CVE-2012-3022

TrendLink (Canary Labs) ActiveX control SaveToFile in TrendDisplay.dll is vulnerable in versions up to 9.0.2.27051. The vulnerability allows a remote attacker, via a crafted web site, to create arbitrary files and potentially execute arbitrary code on the client. Public documentation consistently...

CVE-2013-0501

The EdrawSoft EDOFFICE.EDOfficeCtrl.1 ActiveX control, as used in Edraw Office Viewer Component, the client in IBM Cognos Disclosure Management CDM 10.2.0, and other products, allows remote attackers to read arbitrary files, or download an arbitrary program onto a client machine and execute this...

CVE-2013-0501

The CVE-2013-0501 entry involves the EdrawSoft EDOFFICE.EDOfficeCtrl.1 ActiveX control (used by Edraw Office Viewer Component and IBM Cognos Disclosure Management 10.2.0). The vulnerability arises from this ActiveX control permitting a crafted web site to read arbitrary files on a client, or down...

McAfee Virtual Technician McHealthCheck.dll ActiveX Control Save() Method Arbitrary File Overwrite (SB10040)

The remote Windows host has a version of the McAfee Virtual Technician / ePolicy Orchestrator McHealthCheck.dll ActiveX control that allows arbitrary files to be corrupted / overwritten due to a flaw in the Save method. If an attacker can trick a user on the affected host into viewing a specially...

Microsoft Internet Explorer释放后重用远程代码执行漏洞(CVE-2013-1303)（MS13-028）

BUGTRAQ ID: 58850 CVECAN ID: CVE-2013-1303 Microsoft Internet Explorer是微软公司推出的一款网页浏览器。 Microsoft Internet Explorer 6, 7, 8, 9, 10访问内存中已被删除的对象时存在远程执行代码漏洞。攻击者可以在当前用户的上下文中执行任意代码，如果执行失败将会导致拒绝服务。 0 Microsoft Internet Explorer 6 - 10 临时解决方法： 如果您不能立刻安装补丁或者升级，建议您采取以下措施以降低威胁： 将 Internet 和本地 Intranet...

Microsoft Remote Desktop ActiveX控件远程代码执行漏洞(CVE-2013-1296)(MS13-029)

BUGTRAQ ID: 58874 CVECAN ID: CVE-2013-1296 远程桌面协议（RDP, Remote Desktop Protocol）是一个多通道（multi-channel）的协议，让用户（客户端或称“本地电脑”）连上提供微软终端机服务的电脑（服务器端或称“远程电脑”）。 当远程桌面 ActiveX 控件 mstscax.dll 尝试访问内存中已被删除的对象时，存在一个远程执行代码漏洞。攻击者可通过诱使用户访问特制网页来利用该漏洞。成功利用此漏洞的攻击者可以获得与登录用户相同的用户权限。 0 Microsoft Windows XP Microsoft...

Microsoft RDP ActiveX Control Remote Code Execution Vulnerability (2828223)

This host is missing a critical security update according to Microsoft Bulletin MS13-029. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CVE-2013-1296

The Remote Desktop ActiveX control in mstscax.dll in Microsoft Remote Desktop Connection Client 6.1 and 7.0 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code via a web page that triggers access to a deleted object, and allows remote RDP servers to...

CVE-2013-1296

The CVE-2013-1296 issue affects Microsoft Remote Desktop Connection Client (mstscax.dll) ActiveX in versions 6.1 and 7.0. It is a use-after-free memory access vulnerability that allows remote code execution when a user visits a malicious webpage or when handling objects in memory, yielding the sa...

Pwn2Own IE Vulnerabilities Missing from Microsoft Patch Tuesday Updates

UPDATE – In an unexpected turn, Microsoft’s monthly Patch Tuesday security updates released today did not include patches for Internet Explorer vulnerabilities used during the Pwn2Own contest one month ago. The popular hacker contest attracted researchers from all over who were targeting all the...

Microsoft Remote Desktop ActiveX Control CVE-2013-1296 Remote Code Execution Vulnerability

Description The Microsoft Remote Desktop ActiveX control is prone to a remote code-execution vulnerability. An attacker can exploit this issue by enticing an unsuspecting user to view a malicious webpage. Successful exploits will allow the attacker to execute arbitrary code within the context of...

Microsoft Windows RDP ActiveX Control Remote Code Execution (MS13-029; CVE-2013-1296)

A remote code execution vulnerability in the way the Remote Desktop ActiveX control, mstscax.dll, attempts to access an object in memory that has been deleted. An attacker could exploit this vulnerability by convincing the user to visit a specially crafted webpage. An attacker who successfully...

CVE-2013-1079

CVE-2013-1079 relates to a directory traversal vulnerability in the ISCreateObject method of the ISProxy ActiveX object used by Novell ZENworks AdminStudio (ISProxy.dll). The flaw, triggered by a crafted web page that also calls Initialize, can cause the underlying OS to load arbitrary local DLLs...

CVE-2013-1079

Directory traversal vulnerability in the ISCreateObject method in an ActiveX control in InstallShield\ISProxy.dll in AdminStudio in Novell ZENworks Configuration Management ZCM 10.3 through 11.2 allows remote attackers to execute arbitrary local DLL files via a crafted web page that also calls th...

CVE-2012-5879

An ActiveX control in McHealthCheck.dll in McAfee Virtual Technician MVT and ePO-MVT 6.5.0.2101 and earlier allows remote attackers to modify or create arbitrary files via a full pathname argument to the Save method...

Design/Logic Flaw

An ActiveX control in McHealthCheck.dll in McAfee Virtual Technician MVT and ePO-MVT 6.5.0.2101 and earlier allows remote attackers to modify or create arbitrary files via a full pathname argument to the Save method...

CVE-2012-5879

An ActiveX control in McHealthCheck.dll in McAfee Virtual Technician MVT and ePO-MVT 6.5.0.2101 and earlier allows remote attackers to modify or create arbitrary files via a full pathname argument to the Save method...

Honeywell Multiple Products HscRemoteDepoy.dll ActiveX Control Arbitrary Code Execution

Binary data scadahoneywellhscremotedeployactivex.nbin...

CVE-2013-0674

Buffer overflow in the RegReader ActiveX control in Siemens WinCC before 7.2, as used in SIMATIC PCS7 before 8.0 SP1 and other products, allows remote attackers to execute arbitrary code via a long parameter...

Buffer overflow

Buffer overflow in the RegReader ActiveX control in Siemens WinCC before 7.2, as used in SIMATIC PCS7 before 8.0 SP1 and other products, allows remote attackers to execute arbitrary code via a long parameter...