HP AIO Archive Query Server oasoa.exe Stack Buffer Overflow (CVE-2013-6189)

A stack buffer overflow vulnerability exists in HP Application Information Optimizer. The vulnerability is due to insufficient sanitization on the range of the opcode value. A remote unauthenticated attacker can leverage this vulnerability by sending crafted messages to the server...

Microsoft MSDE Long TCP Request Buffer Overflow - Ver2 (CVE-2002-1123)

A buffer overflow vulnerability has been reported in Microsoft MSDE. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Cisco Prime Data Center Network Manager processImageSave.jsp Arbitrary File Upload (CVE-2013-5486)

An arbitrary file upload vulnerability exists in Cisco Prime Data Center Network Manager...

Microsoft Internet Explorer EUC-JP Character Encoding Cross Site Scripting (MS13-059; CVE-2013-3192)

A universal cross site scripting vulnerability exists in Microsoft Internet Explorer...

Microsoft .NET Framework Entity Expansion Denial of Service (MS13-082; CVE-2013-3860)

A denial of service vulnerability exists in the .NET Framework...

Sun Java Web Start Double Quote Injection (CVE-2012-1533)

A remote code execution vulnerability has been in Java Web Start...

Novell ZENworks Configuration Management File Upload (CVE-2013-1080)

A file upload vulnerability has been reported in Novel ZENworks Configuration Management...

Mutiny FrontEnd Arbitrary File Upload (CVE-2013-0136)

A directory traversal vulnerability has been reported in EditDocument servlet file upload function from the frontend on the Mutiny 5 appliance. A directory traversal vulnerability in the same functionality allows for arbitrary file upload, which results in arbitrary code execution with root...

IBM Java java.lang.ClassLoader.defineClass Sandbox Breach (CVE-2012-4823)

A sandbox breach vulnerability has been reported IBM Java. The vulnerability exists in a certain function which calls a specific class, which later incorrectly returns a privileged ClassLoader, which is then used to instantiate a certain object. That object uses ByteArrays to create a class, whic...

Microsoft SharePoint Directory Traversal (MS13-024; CVE-2013-0084)

An elevation of privilege exists in Microsoft SharePoint Server. The vulnerability is due to an error in the way Microsoft SharePoint handles specially crafted URLs. A remote attacker may exploit this issue by enticing a target user to open a specially crafted web page. An attacker who successful...

Oracle Outside In CorelDRAW File Parser Heap Buffer Overflow (CVE-2013-0418)

A heap buffer overflow vulnerability exists in Oracle Outside In. The vulnerability is due to an error when processing Coords structure for loda chunks of type 3 Line/Curve. Remote attackers could exploit the vulnerability to inject and execute arbitrary code in the context of the vulnerable...

Microsoft DNS Server Denial of Service - Specific (MS12-017; CVE-2012-0006)

A denial of service vulnerability has been reported in Microsoft DNS servers. The vulnerability is due to the way that the DNS server improperly handles objects in memory when looking up the resource record of a domain. A remote attacker may exploit this issue by sending a specially crafted DNS...

Microsoft Windows MSXML XSLT Remote Code Execution (MS13-002; CVE-2013-0007)

A remote code execution vulnerability has been reported in Microsoft Windows...

Microsoft Word RTF listoverridecount Remote Code Execution (MS12-079; CVE-2012-2539; CVE-2014-1761)

A remote code execution vulnerability has been reported in Microsoft Word. The vulnerability is due to an error in the way Word parses specially crafted Rich Text Format RTF data. A remote attacker can exploit this issue by enticing a target user to open a malicious Microsoft Office Document...

Multiple Products NCTAudioFile2 ActiveX Control Buffer Overflow (CVE-2007-0018)

A remote code execution vulnerability has been reported in the NCTAudioFile2 ActiveX control. The vulnerability is due to a data validation failure by the NCTAudioFile2 ActiveX control. A remote attacker may exploit this vulnerability by enticing an affected user to open a specially crafted...

