PT-2014-4656

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to 7.2 Description The issue allows remote attackers to read arbitrary files via a crafted call to the BrowseFolder method in the bwocxrun ActiveX control. Recommendations For versions prior to 7.2, update to...

Advantech WebAccess webdact.ocx NodeName Stack Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Advantech WebAccess dvs.ocx GetColor Buffer Overflow

This module exploits a buffer overflow vulnerability in Advantec WebAccess. The vulnerability exists in the dvs.ocx ActiveX control, where a dangerous call to sprintf can be reached with user controlled data through the GetColor function. This module has been tested successfully on Windows XP SP3...

Advantech WebAccess SCADA webvact.ocx GotoCmd Buffer Overflow (CVE-2014-0765)

A stack buffer overflow has been reported in Advantech's WebAccess SCADA software. This vulnerability is due to insufficient input validation on the GotoCmd parameter of the webvact.ocx ActiveX control, a part of the WebAccess Client. A remote, unauthenticated attacker could exploit this...

Telecom Italia DownloaderActiveX.ocx ActiveX Control Code Execution (CVE-2008-2551)

An attacker may use the vulnerable ActiveX control in order to download and execute arbitrary files in the context of the currently logged-on user...

Oracle Data Quality PostcardPreviewInt onclose Untrusted Pointer Dereference (CVE-2014-2415)

A remote code execution vulnerability exists in Oracle Data Profiling and Data Quality for Data Integrator. The vulnerability is due to dereferencing an arbitrary pointer within the TSS12.TransformerTools.PostcardPreviewInt ActiveX control. A remote attacker can exploit this vulnerability by...

Oracle Data Quality FileChooserDlg onChangeDirectory Untrusted Pointer Dereference (CVE-2014-2418)

A remote code execution vulnerability exists in Oracle Data Profiling and Data Quality for Data Integrator. The vulnerability is due to dereferencing an arbitrary pointer within the TSS12.DscTools.FileChooserDlg ActiveX control. A remote attacker can exploit this vulnerability by enticing a user ...

PT-2014-4981

Name of the Vulnerable Software and Affected Versions AVG Secure Search toolbar versions prior to 18.1.7.598 AVG Safeguard versions prior to 18.1.7.644 Description The issue concerns the ScriptHelperApi in the AVG ScriptHelper ActiveX control, which does not implement domain-based access control...

CVE-2014-0602

Directory traversal vulnerability in the DumpToFile method in the NQMcsVarSet ActiveX control in NetIQ Security Manager through 6.5.4 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-3460...

CVE-2014-0602

Directory traversal vulnerability in the DumpToFile method in the NQMcsVarSet ActiveX control in NetIQ Security Manager through 6.5.4 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-3460...

CVE-2014-0602

CVE-2014-0602 is a directory traversal vulnerability in the DumpToFile method of the NQMcsVarSet ActiveX control in NetIQ Security Manager up to version 6.5.4, allowing remote attackers to realize arbitrary code execution via crafted paths. Related entries (CVE-2014-3460) describe the same access...

PT-2014-3701

Name of the Vulnerable Software and Affected Versions NetIQ Security Manager versions prior to 6.5.5 Description A directory traversal issue exists in the DumpToFile method of the NQMcsVarSet ActiveX control. This allows remote attackers to execute arbitrary code. Recommendations For versions pri...

AVG Safeguard and Secure Search ActiveX controls provides insecure methods

Overview The AVG Secure Search toolbar, also known as AVG Safeguard includes an ActiveX control that provides a number of unsafe methods, which may allow a remote, unauthenticated attacker to execute arbitrary code with the privileges of the user. Description AVG Secure Search is a toolbar add-on...

Quest vWorkspace 7.5 Connection Broker Client ActiveX Control (pnllmcli.dll 7.5.304.547) SaveMiniLaunchFile() Method Remote File Creation / Overwrite PoC

No description provided by source. !-- Quest vWorkspace 7.5 Connection Broker Client ActiveX Control pnllmcli.dll 7.5.304.547 SaveMiniLaunchFile Method Remote File Creation / Overwrite ie7/8 vendor site: http://www.quest.com/ file tested: QuestvWorkspace-75--32-bit75.zip Binary Path:...

Quest InTrust 10.4.x ReportTree and SimpleTree Classes

No description provided by source. Quest InTrust 10.4.x ReportTree and SimpleTree Classes ArDoc.dll ActiveX Control Remote File Creation / Overwrite homepage: http://www.quest.com/intrust/ description: InTrust securely collects, stores, reports and alerts on event log data from Windows, Unix and...

Microsoft Internet Explorer 6.0 TSUserEX.DLL ActiveX Control Memory Corruption Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/19570/info Microsoft Internet Explorer is prone to a memory-corruption vulnerability. This is related to the handling of the 'tsuserex.dll' COM object ActiveX control. Attackers may exploit this issue via a malicious web...

HP Instant Support ActiveX Control Driver Check Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/24730/info HP Instant Support ActiveX control is prone to a remote buffer-overflow vulnerability because it fails to adequately bounds-check user-supplied input before copying it to an insufficiently sized memory buffer...

Grokster 1.3/2.6,KaZaA Media Desktop 1.3.x/1.6.1/2.0.x ActiveX Control Remote Buffer Overflow

No description provided by source. source: http://www.securityfocus.com/bid/11101/info Altnet is reported prone to a remote buffer overflow vulnerability. This issue presents itself in an ActiveX control installed by the application. Reportedly, a malicious attacker can exploit this issue to...

KingScada kxClientDownload.ocx ActiveX - Remote Code Execution

No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = GoodRanking include Msf::Exploit::Remote::BrowserExploitServer include...

Microsoft Log Sink Class ActiveX Control Arbitrary File Creation Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/12646/info Microsoft Log Sink Class ActiveX control can allow remote attackers to create arbitrary files on an affected computer. A remote attacker can exploit this issue by crafting a malicious Web site that triggers thi...