CVE-2020-7874: Download of Code Without Integrity Check

Download of code without integrity check vulnerability in NEXACRO14 Runtime ActiveX control of tobesoft Co., Ltd allows the attacker to cause an arbitrary file download and execution. This vulnerability is due to incomplete validation of file download URL or file extension...

CVE-2020-7873: Download of Code Without Integrity Check

Download of code without integrity check vulnerability in ActiveX control of Younglimwon Co., Ltd allows the attacker to cause a arbitrary file download and execution...

CVE-2021-26608: Missing Support for Integrity Check

An arbitrary file download and execution vulnerability was found in the HShell.dll of handysoft Co., Ltd groupware ActiveX module. This issue is due to missing support for integrity check of download URL or downloaded file hash...

Microsoft: Attackers Exploiting Windows Zero-Day Flaw

Microsoft Corp. warns that attackers are exploiting a previously unknown vulnerability in Windows 10 and many Windows Server versions to seize control over PCs when users open a malicious document or visit a booby-trapped website. There is currently no official patch for the flaw, but Microsoft h...

Microsoft, CISA Urge Mitigations for Zero-Day RCE Flaw in Windows

Both Microsoft and federal cybersecurity officials are urging organizations to use mitigations to combat a zero-day remote control execution RCE vulnerability in Windows that allows attackers to craft malicious Microsoft Office documents. Microsoft has not revealed much about the MSHTML bug,...

[updated] Windows MSHTML zero-day actively exploited, mitigations required

Several researchers have independently reported a 0-day remote code execution vulnerability in MSHTML to Microsoft. The reason it was reported by several researchers probably lies in the fact that a limited number of attacks using this vulnerability have been identified, as per Microsoft’s securi...

New 0-Day Attack Targeting Windows Users With Microsoft Office Documents

Microsoft on Tuesday warned of an actively exploited zero-day flaw impacting Internet Explorer that's being used to hijack vulnerable Windows systems by leveraging weaponized Office documents. Tracked as CVE-2021-40444 CVSS score: 8.8, the remote code execution flaw is rooted in MSHTML aka Triden...

Microsoft MSHTML Remote Code Execution Vulnerability

MSHTML also known as Trident is Microsoft's Internet Explorer browser engine, and while MHTML is primarily used in the deprecated Internet Explorer browser, the component is also used in Office applications to render Word, Excel, or PowerPoint documents in A remote code execution vulnerability...

Microsoft MSHTML Remote Code Execution Vulnerability

Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability by using specially-crafted Microsoft Office documents. An attacker could craft a malicious Active...

The vulnerability of the MSCOMCTL.OCX component in the Microsoft Office software, the Microsoft SQL Server relational database management system, the Microsoft Commerce Server e-commerce software, and the Microsoft Visual FoxPro database development environment allows a perpetrator to execute arbitrary code.

The vulnerability of the MSCOMCTL.OCX component in the Microsoft Office software, the Microsoft SQL Server relational database management system, the Microsoft Commerce Server e-commerce software, and the Microsoft Visual FoxPro database development environment is related to code generation error...

PT-2021-3925

Name of the Vulnerable Software and Affected Versions Microsoft Windows affected versions not specified Description Remote code execution is possible in MSHTML, the browser rendering engine used by Microsoft Internet Explorer and hosted within Microsoft Office documents. The issue stems from...

Microsoft MSHTML.DLL 路径遍历漏洞

MSHTML also known as Trident is Microsoft's Internet Explorer browser engine, and while MHTML is primarily used in the deprecated Internet Explorer browser, the component is also used in Office applications to render Word, Excel, or PowerPoint documents in A remote code execution vulnerability...

COMMAX UMS Client ActiveX Control 1.7.0.2 - (CNC_Ctrl.dll) Heap Buffer Overflow Vulnerability

Exploit Title: COMMAX UMS Client ActiveX Control 1.7.0.2 - 'CNCCtrl.dll' Heap Buffer Overflow Exploit Author: LiquidWorm Vendor Homepage: https://www.commax.com COMMAX UMS Client ActiveX Control 1.7.0.2 CNCCtrl.dll Heap Buffer Overflow Vendor: COMMAX Co., Ltd. Prodcut web page:...

COMMAX WebViewer ActiveX Control 2.1.4.5 - (Commax_WebViewer.ocx) Buffer Overflow Vulnerability

Exploit Title: COMMAX WebViewer ActiveX Control 2.1.4.5 - 'CommaxWebViewer.ocx' Buffer Overflow Exploit Author: LiquidWorm Vendor Homepage: https://www.commax.com COMMAX WebViewer ActiveX Control 2.1.4.5 CommaxWebViewer.ocx Buffer Overflow Vendor: COMMAX Co., Ltd. Prodcut web page:...

COMMAX WebViewer ActiveX Control 2.1.4.5 - 'Commax_WebViewer.ocx' Buffer Overflow

Exploit Title: COMMAX WebViewer ActiveX Control 2.1.4.5 - 'CommaxWebViewer.ocx' Buffer Overflow Date: 02.08.2021 Exploit Author: LiquidWorm Vendor Homepage: https://www.commax.com COMMAX WebViewer ActiveX Control 2.1.4.5 CommaxWebViewer.ocx Buffer Overflow Vendor: COMMAX Co., Ltd. Prodcut web pag...

COMMAX UMS Client ActiveX Control 1.7.0.2 - 'CNC_Ctrl.dll' Heap Buffer Overflow

Exploit Title: COMMAX UMS Client ActiveX Control 1.7.0.2 - 'CNCCtrl.dll' Heap Buffer Overflow Date: 02.08.2021 Exploit Author: LiquidWorm Vendor Homepage: https://www.commax.com COMMAX UMS Client ActiveX Control 1.7.0.2 CNCCtrl.dll Heap Buffer Overflow Vendor: COMMAX Co., Ltd. Prodcut web page:...

VulnCheck KEV: CVE-2008-2551

The DownloaderActiveX Control DownloaderActiveX.ocx in Icona SpA C6 Messenger 1.0.0.1 allows remote attackers to force the download and execution of arbitrary files via a URL in the propDownloadUrl parameter with the propPostDownloadAction parameter set to "run."...

COMMAX UMS Client ActiveX Control 1.7.0.2 Buffer Overflow

COMMAX UMS Client ActiveX Control 1.7.0.2 CNCCtrl.dll Heap Buffer Overflow Vendor: COMMAX Co., Ltd. Prodcut web page: https://www.commax.com Affected version: 1.7.0.2 Summary: COMMAX activex web viewer UMS client 32bit for COMMAX DVR/NVR. Desc: The vulnerability is caused due to a boundary error ...

COMMAX WebViewer ActiveX Control 2.1.4.5 Buffer Overflow

COMMAX WebViewer ActiveX Control 2.1.4.5 CommaxWebViewer.ocx Buffer Overflow Vendor: COMMAX Co., Ltd. Prodcut web page: https://www.commax.com Affected version: 2.1.4.5 Summary: COMMAX activex web viewer client 32bit for COMMAX DVR/NVR. Desc: The vulnerability is caused due to a boundary error in...

COMMAX UMS Client ActiveX Control 1.7.0.2 (CNC_Ctrl.dll) Heap Buffer Overflow

Summary COMMAX activex web viewer client 32bit for COMMAX DVR/NVR. Description The vulnerability is caused due to a boundary error in the processing of user input, which can be exploited to cause a heap based buffer overflow when a user inserts overly long array of string bytes through several...