX control contains multiple stack buffer overflows, which could allow an attacker to execute arbitrary code on a vulnerable system. Description Motive Communications ActiveUtils is a software package used by multiple ISPs to provide...

IBM and Lenovo Access Support acpRunner ActiveX control fails to restrict access to methods

Overview The IBM Lenovo Access Support acpRunner ActiveX control fails to restrict access to its methods, which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description The Access Support software package for IBM and Lenovo systems includes severa...

Microsoft Internet Explorer substringData Heap Overflow Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of various Microsoft software User interaction is required to exploit this vulnerability in that the target must visit a malicious page. The specific flaw exists in the substringData method available ...

IBM and Lenovo Access Support acpRunner ActiveX control format string vulnerability

Overview The IBM Lenovo Access Support acpRunner ActiveX control contains a format string vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description The Access Support software package for IBM and Lenovo systems includes several...

Microsoft XML Core Services XMLDOM substringData() buffer overflow

Overview Microsoft XML Core Services contains an unspecified memory corruption vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Microsoft XML Core Services MSXML allow developers who use JScript, Visual Basic Scripting...

IBM and Lenovo Access Support acpRunner ActiveX control fails to validate digital signatures

Overview The IBM Lenovo Access Support acpRunner ActiveX control fails to validate digital signatures, which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description The Access Support software package for IBM and Lenovo systems includes several...