5641 matches found
X360 VideoPlayer ActiveX Control Buffer Overflow
This module exploits a buffer overflow in the VideoPlayer.ocx ActiveX installed with the X360 Software. By setting an overly long value to 'ConvertFile', an attacker can overrun a .data buffer to bypass ASLR/DEP and finally execute arbitrary code. Module Options msf use...
Samsung SmartViewer CNC_Ctrl ActiveX Control Buffer Overflow (CVE-2012-4333; CVE-2014-9265)
A stack buffer overflow vulnerability exists in Samsung SmartViewer. The vulnerability is due to improper validation of a parameter provided to the BackupToAvi method of the CNCCtrl ActiveX Control. A remote, unauthenticated attacker can exploit this vulnerability by enticing the target user to...
Lorex LH300 Series - ActiveX Buffer Overflow (PoC)
Lorex LH300 Series - ActiveX Buffer Overflow PoC Disclosure: 09/01/2014 / Last updated: 18/01/2015 Hi, I have discovered a buffer overflow vulnerability that allows remote code execution in an ActiveX control bundled by a manufacturer of video surveillance systems. The company is Lorex...
Lorex LH300 Series - ActiveX Buffer Overflow (PoC)
Disclosure: 09/01/2014 / Last updated: 18/01/2015 Hi, I have discovered a buffer overflow vulnerability that allows remote code execution in an ActiveX control bundled by a manufacturer of video surveillance systems. The company is Lorex Technologies, a major video surveillance manufacturer that ...
CVE-2014-10011
Stack-based buffer overflow in UltraCamLib in the UltraCam ActiveX Control UltraCamX.ocx for the TRENDnet SecurView camera TV-IP422WN allows remote attackers to execute arbitrary code via a long string to the 1 CGIParamSet, 2 OpenFileDlg, 3 SnapFileName, 4 Password, 5 SetCGIAPNAME, 6 AccountCode,...
CVE-2014-10011
Stack-based buffer overflow in UltraCamLib in the UltraCam ActiveX Control UltraCamX.ocx for the TRENDnet SecurView camera TV-IP422WN allows remote attackers to execute arbitrary code via a long string to the 1 CGIParamSet, 2 OpenFileDlg, 3 SnapFileName, 4 Password, 5 SetCGIAPNAME, 6 AccountCode,...
CVE-2014-10011
CVE-2014-10011 describes a stack-based buffer overflow in the UltraCamLib inside the UltraCam ActiveX Control (UltraCamX.ocx) used by TRENDnet SecurView camera TV-IP422WN/TV-IP422W. The overflow occurs when processing large input to multiple functions (CGI_ParamSet, OpenFileDlg, SnapFileName, Pas...
Type confusion
The RACInstaller.StateCtrl.1 ActiveX control in InstallerDlg.dll in RealNetworks GameHouse RealArcade Installer 2.6.0.481 performs unexpected type conversions for invalid parameter types, which allows remote attackers to execute arbitrary code or cause a denial of service use-after-free via craft...
CVE-2013-2603
The RACInstaller.StateCtrl.1 ActiveX control in InstallerDlg.dll in RealNetworks GameHouse RealArcade Installer 2.6.0.481 performs unexpected type conversions for invalid parameter types, which allows remote attackers to execute arbitrary code or cause a denial of service use-after-free via craft...
Schneider Electric ProClima ATX45 SetBodyAttribute Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Schneider Electric ProClima. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
Schneider Electric ProClima ATX45 SetHtmlFileName Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Schneider Electric ProClima. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
Schneider Electric ProClima MetaDraw ObjLinks Property Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Schneider Electric ProClima. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
Schneider Electric ProClima MetaDraw ObjectOverlappedBy Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Schneider Electric ProClima. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
CVE-2011-5295
Buffer overflow in the Download method in a certain ActiveX control in MDIEEx.dll in Gogago YouTube Video Converter 1.1.6 allows remote attackers to execute arbitrary code via a long argument...
CVE-2011-5294
The SaveMessage method in the LEADeMail.LEADSmtp.20 ActiveX control in LTCML14n.dll 14.0.0.34 in Kofax e-Transactions Sender Sendbox 2.5.0.933 allows remote attackers to write to arbitrary files via a pathname in the first argument...
Code injection
The SaveMessage method in the LEADeMail.LEADSmtp.20 ActiveX control in LTCML14n.dll 14.0.0.34 in Kofax e-Transactions Sender Sendbox 2.5.0.933 allows remote attackers to write to arbitrary files via a pathname in the first argument...
Buffer overflow
Buffer overflow in the Download method in a certain ActiveX control in MDIEEx.dll in Gogago YouTube Video Converter 1.1.6 allows remote attackers to execute arbitrary code via a long argument...
CVE-2011-5295
Buffer overflow in the Download method in a certain ActiveX control in MDIEEx.dll in Gogago YouTube Video Converter 1.1.6 allows remote attackers to execute arbitrary code via a long argument...
CVE-2011-5294
The SaveMessage method in the LEADeMail.LEADSmtp.20 ActiveX control in LTCML14n.dll 14.0.0.34 in Kofax e-Transactions Sender Sendbox 2.5.0.933 allows remote attackers to write to arbitrary files via a pathname in the first argument...
CVE-2011-5291
The SaveData method in the Cygnicon.ViewControl.1 ActiveX control in CyViewer.ocx in Ashampoo 3D CAD Professional 3.x before 3.0.2 allows remote attackers to write to arbitrary files via a pathname in the first argument...