Siemens SIPROTEC Denial of Service (CVE-2015-5374)

A vulnerability exists in Siemens SIPROTEC. This vulnerability, aka Crash Override or Industroyer, is due to the way SIPROTEC handles certain malformed protocol requests. A successful attack can lead to a denial of service...

Microsoft Windows Kernel Information Disclosure (CVE-2017-0258)

An information disclosure vulnerability exists within Microsoft Windows. The vulnerability is caused when Microsoft Windows kernel improperly handles objects in memory. Successful exploitation of this issue might lead to leakage of sensitive information from the kernel...

Microsoft IIS Server XSS Elevation of Privilege (MS17-016: CVE-2017-0055)

A cross-site scripting vulnerability exists in Microsoft IIS, due to improper input validation. A remote attacker can exploit this issue by enticing an affected user to open a specially crafted web page. Successful exploitation could allow an attacker to spoof content, disclose information, or ta...

SafeNet SoftRemote GROUPNAME Buffer Overflow (CVE-2009-3861)

A stack buffer overflow vulnerability exists in SafeNet SoftRemote Security Policy Editor. The vulnerability is due to insufficient input validation while handling a specially formatted security policy. Successful exploitation could lead to arbitrary code execution in the security context of the...

Microsoft Browser Scripting Engine Memory Corruption (MS16-145: CVE-2016-7287)

A memory corruption vulnerability exists in Microsoft Edge. The vulnerability is due to the way JavaScript engine renders when handling objects in memory. A remote unauthenticated attacker could exploit this vulnerability by enticing the target user to open a specially crafted web page...

Microsoft Windows VHDFS Driver Elevation of Privilege (MS16-138: CVE-2016-7224)

Multiple elevation of privilege vulnerabilities exist in the Windows VHDMP kernel driver. The vulnerability is due to the way driver fails to properly handle user access to certain files. An attacker can exploit this vulnerability by gaining access to the local system and executing a specially...

SolarWinds SRM Profiler SQL Injection (CVE-2016-4350)

An SQL injection vulnerability has been reported in SolarWinds Storage Manager Resource Monitor, Profiler Module. This vulnerability is due to insufficient validation in several parameters when processing HTTP requests. A remote, authenticated attacker could exploit this vulnerability by sending ...

Microsoft Internet Explorer Memory Corruption (MS16-009: CVE-2016-0061)

A memory corruption vulnerability exists in Microsoft Internet Explorer. The vulnerability is due to a type confusion when handling certain objects in JavaScript. A remote unauthenticated attacker could exploit this vulnerability by enticing the target user to open a specially crafted web page...

Microsoft Internet Explorer Information Disclosure (MS16-009: CVE-2016-0059)

An information disclosure vulnerability has been reported in Microsoft Internet Explorer. The vulnerability is due to an error in the way that Hyperlink Object Library discloses the contents of its memory. A remote attacker can exploit this issue by enticing a user to open a specially crafted...

Dell NetVault Backup Denial of Service (CVE-2015-5696)

A Denial of Service vulnerability has been reported in Dell NetVault service. The vulnerability exists in Dell NetVault's nvpmgr.exe and is due to the way invalid "Subcode data" is handled when there is the relevant "Code" value. A remote attacker can trigger this flaw by establishing a connectio...

Microsoft Office Memory Corruption (MS15-99: CVE-2015-2523)

A remote code execution vulnerability exists in Microsoft Office. The vulnerability is due to an error in the way Microsoft Office improperly handles objects in memory while parsing specially crafted files. A remote attacker can exploit this issue by enticing a victim to open a specially crafted...

Microsoft Internet Explorer Memory Corruption (MS15-079: CVE-2015-2452)

A remote code execution vulnerability has been reported in Microsoft Internet Explorer. The vulnerability is due to an error in the way that Internet Explorer accesses an object that has not been correctly initialized or has been deleted. A remote attacker can exploit this issue by enticing a use...

Microsoft Graphics Component Remote Code Execution (MS15-080: CVE-2015-2464)

A remote code execution vulnerability has been reported in Windows Graphics Component. The vulnerability is due to the way Windows components handle specially crafted TTF files. A remote attacker can exploit this issue by enticing a user to view TTF files in shared content...

Adobe Acrobat and Reader API Calls Code Execution (APSB15-10: CVE-2015-3062; CVE-2015-3060)

A remote code execution vulnerability has been reported in Adobe Acrobat and Reader. The vulnerability is due to the way Adobe Reader handles certain API functions, that could lead to bypass restrictions. A remote attacker can exploit this issue by enticing a target user to open a specially craft...

