1718 matches found
Microsoft Windows OLE CVE-2017-0211 Local Privilege Escalation Vulnerability
Description Microsoft Windows is prone to a local privilege-escalation vulnerability. A local attacker can exploit this issue to execute arbitrary code within the context of the application. Technologies Affected Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 Version 16...
Microsoft OLE URL Moniker improperly handles remotely-linked HTA data
Overview Microsoft OLE uses the URL Moniker to open application data based on the server-provided MIME type, which can allow an unauthenticated remote attacker to execute arbitrary code on a vulnerable system. Description Microsoft OLE uses the URL Moniker to processes remotely-linked content in ...
Beware of an Unpatched Microsoft Word 0-Day Flaw being Exploited in the Wild
It's 2017, and opening a simple MS Word file could compromise your system. Security researchers are warning of a new in-the-wild attack that silently installs malware on fully-patched computers by exploiting a serious — and yet unpatched — zero-day vulnerability in all current versions of Microso...
Microsoft Office - OLE Multiple DLL Side Loading Vulnerabilities (MS15-132/MS16-014/MS16-025/MS16-04
Exploit for windows platform in category local exploits require 'zip' require 'base64' require 'msf/core' require 'rex/ole' class MetasploitModule 'Office OLE Multiple DLL Side Loading Vulnerabilities', 'Description' = %q Multiple DLL side loading vulnerabilities were found in various COM...
Arbitrary Code Execution
Overview Affected versions of this package are vulnerable to Arbitrary Code Execution. Type confusion exists in two methods of Ruby's WIN32OLE class, oleinvoke and olequeryinterface. Attacker passing different type of object than this assumed by developers can cause arbitrary code execution...
Type confusion exists in ole_invoke and ole_query_interface methods of Ruby's WIN32OLE class
Type confusion exists in two methods of Ruby's WIN32OLE class, oleinvoke and olequeryinterface. Attacker passing different type of object than this assumed by developers can cause arbitrary code execution...
CVE-2016-7275
Microsoft Office 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016 mishandles library loading, which allows local users to gain privileges via a crafted application, aka "Microsoft Office OLE DLL Side Loading Vulnerability."...
CVE-2016-7275
CVE-2016-7275 affects Microsoft Office on Windows (Office 2010 SP2, 2013 SP1/RT SP1, and 2016). The issue is Office-related DLL loading: it mishandles loading of DLLs, enabling a local attacker to gain privileges via a crafted Office document/application (OLE DLL side loading). Impact is local pr...
[SECURITY] Fedora 24 Update: libgsf-1.14.33-4.fc24
A library for reading and writing structured files e.g. MS OLE and Zip...
[SECURITY] Fedora 25 Update: libgsf-1.14.33-4.fc25
A library for reading and writing structured files e.g. MS OLE and Zip...
InPage Zero Day Used in Attacks Against Banks
A zero-day vulnerability in InPage publishing software used primarily in Urdu, Pashto and Arabic-speaking nations has been publicly exploited in attacks against financial institutions and government agencies in the region. While there are more than 10 million InPage users in Pakistan and India...
Office OLE DLL Hijacking
require 'zip' require 'base64' require 'msf/core' require 'rex/ole' class MetasploitModule 'Office OLE Multiple DLL Side Loading Vulnerabilities', 'Description' = %q Multiple DLL side loading vulnerabilities were found in various COM components. These issues can be exploited by loading various...
From the patch compare to the PoC to reproduce it MS16-0 3 0-vulnerability warning-the black bar safety net
MS16-0 3 0 vulnerability MS16-0 3 0 vulnerabilities Windows OLE remote code execution vulnerability, since OLE does not have the correct validation of user input, causing by the special structure of the file or the program can trigger the vulnerability, causing the user to click on after the remo...
MS16-116: Security Update in OLE Automation for VBScript Scripting Engine (3188724)
The remote Windows host is missing a security update. It is, therefore, affected by a remote code execution vulnerability in the Microsoft OLE Automation mechanism and the VBScript Scripting Engine due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit this...
CVE-2016-3375
The OLE Automation mechanism and VBScript scripting engine in Microsoft Internet Explorer 9 through 11, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allow remote attackers to...
Memory corruption
The OLE Automation mechanism and VBScript scripting engine in Microsoft Internet Explorer 9 through 11, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allow remote attackers to...
CVE-2016-3375
The OLE Automation mechanism and VBScript scripting engine in Microsoft Internet Explorer 9 through 11, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allow remote attackers to...
Microsoft VBScript Scripting Engine OLE Automation Memory Corruption Vulnerability (3188724)
This host is missing a critical security update according to Microsoft Bulletin MS16-116 SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...
Microsoft Fixes 47 Vulnerabilities with September Patch Tuesday
Microsoft patched 47 vulnerabilities as part of 14 security bulletins, seven critical, with its monthly Patch Tuesday updates today. The company is warning users that if left unpatched, 10 of the issues can lead to remote execution. The updates resolve issues in Microsoft Windows, Office, Office...
