Microsoft Outlook View Control allows execution of arbitrary code and manipulation of user data

Overview A vulnerability exists in an ActiveX control supplied with Microsoft Outlook 2002 that could allow malicious code on a web page or in an HTML email message to manipulate Outlook data or execute arbitrary code as the user running Outlook. Description Microsoft Outlook 2002 installs an...

MS Office XP - the more money I give to Microsoft, the more vulnerable my Windows computers are

Georgi Guninski security advisory 49, 2001 MS Office XP - the more money I give to Microsoft, the more vulnerable my Windows computers are Systems affected: Win2K + IE 5.5 SP1 fully patched + Office XP. It was reported to work with IE6 beta also. Risk: High Date: 12 July 2001 Legal Notice: This...

Security Bulletin MS01-038

---------------------------------------------------------------------- Title: Outlook View Control Exposes Unsafe Functionality Date: 12 July 2001 Software: Outlook 98, 2000, and 2002 Impact: Run code of attacker's choice via either web page or HTML e-mail. Bulletin: MS01-038 Microsoft encourages...

Vulnerability in IE/Outlook ActiveX control

-----BEGIN PGP SIGNED MESSAGE----- Microsoft alerted me to a new vulnerability discovered by Georgi Guninski and now posted publicly. The vulnerability involves an ActiveX control that is installed by a variety of software, including Office/Outlook XP. The control exposes a method which should no...

Microsoft Outlook 9820002002 - Arbitrary Code Execution

Microsoft Outlook 9820002002 - Arbitrary Code Execution source: https://www.securityfocus.com/bid/3026/info Microsoft Outlook introduces a vulnerability that may allow attackers to execute arbitrary commands on a target system. The vulnerability is due to a new ActiveX control called 'Microsoft...

Microsoft Outlook 9820002002 - Unauthorized Email Access

Microsoft Outlook 9820002002 - Unauthorized Email Access source: https://www.securityfocus.com/bid/3025/info Microsoft Outlook introduces a vulnerability that may allow attackers to access and manipulate user email. The vulnerability is due to a new ActiveX control called 'Microsoft Outlook View...

Microsoft Outlook 98/2000/2002 - Unauthorized Email Access

source: https://www.securityfocus.com/bid/3025/info Microsoft Outlook introduces a vulnerability that may allow attackers to access and manipulate user email. The vulnerability is due to a new ActiveX control called 'Microsoft Outlook View Control'. The flaw is that this control is marked 'safe f...

Microsoft Outlook 98/2000/2002 - Arbitrary Code Execution

source: https://www.securityfocus.com/bid/3026/info Microsoft Outlook introduces a vulnerability that may allow attackers to execute arbitrary commands on a target system. The vulnerability is due to a new ActiveX control called 'Microsoft Outlook View Control'. The flaw is that this control is...

CVE-2001-0148

The WMP ActiveX Control in Windows Media Player 7 allows remote attackers to execute commands in Internet Explorer via javascript URLs, a variant of the "Frame Domain Verification" vulnerability...

CVE-2001-0091

CVE-2001-0091 concerns the ActiveX control used to invoke a scriptlet in Internet Explorer 5.0–5.5. The control renders arbitrary file types instead of HTML, enabling an attacker to read arbitrary files. The vulnerability is characterized as a variant of the Scriptlet Rendering issue. Documented ...

CVE-2001-0091

The ActiveX control for invoking a scriptlet in Internet Explorer 5.0 through 5.5 renders arbitrary file types instead of HTML, which allows an attacker to read arbitrary files, aka a variant of the "Scriptlet Rendering" vulnerability...

CVE-2001-0148

The WMP ActiveX Control in Windows Media Player 7 allows remote attackers to execute commands in Internet Explorer via javascript URLs, a variant of the "Frame Domain Verification" vulnerability...

CVE-2001-0148: Undefined Security Weakness

The WMP ActiveX Control in Windows Media Player 7 allows remote attackers to execute commands in Internet Explorer via javascript URLs, a variant of the "Frame Domain Verification" vulnerability...

CVE-2001-0091: Undefined Security Weakness

The ActiveX control for invoking a scriptlet in Internet Explorer 5.0 through 5.5 renders arbitrary file types instead of HTML, which allows an attacker to read arbitrary files, aka a variant of the "Scriptlet Rendering" vulnerability...

RhinoSoft FTP Voyager FtpTree incorrectly marked "safe for scripting"

Overview FTP Voyager is an FTP client implemented as an ActiveX control. It is incorrectly marked as "safe for scripting" allowing malicious web pages or email messages to upload and download files. Description FTP Voyager is an FTP client implemented as an ActiveX control. An ActiveX control may...

CVE-2001-1103

FTP Voyager ActiveX control before 8.0, when it is marked as safe for scripting the default or if allowed by the IObjectSafety interface, allows remote attackers to execute arbitrary commands...

CVE-2001-0091

The ActiveX control for invoking a scriptlet in Internet Explorer 5.0 through 5.5 renders arbitrary file types instead of HTML, which allows an attacker to read arbitrary files, aka a variant of the "Scriptlet Rendering" vulnerability...

CVE-2000-1034

The CVE relates to a buffer overflow in the Windows 2000 System Monitor ActiveX control (sysmon.ocx). The vulnerability allows remote code execution by crafting a malicious LogFileName value in HTML/scripted content, permitting exploitation by a user who can load the affected page or message. The...

CVE-2000-1034

Buffer overflow in the System Monitor ActiveX control in Windows 2000 allows remote attackers to execute arbitrary commands via a long LogFileName parameter in HTML source code, aka the "ActiveX Parameter Validation" vulnerability...

guninski31.txt

Georgi Guninski security advisory 31, 2001 Windows Media Player 7 and IE vulnerability - executing arbitrary programs Systems affected: Windows Media Player 7 and IE Risk: High Date: 1 January 2001 Legal Notice: This Advisory is Copyright c 2000 Georgi Guninski. You may distribute it unmo dified...