VMware ESX and ESXi Server SOAP Request Handling Denial Of Service - Ver2 (CVE-2012-5703)

A denial of service vulnerability exists in VMware ESX and ESXi server. The vulnerability is due to improper handling of certain SOAP requests in the vSphere API. A remote unauthenticated attacker could exploit this vulnerability by sending specially crafted messages to the affected server...

PHP Core unserialize process nested data Use After Free - ver 2 (CVE-2014-8142; CVE-2015-0231)

A code execution vulnerability has been reported in PHP core. The vulnerability is due to a use after free error when handling serialized objects with identical number key names within the unserialize function. A remote attacker can exploit the vulnerability by sending crafted serialized data to ...

Oracle Database Client System Analyzer Arbitrary File Upload Code Execution - Ver2 (CVE-2010-3600)

A code execution vulnerability has been reported in Oracle Enterprise Manager Grid Control and Oracle Database Server. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Microsoft AntiXSS Library Bypass Information Disclosure (MS12-007) - Ver2 (CVE-2012-0007)

An information disclosure vulnerability has been reported in the Microsoft Anti-Cross Site Scripting AntiXSS Library. The vulnerability is due to the way the AntiXSS Library incorrectly evaluates certain characters after a CSS escaped character is detected. A remote attacker may exploit this issu...

Microsoft Internet Explorer EUC-JP Character Encoding Cross Site Scripting - Ver2 (CVE-2013-3192)

A universal cross site scripting vulnerability exists in Microsoft Internet Explorer. The vulnerability is due to the way that IE handles EUC-JP character encoding. A remote attacker could exploit this vulnerability by submitting specially crafted HTML code into a target web site that uses EUC-JP...

Microsoft Windows Fax Services Cover Page Editor Heap Buffer Overflow - Ver2 (CVE-2010-3974)

A heap buffer overflow vulnerability has been discovered in Microsoft Windows Fax Services. The Windows Fax Service is a component that allows a Windows system to act as a Fax server. One of the tools within this fax suite is the Fax Console, which allows a user to monitor the sending and receivi...

Microsoft Internet Explorer Memory Corruption (MS15-018: CVE-2015-0032)

A remote code execution vulnerability has been reported in Microsoft Internet Explorer. The vulnerability is due to the way that the VBScript engine handles objects in memory when rendered in Internet Explorer. A remote attacker can exploit this issue by enticing a user to open a specially crafte...

Adobe Shockwave Player Chunk Parsing Uninitialized Object Access (APSB12-13) - Ver2 (CVE-2012-2030)

A remote code execution vulnerability has been reported in Adobe Shockwave player. The vulnerability is due to an error in Adobe Shockwave Player while parsing crafted data inside rcsL RIFF chunk in DIR or DCR files. A remote attacker can exploit this issue by enticing a target user to open a...

AWStats configdir Parameter Remote Command Execution (CVE-2005-0116; CVE-2005-0362)

A command execution vulnerability has been reported in AWStats. The vulnerability is due to failing of AWStats CGI script to properly sanitize user provided parameters. A remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the target system...

AlienVault OSSIM Framework Backup Command Execution (CVE-2014-5158)

A command execution vulnerability exists in AlienVault OSSIM Framework. The vulnerability is due to insufficient sanitization of user supplied data that is used to execute backup commands. A remote unauthenticated attacker could exploit this vulnerability by sending a crafted request to the...

Advantech WebAccess SCADA webvact.ocx AccessCode Buffer Overflow (CVE-2014-0767)

A stack buffer overflow exists in Advantech's WebAccess SCADA software. This is due to insufficient input validation on the AccessCode parameter of the webvact.ocx ActiveX control, a part of the WebAccess Client. A remote, unauthenticated attacker could exploit this vulnerability by enticing a...

Microsoft Lync Server Information Disclosure (MS14-032; CVE-2014-1823)

An information disclosure vulnerability exists when Lync Server fails to properly sanitize specially crafted content. The vulnerability is caused when Lync Server does not properly sanitize specially crafted content. An attacker who successfully exploited this vulnerability could potentially...

Sun Java Web Start dnsResolve ActiveX Buffer Overflow - Ver2 (CVE-2007-5019)

A buffer overflow vulnerability has been reported in numerous forms. The vulnerability is due to a boundary error in the Sun Java Web Start ActiveX control that fails to properly handle user supplied data. Successful exploitation of this vulnerability could allow a remote attacker to execute...

Microsoft Windows Mail HTML Link Program Execution - Ver2 (CVE-2007-1658)

A command and program execution vulnerability has been reported in Microsoft Windows Vista. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands and programs on the affected system...