EnjoySAP SAP GUI ActiveX Control Arbitrary File Download (CVE-2008-4830)

An arbitrary file download vulnerability has been reported in EnjoySAP, a GUI for SAP. The vulnerability is due to an input validation error while processing a certain method. A remote attacker may exploit this vulnerability by enticing a target user to open a specially crafted HTML page...

Zenturi ProgramChecker ActiveX Components ActiveX Controls Buffer Overflows (CVE-2007-2987)

Multiple buffer overflow vulnerabilities have been reported in Zenturi ProgramChecker. The vulnerabilities are due to a data validation failure, resulting in a buffer overflow. A remote attacker may exploit these vulnerabilities by enticing a target user to open a specially crafted HTML file...

Microsoft SharePoint Server XML Rollup Information Disclosure (MS11-074; CVE-2011-1892)

An information disclosure vulnerability has been reported in Microsoft SharePoint Server. The vulnerability is due to improper handling of malicious XML classes by SharePoint. An attacker could trigger this flaw by loading a malicious XML file to content rollup in an affected SharePoint server...

Cisco AnyConnect VPN Client ActiveX Code Execution (CVE-2011-2039)

A remote code execution vulnerability has been reported in Cisco Anyconnect VPN Client. Annyconnect provides secured remote connection software solution for PCs and mobile devices. The vulnerability exists in the application VPN client's Activex control which aids in downloading and executing its...

7T Interactive Graphical SCADA System File Operations Buffer Overflows (CVE-2011-1567; CVE-2011-4050)

7-Technologies' IGSS is a Supervisory Control and Data Acquisition SCADA system used for monitoring and controlling industrial processes. Multiple buffer overflow vulnerabilities have been reported in 7T Interactive Graphical SCADA System IGSS. The vulnerability is due to boundary errors in the...

Novell GroupWise Internet Agent RRULE Parsing Buffer Overflow (CVE-2010-4326; CVE-2011-2662; CVE-2011-2663)

Novell GroupWise is a client-server collaborative software and email system provided by Novell. Novell GroupWise Internet Agent is a component of Novell GroupWise and provides email services, supporting SMTP, POP, and IMAP protocols. A buffer overflow vulnerability has been reported in Novell...

Oracle Document Capture EasyMail ActiveX Control Information Disclosure (CVE-2010-3595)

Oracle Document Capture supplies document scanning and indexing capabilities. It installs an ActiveX control EasyMail on web clients An information disclosure vulnerability has been reported in the EasyMail ActiveX control included with Oracle Document Capture. The vulnerability is due to imprope...

Microsoft Word Unchecked Index Value Remote Code Execution (MS10-079; CVE-2010-2750)

Microsoft Word is a popular word processing software. A remote code execution vulnerability has been identified in the way that Microsoft Word handles index values inside a specially crafted Word file. The vulnerability is due to an error in Microsoft Word that fails to properly parse specially...

Oracle Secure Backup Administration selector Variable Command Injection (CVE-2010-0906)

Oracle Secure Backup is a backup solution allowing for single point of management of data present on network attached storage NAS devices and distributed hosts. A command execution vulnerability exists in Oracle Secure Backup server. The vulnerability is due to an insufficient sanitizing when...

Oracle Secure Backup Administration property_box.php Command Injection (CVE-2010-0899)

Oracle Secure Backup is a backup solution allowing for centralized tape backup management. The server allows for single point of management of data present on network attached storage NAS devices and distributed hosts which may have different operating systems. The data in transit is kept secure ...

Microsoft Outlook Express Windows Address Book File Overflow (MS06-016; CVE-2006-0014)

Microsoft Outlook Express OE is an email, newsgroup and address book management client application. The application includes a stand-alone component called Address Book that manages the address book entries. An Address Book can contain entries for individual contacts as well as group lists that...

Update Protection against HP OpenView Storage Data Protector Cell Manager Heap Buffer Overflow

A buffer overflow vulnerability exists in HP OpenView Data Protector Cell Manager, a backup solution designed for enterprise and distributed environments. The flaw is due to an integer overflow while processing crafted packets received on port 1530/TCP. A remote attacker can exploit this...

