AOL ICQ ActiveX DownloadAgent vulnerability

Added: 12/15/2006 CVE: CVE-2006-5650 BID: 20930 OSVDB: 30220 Background America Online AOL ICQ is a widely used program for communicating with other users on the Internet. Problem The ICQPhone.SipxPhoneManager ActiveX control, which is installed with ICQ, includes a function called DownloadAgent...

AOL ICQ ActiveX DownloadAgent vulnerability

Added: 12/15/2006 CVE: CVE-2006-5650 BID: 20930 OSVDB: 30220 Background America Online AOL ICQ is a widely used program for communicating with other users on the Internet. Problem The ICQPhone.SipxPhoneManager ActiveX control, which is installed with ICQ, includes a function called DownloadAgent...

Flash Player HTTP Header CRLF Injection (APSB06-18)

According to its version number, the instance of Flash Player on the remote Windows host contains two ways for a remote attacker to perform arbitrary HTTP requests while controlling most of the HTTP headers. A remote attacker may be able to leverage these issues to conduct cross-site request...

Microsoft Visual Studio WmiScriptUtils.dll跨域脚本漏洞

Microsoft Visual Studio是一套微软公司的开发工具套件系列产品。 Microsoft Visual Studio WMIScriptUtils.WMIObjectBroker2 ActiveX控件处理存在问题，远程攻击者可利用漏洞以应用程序进程权限执行任意指令。 Microsoft WMIScriptUtils.WMIObjectBroker2 ActiveX控件存在安全问题，攻击者可以构建恶意页面，诱使用户访问，导致绕过Internet域安全限制，并实例化其他危险的对象，造成 任意指令执行。 Visual Studio 2005 Standard Edition...

AOL ICQ ActiveX DownloadAgent vulnerability

Added: 12/15/2006 CVE: CVE-2006-5650 BID: 20930 OSVDB: 30220 Background America Online AOL ICQ is a widely used program for communicating with other users on the Internet. Problem The ICQPhone.SipxPhoneManager ActiveX control, which is installed with ICQ, includes a function called DownloadAgent...

CVE-2006-6510

An unspecified ActiveX control in SiteKiosk before 6.5.150 is installed "safe for scripting", which allows local users to bypass security protections and read arbitrary files via certain functions...

Integrity Clientless Security (ICS) Update 3.7.120.0

Check Point Integrity ™ Clientless Security ICS protects your Web site by detecting and disabling spyware processes and allowing you to enforce security policies before a user logs onto your network. Using ICS you can prevent users with potentially harmful software from accessing your Web site, a...

CVE-2006-6510

SiteKiosk pre-6.5.150 contains an unspecified ActiveX control labeled “safe for scripting” that can bypass protections and read arbitrary files via certain functions. This is documented across CVE-2006-6510 sources (NVD), and corroborated by the Nessus entry noting additional locally exploitable ...

CVE-2006-6510

An unspecified ActiveX control in SiteKiosk before 6.5.150 is installed "safe for scripting", which allows local users to bypass security protections and read arbitrary files via certain functions...

Microsoft Visual Studio WMI Object Broker ActiveX code execution

Object can be used to bypass internet zone restrictions...

ZDI-06-047: Microsoft Visual Studio WmiScriptUtils.dll Cross-Zone Scripting Vulnerability

ZDI-06-047: Microsoft Visual Studio WmiScriptUtils.dll Cross-Zone Scripting Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-06-047.html December 12, 2006 -- CVE ID: CVE-2006-4704 -- Affected Vendor: Microsoft -- Affected Products: Visual Studio 2005 Standard Edition Visual Studio 20...

Microsoft Visual Studio “WMI Object Broker”控件代码执行漏洞（MS06-073）

Microsoft Visual Studio是微软公司的开发工具套件系列产品，是一个基本完整的开发工具集，包括了软件整个生命周期中所需要的大部分工具。 Visual Studio的"WMI Object Broker"控件在例程的创建和处理上存在漏洞，远程攻击者可能利用此漏洞在用户机器上执行任意恶意代码。 Visual Studio所捆绑的WMI Object Broker ActiveX控件允许创建系统上已有的ActiveX控件例程。以这种方式创建的ActiveX对象会绕过ActiveX安全限制，如忽略kill bit和safe for...

