Microsoft XMLDOM ActiveX control information disclosure vulnerability

Overview The Microsoft XMLDOM ActiveX control can be used to check for the presence of multiple resources, which can result in unintended information disclosure. Description Microsoft.XMLDOM is an ActiveX control that can run in Internet Explorer without requiring any prompting to the user. This...

MW6 Technologies Aztec ActiveX Control Buffer Overflow (CVE-2013-6040)

A buffer overflow vulnerability exists in MW6 Technologies Aztec ActiveX Control. The vulnerability is due to improperly handled user input in the 'Data' parameter. A remote attacker could exploit the vulnerability via a specially crafted web page...

IBM Lotus Quickr ActiveX Stack Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Lotus Quickr for Domino. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The flaw exists within an ActiveX...

Information disclosure

The XMLHTTP ActiveX controls in XML Core Services 3.0 in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to...

Microsoft XML Core Services信息泄露漏洞(CVE-2014-0266)(MS14-005)

BUGTRAQ ID: 65407 CVECAN ID: CVE-2014-0266 Microsoft XML Core Services MSXML提供了一组服务，使用户可以使用JScript、VBScript和其它微软的开发工具开发基于XML的本机应用程序。 Microsoft XML Core Services在实现上存在安全漏洞，可使攻击者读取用户本地文件系统上的文件或者经过身份验证的Web域内容。当用户查看特制的Web内容时会通过IE触发MSXML，此时攻击者即可以利用此漏洞。 0 Microsoft Windows Windows Server 2012 Microsoft...

KingSCADA/KingGraphic远程代码执行漏洞

CVECAN ID: CVE-2013-2827 KingSCADA系列产品是基于Windows的控制、监督和数据收集应用程序。 KingSCADA、KingGraphic 3.1及之前版本处理 "ProjectURL" 属性时，ActiveX组件内出现错误，成功利用后可导致下载并执行任意代码。 0 kingview KingSCADA = 3.1 kingview KingGraphic = 3.1 厂商补丁： kingview -------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.kingview.com...

IBM Lotus Quickr for Domino ActiveX控件缓冲区溢出漏洞

BUGTRAQ ID: 65191 CVECAN ID: CVE-2013-6748 IBM Lotus Quickr是一款团队协作软件，能够帮助访问人员、信息和完成任务所需的项目材料。 IBM Lotus Quickr for Domino 8.5.1版本中，qp2.cab内的ActiveX控件存在缓冲区溢出漏洞，可使远程攻击者通过特制的HTML文档，利用此漏洞执行任意代码。 0 IBM Lotus Quickr for Domino 8.5.1 厂商补丁： IBM --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

KingScada kxClientDownload.ocx ActiveX Remote Code Execution

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'KingScada kxClientDownload.ocx ActiveX Remote Code Execution', 'Description' = %q This module abuses the kxClientDownload.ocx ActiveX...

KingScada kxClientDownload.ocx ActiveX Remote Code Execution

This Metasploit module abuses the kxClientDownload.ocx ActiveX control distributed with WellingTech KingScada. The ProjectURL property can be abused to download and load arbitrary DLLs from arbitrary locations, leading to arbitrary code execution, because of a dangerous usage of LoadLibrary. Due ...

KingScada - kxClientDownload.ocx ActiveX Remote Code Execution (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'KingScada kxClientDownload.ocx ActiveX Remote Code Execution', 'Description' = %q This module abuses the kxClientDownload.ocx ActiveX...

IBM SPSS SamplePower 3.0.1 < 3.0.1 IF1 ActiveX Control Remote Code Execution

The remote Windows host has a version of IBM SPSS SamplePower 3.0.1 prior to Interim Fix 1. It is, therefore, affected by a remote code execution vulnerability related to a flaw in the 'Vsflex8l.ocx' ActiveX control. C Tenable Network Security, Inc. include"compat.inc"; if description...

Adobe Flash Player Integer Underflow Remote Code Execution

This module exploits a vulnerability found in the ActiveX component of Adobe Flash Player before 12.0.0.43. By supplying a specially crafted swf file it is possible to trigger an integer underflow in several avm2 instructions, which can be turned into remote code execution under the context of th...

WellinTech KingScada KingGraphic kxClientDownload ActiveX Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of WellinTech KingScada KingGraphics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists withi...

Lorex Technologies Edge Series Security DVR ActiveX Buffer Overflow

The remote Windows host has one or more versions of Lorex Technologies' INetViewX ActiveX control installed. The HTTPPORT parameter in these controls is affected by a buffer overflow vulnerability that could allow an attacker to remotely execute arbitrary code if exploited. C Tenable Network...

DaumGame ActiveX Buffer Overflow (CVE-2013-7246)

A buffer overflow vulnerability exists in the DaumGame ActiveX control. A remote attacker can exploit this vulnerability by enticing a user to visit a malicious website. Successful exploitation could allow arbitrary code execution in the context of the target user...

CVE-2013-6724

Unspecified vulnerability in the vsflex8l ActiveX control in IBM SPSS SamplePower 3.0.1 before FP1 IF1 allows remote attackers to execute arbitrary code via a crafted ComboList property value...

Code injection

Unspecified vulnerability in the vsflex8l ActiveX control in IBM SPSS SamplePower 3.0.1 before FP1 IF1 allows remote attackers to execute arbitrary code via a crafted ComboList property value...

CVE-2013-6724

Unspecified vulnerability in the vsflex8l ActiveX control in IBM SPSS SamplePower 3.0.1 before FP1 IF1 allows remote attackers to execute arbitrary code via a crafted ComboList property value...

CVE-2013-6724

CVE-2013-6724 affects IBM SPSS SamplePower for Windows v3.0.1 through FP1; the vulnerability resides in the vsflex8l ActiveX control (VSFlexGrid8.VSFlexGridL) with the ComboList/ColComboList data handling, allowing remote code execution via a crafted value. IBM notes a fix in SamplePower 3.0.1 FP...

CVE-2013-7246

Buffer overflow in the IconCreate method in an ActiveX control in the DaumGame ActiveX plugin 1.1.0.4 and 1.1.0.5 allows remote attackers to execute arbitrary code via a long string, as exploited in the wild in January 2014...