Novell eDirectory iMonitor NDS Server Buffer Overflow (CVE-2005-2551; CVE-2006-2496)

Novell eDirectory is a Lightweight Directory Access Protocol LDAP server intended for use as a part of an identity management solution. The product is made available for multiple platforms including NetWare, Unix-like systems, and Windows. iMonitor, one of the many components of eDirectory, is a...

Microsoft Excel SxView Record Parsing Memory Corruption (MS10-038; CVE-2010-0821)

Microsoft Excel is a spreadsheet application released by the Microsoft Corporation. Its native file format is the Binary Interchange File Format BIFF, which is available is several versions. An Excel file contains information about the various spreadsheets that form an Excel workbook, the data an...

Microsoft Excel WOpt Record Memory Corruption (MS10-038; CVE-2010-0824)

Microsoft Excel is a popular spreadsheet application. A memory corruption vulnerability has been identified in Microsoft Excel. The vulnerability is due to an error in Microsoft Office Excel that fails to properly parse the Excel spreadsheet file format. A remote attacker could trigger this flaw ...

Firebird XDR Operation Request Handling Denial of Service (CVE-2008-0387)

There exists a null-dereference overflow vulnerability in Firebird database project. The flaw resides in the External Data Representation XDR protocol processing routines. A remote unauthenticated attacker may exploit this vulnerability by sending crafted message to the target server. Successful...

Internet Explorer Nested Object Tag Handling Memory Corruption (MS06-021; CVE-2006-1992)

Microsoft Internet Explorer IE is the most widely used web browser application. The browser is capable of processing HTML, scripting languages, and interpretation of various other popular Internet specifications. There exists a memory corruption vulnerability in Microsoft Internet Explorer. The...

Microsoft SMB Server Race Condition Denial of Service (MS10-012; CVE-2010-0021)

The SMB Protocol is a network file sharing protocol that is implemented in Microsoft Windows. A denial of service vulnerability has been reported in the Microsoft Windows Server Message Block SMB implementation. The vulnerability is due to a race condition in a driver that is part of the SMB stac...

Preemptive Protection against Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerabilities (MS10-002)

Multiple memory corruption vulnerabilities have been reported in Microsoft Internet Explorer. A remote attacker could exploit these issues by convincing a user to open a maliciously crafted HTML file with Internet Explorer, which will cause the browser to crash and may allow execution of arbitrar...

Nullsoft Winamp Player Playlists Name Handling Buffer Overflow (CVE-2006-0476; CVE-2006-0708)

NullSoft Winamp is a multimedia player that is capable of playing many formats of audio and video files. Winamp is capable of retrieving and displaying meta data embedded in media files. There exists a buffer overflow vulnerability in Nullsoft Winamp Player. The vulnerability is caused by...

Jive Software Openfire Jabber Server Authentication Bypass (CVE-2008-6508)

Openfire previously known as Wildfire Server is an open source Jabber/XMPP server written in Java. Jabber is an open instant messaging technology that is maintained by the community. Extensible Messaging and Presence Protocol XMPP is an open, XML-inspired protocol originally aimed at...

Internet Explorer STYLE Object Remote Code Execution (CVE-2009-3672)

Microsoft Internet Explorer is the most widely used Internet browser. A memory corruption vulnerability has been reported in Microsoft Internet Explorer. The vulnerability is due to the way Internet Explorer accesses an object that has been deleted. To trigger this issue, an attacker may create a...

Internet Explorer daxctle.ocx KeyFrame Method Memory Corruption (MS06-067; CVE-2006-4777)

Microsoft Internet Explorer IE is a web browser application that is capable rendering both static and dynamic contents. The application supports the ActiveX technology, which is a feature extension framework. IE is installed with a set of ActiveX controls including the DirectAnimation package...