Microsoft Windows Media Format运行时库远程任意指令执行漏洞（MS06-078）

Microsoft Windows是微软发布的非常流行的操作系统。 Windows的Media Format的运行时库在处理包含畸形内容的ASF及ASX文件时存在漏洞，远程攻击者可能利用此漏洞完全控制用户机器。 如果用户浏览了恶意设置的网站或被诱骗打开了包含恶意内容的电子邮件，远程攻击者可能在用户机器上执行任意指令。 Microsoft Windows Media Player 6.4 Microsoft Windows Media Format 9.5 Series Runtime x64 Edition Microsoft Windows Media Format 7.1 - 9.5...

Microsoft IE多个代码执行及信息泄露漏洞（MS06-073）

Microsoft IE是微软公司开发的极流行的Web浏览器工具。 IE的实现上存在多个内存破坏及信息泄露漏洞，远程攻击者可能利用这些漏洞通过诱使用户打开恶意网页控制用户机器。 具体的漏洞条目如下： CVE-2006-5579 IE在处理脚本错误存在堆破坏问题。 CVE-2006-5581 IE在解析特定的DHTML脚本函数时没能正确创建元素。 CVE-2006-5578 在特定情况下IE处理拖放操作时存在问题，远程攻击者可能利用此漏洞获取Internet临时文件夹里的文件。 CVE-2006-5577...

Microsoft Visual Studio WmiScriptUtils.dll Cross-Zone Scripting Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. Successful exploitation requires that the target user browse to a malicious web page. The specific flaw exists in the Microsoft WMIScriptUtils.WMIObjectBroker2 ActiveX...

IBM eGatherer ActiveX代码执行漏洞

IBM eGatherer ActiveX控件是一款自动检测机器类型，序列号等信息，帮助用户快速获得文件和信息的控件。 IBM eGatherer ActiveX控件不正确处理参数数据，远程攻击者可以利用漏洞进行缓冲区溢出攻击，可能以进程权限执行任意指令。 问题存在于ActiveX控件汇总的RunEgatherer函数中，这个方法接收一个函数，使用特定的文件名作为eGatherer日志输出，通过填充超长的字符传作为参数数据，可导致堆栈溢出，精心构建恶意WEB页，诱使用户访问，可导致以进程权限执行任意指令。 IBM eGatherer ActiveX control...

Microsoft Internet Explorer TSUserEX.DLL ActiveX控件内存破坏漏洞

Microsoft Internet Explorer是一款流行的WEB浏览器。 Microsoft Internet Explorer实例化tsuserex.dll对象存在问题，远程攻击者可以利用漏洞进行内存破坏攻击，可能以进程权限执行任意指令。 当Microsoft Windows 2003上的Microsoft Internet Explorer尝试以ActiveX控件实例化tsuserex.dll Terminal Services COM对象，可能破坏系统内存造成拒绝服务，可能导致任意代码执行。 Microsoft Internet Explorer 6.0 SP1...

AOL CDDBControl ActiveX控件缓冲区溢出漏洞

AOL是一款流行的即时通信软件。 AOL Client Software处理"CDDBControlAOL.CDDBAOLControl" ActiveX控件存在问题，远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。 当"CDDBControlAOL.CDDBAOLControl" ActiveX控件cddbcontrol.dll处理传递个"SetClientInfo"函数方法的"ClientId"参数时缺少正确的边界错误，提交超长字符串可发生基于堆栈的缓冲区溢出，精心构建参数数据可导致以应用程序进程权限执行任意指令。 AOL Client Software 9.0 Securit...

CVE-2006-6442

Stack-based buffer overflow in the SetClientInfo function in the CDDBControlAOL.CDDBAOLControl ActiveX control cddbcontrol.dll, as used in America Online AOL 7.0 4114.563, 8.0 4129.230, and 9.0 Security Edition 4156.910, and possibly other products, allows remote attackers to execute arbitrary co...

CVE-2006-6442

Stack-based buffer overflow in the SetClientInfo function in the CDDBControlAOL.CDDBAOLControl ActiveX control cddbcontrol.dll, as used in America Online AOL 7.0 4114.563, 8.0 4129.230, and 9.0 Security Edition 4156.910, and possibly other products, allows remote attackers to execute arbitrary co...