Taskpads ActiveX Control incorrectly marked safe-for-scripting

Overview The taskpads ActiveX control included with some resource kit products circa February 1999 was incorrectly marked safe-for-scripting. Description The taskpads ActiveX control included with the Microsoft Windows 98 resource kit, the Microsoft Windows 98 resource kit sampler, and the Back...

Microsoft MSN Messenger Chat Control contains a buffer overflow in "ResDLL" parameter

Overview Microsoft's MSN Chat is an ActiveX control for Microsoft Messenger, an instant messaging client. A buffer overflow exists in the ActiveX control that may permit a remote attacker to execute arbitrary code on the system with the privileges of the current user. Description A buffer overflo...

Microsoft scriptlet.typlib ActiveX object unsafe for scripting from Internet Explorer

Overview The ActiveX control "scriptlet.typlib" is incorrectly marked "safe for scripting" in Internet Explorer IE versions 4.0 and 5.0, when it is actually unsafe for scripting. Description There exists a vulnerability in the default installation of an ActiveX control named "scriptlet.typlib,"...

CVE-2002-0131

ActivePython ActiveX control for Python in the AXScript package, when used in Internet Explorer, does not prevent a script from reading files from the client's filesystem, which allows remote attackers to read arbitrary files via a malicious web page containing Python script...

CVE-2002-0131

ActivePython ActiveX control for Python in the AXScript package, when used in Internet Explorer, does not prevent a script from reading files from the client's filesystem, which allows remote attackers to read arbitrary files via a malicious web page containing Python script...

CVE-2002-0131: Undefined Security Weakness

ActivePython ActiveX control for Python in the AXScript package, when used in Internet Explorer, does not prevent a script from reading files from the client's filesystem, which allows remote attackers to read arbitrary files via a malicious web page containing Python script...

CVE-2001-0538

CVE-2001-0538 describes a vulnerability in the Microsoft Outlook View ActiveX control used by Outlook 2002 and earlier. The flaw allows remote attackers to execute arbitrary code by presenting a malicious HTML email or web page that invokes the control, effectively running code with the caller’s ...

CVE-2001-0538

Microsoft Outlook View ActiveX Control in Microsoft Outlook 2002 and earlier allows remote attackers to execute arbitrary commands via a malicious HTML e-mail message or web page...

CVE-2001-0365

Eudora before 5.1 allows a remote attacker to execute arbitrary code, when the 'Use Microsoft Viewer' and 'allow executables in HTML content' options are enabled, via an HTML email message containing Javascript, with ActiveX controls and malicious code within IMG tags...

CVE-1999-1380

Symantec Norton Utilities 2.0 for Windows 95 marks the TUNEOCX.OCX ActiveX control as safe for scripting, creating an insecure scripting context that allows remote attackers to execute arbitrary commands via the run option through malicious web pages loaded in browsers like Internet Explorer 3.0....

CVE-1999-1380

Symantec Norton Utilities 2.0 for Windows 95 marks the TUNEOCX.OCX ActiveX control as safe for scripting, which allows remote attackers to execute arbitrary commands via the run option through malicious web pages that are accessed by browsers such as Internet Explorer 3.0...

CVE-1999-1380: Undefined Security Weakness

Symantec Norton Utilities 2.0 for Windows 95 marks the TUNEOCX.OCX ActiveX control as safe for scripting, which allows remote attackers to execute arbitrary commands via the run option through malicious web pages that are accessed by browsers such as Internet Explorer 3.0...

CVE-2001-0538: Undefined Security Weakness

Microsoft Outlook View ActiveX Control in Microsoft Outlook 2002 and earlier allows remote attackers to execute arbitrary commands via a malicious HTML e-mail message or web page...

Eyedog ActiveX control incorrectly marked "safe for scripting"

Overview Versions of the Eyedog ActiveX control current circa August, 1999, are incorrectly marked safe for scripting. Description Eyedog is an ActiveX control that was used to perform diagnostic function in Windows. It was marked as safe for scripting, which means that it could be called from...

CVE-1999-1484

The provided documents describe CVE-1999-1484 as a buffer overflow in the MSN Setup BBS 4.71.0.10 ActiveX control (setupbbs.ocx). The vulnerability allows a remote attacker to execute arbitrary commands via the methods vAddNewsServer or bIsNewsServerConfigured. Affected component: MSN Setup BBS A...

CVE-1999-1484

Buffer overflow in MSN Setup BBS 4.71.0.10 ActiveX control setupbbs.ocx allows a remote attacker to execute arbitrary commands via the methods 1 vAddNewsServer or 2 bIsNewsServerConfigured...

CVE-2001-0538

Microsoft Outlook View ActiveX Control in Microsoft Outlook 2002 and earlier allows remote attackers to execute arbitrary commands via a malicious HTML e-mail message or web page...

Microsoft Outlook View Control allows execution of arbitrary code and manipulation of user data

Overview A vulnerability exists in an ActiveX control supplied with Microsoft Outlook 2002 that could allow malicious code on a web page or in an HTML email message to manipulate Outlook data or execute arbitrary code as the user running Outlook. Description Microsoft Outlook 2002 installs an...

Security Bulletin MS01-038

---------------------------------------------------------------------- Title: Outlook View Control Exposes Unsafe Functionality Date: 12 July 2001 Software: Outlook 98, 2000, and 2002 Impact: Run code of attacker's choice via either web page or HTML e-mail. Bulletin: MS01-038 Microsoft encourages...

Vulnerability in IE/Outlook ActiveX control

-----BEGIN PGP SIGNED MESSAGE----- Microsoft alerted me to a new vulnerability discovered by Georgi Guninski and now posted publicly. The vulnerability involves an ActiveX control that is installed by a variety of software, including Office/Outlook XP. The control exposes a method which should no...