Adobe JRun 4 Server File Disclosure (CVE-2004-0928)

Adobe JRun is an application server used to deploy J2EE Java 2 Enterprise Edition applications, JSPs Java Server Pages, and other Java applications. It can be used as a stand-alone web server or can be accessed through other web servers including IIS and Apache. With IIS, JRun can be registered t...

Multiple Browsers Telnet URI Handler File Manipulation (CVE-2004-0411; CVE-2004-0473)

There exists a vulnerability that affects various web-browsers. Insufficient input validation for telnet URI e.g., telnet://hostname can cause the Telnet software activated by the browsers to treat specially crafted Telnet URI as command-line options. As such, a malicious attacker may be able to...

Nullsoft Winamp Ultravox Streaming Metadata Parsing Stack Buffer Overflow (CVE-2008-0065)

NullSoft Winamp is a multimedia player that is capable of playing back many audio/video formats and streaming protocols. Winamp supports the Ultravox media streaming format, a proprietary streaming media protocol developed by AOL. There exists a buffer overflow vulnerability in Nullsoft Winamp...

RealNetworks Helix Server RTSP SETUP Request Denial of Service (CVE-2009-2534)

Helix Server is a multi-media server that is designed to serve streaming and static audio and video content. A denial of service vulnerability has been reported in RealNetworks Helix Server. The vulnerability is due to an error in the way RealNetworks Helix Server handles SETUP requests. A remote...

Microsoft Windows AVI Processing Malformed Header Code Execution (MS09-038; CVE-2009-1545)

Audio Video Interleave AVI is a special case of Resource Interchange File Format RIFF. This file type used with applications that capture, edit, and play back audio-video sequences. A remote code execution vulnerability has been discovered in the way Microsoft Windows handles specially crafted AV...

Update Protection against Oracle Application Server BPEL Module Cross Site Scripting

Oracle Application Server is vulnerable to cross-site scripting due to lack of validation of user supplied data. Oracle Application Server is a multi-platform solution for developing and deploying enterprise applications and web sites. The flaw may be exploited by attackers to execute arbitrary...

Microsoft Windows search-ms Protocol Handler Command Execution (MS08-075; CVE-2008-4269)

Windows Search is a standard component of Windows Vista that allows instant search capabilities for most common file and data types.Windows Search has XML-based files that save information about a search in Windows. A remote code execution vulnerability was reported in Windows Explorer which allo...

Update Protection against CA Multiple Products ActiveX Control Buffer Overflow Vulnerability

A vulnerability was reported in multiple Computer Associates CA products. These products are all intended for enhancing corporate and client security. The vulnerability is due to insufficient boundary checking in the parameters passed to the affected ActiveX control installed by the products list...

Novell eDirectory HTTP Headers Denial of Service (CVE-2008-0927)

Novell eDirectory is a Lightweight Directory Access Protocol LDAP directory-based identity management system that centralizes the management of user identities, access privileges and many other network resources. A denial of service vulnerability was identified in Novell eDirectory. The...

Microsoft Windows GDI Metafile Image Handling Heap Overflow (MS08-021; CVE-2008-1083)

The Microsoft Windows graphics device interface GDI enables applications to use graphics and formatted text on the video display and on the printer.WMF and EMF are image formats used in many Windows programs including Internet Explorer and Outlook. A remote code execution vulnerability has been...

Internet Explorer ANIMATEMOTION Memory Corruption (MS08-010; CVE-2008-0077)

Microsoft Internet Explorer is the most widely used Internet browser. The vulnerability is due to a memory corruption error in Microsoft Internet Explorer when calling the property method. A remote attacker could exploit this issue by convincing a user to visit a specially crafted Web page...

IBM and Lenovo Access Support acpRunner ActiveX Security Bypass (CVE-2007-2928; CVE-2007-2929; CVE-2007-2940)

The Access Support software package for IBM and Lenovo systems includes several ActiveX controls. A remote attacker could exploit this issue by convincing a user to visit a specially crafted HTML document or open a malicious web page. Successful exploitation could result in remote code execution ...