Movable Type 4.2x 4.3x Upgrade Script RCE Script Injection - Ver2 (CVE-2012-6315)

A script injection and execution vulnerability has been reported in Movable Type. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary Perl code and SQL commands on the affected system...

Microsoft PowerPoint RecolorInfo Atom Buffer Overrun (MS11-036) - Ver2 (CVE-2011-1270)

Microsoft PowerPoint is a popular graphics software for preparing slides and presentations. A remote attacker could exploit this issue via a malformed PowerPoint file. . A remote code execution vulnerability has been identified in Microsoft PowerPoint. The vulnerability is caused when Microsoft...

VEGO Web Forum login.php username Parameter SQL Injection - Ver2 (CVE-2006-0067)

An SQL injection vulnerability has been reported in VEGO Links Builder. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary SQL commands on the affected system...

Microsoft IIS ASP Engine HTMLEncode Buffer Overflow - Ver2 (CVE-2008-0075)

A buffer overflow vulnerability has been reported in the Microsoft IIS. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Microsoft SharePoint Calendar Cross-Site Scripting - Ver2 (CVE-2011-0653)

A cross-site scripting vulnerability has been reported in SharePoint 2010. The vulnerability is due to insufficient validation of user input to the calendar object by an affected SharePoint server. A remote attacker could exploit this vulnerability by enticing unsuspecting users to open a special...

Comet WebFileManager CheckUpload.php Language Parameter PHP Code Execution - Ver2 (CVE-2006-4077)

A code execution vulnerability has been reported in Vincenzo Valvano Comet WebFileManager CWFM. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

WellinTech KingView ActiveX Control Heap Buffer Overflow Remote Code Execution (CVE-2011-3142)

A stack-based buffer overflow vulnerability has been reported in WellinTech KingView ActiveX control. The vulnerability is due to failure to perform adequate boundary checks on user-supplied input. A remote attacker can exploit this vulnerability by sending via a long second argument to the...

HP Intelligent Management Center SOM sdFileDownload Information Disclosure (CVE-2013-4826)

An information disclosure vulnerability has been reported in HP Intelligent Management Center Service Operation Management Software...

Microsoft FrontPage XML Information Disclosure (MS13-078; CVE-2013-3137)

An information disclosure vulnerability exists in FrontPage...

Corel WordPerfect Document Processing Buffer Overflow (CVE-2012-4900)

A heap memory corruption vulnerability has been reported in Corel WordPerfect...

Schneider Electric Accutech Manager HTTP Request Processing Buffer Overflow (CVE-2013-0658)

A buffer overflow vulnerability has been reported in Schneider Electric Accutech Manager...

HP Intelligent Management Center mibFileUpload Servlet Arbitrary File Upload (CVE-2012-5201)

An arbitrary file upload vulnerability exists in HP Intelligent Management Center...

Linux Kernel iscsi_add_notunderstood_response Heap Buffer Overflow (CVE-2013-2850)

A heap buffer overflow vulnerability has been reported in the Linux Kernel. The vulnerability is in the iscsiaddnotunderstoodresponse function in the iscsitarget driver and is due to the way a notunderstood response is created after processing very long keys. A remote, unauthenticated attacker ca...

Microsoft Windows Remote Desktop Protocol Denial of Service (MS05-041) - High Confidence (CVE-2005-1218)

A vulnerability exists in Microsoft Windows Remote Desktop Protocol RDP. Remote Desktop Protocol RDP lets users create a virtual session on their desktop computers, allowing them to access all the data and applications on their computers. To trigger the vulnerability, an attacker could send a...

Microsoft System Center Operations Manager Cross-Site Scripting (MS13-003; CVE-2013-0009)

A cross-site scripting vulnerability has been reported in Microsoft System Center Operations Manager...

IBM Rational ClearQuest CQOle ActiveX Code Execution (CVE-2012-0708)

A remote code execution vulnerability has been reported in IBM Rational ClearQuest...

Nullsoft Winamp RIFF INFO Record Heap Buffer Overflow (CVE-2011-3834)

A remote code execution vulnerability has been reported in Nullsoft Winamp...

Preemptive Protection against Freefloat FTP Server Invalid Command Buffer Overflow (CVE-2005-0696; CVE-2005-3683)

A buffer overflow vulnerability has been reported in Freefloat FTP Server...

Apple Safari file URL Arbitrary Code Execution (CVE-2011-3230)

A remote code execution vulnerability has been reported in Apple Safari. The vulnerability is due to an error in Apple Safari while handling of file:// URLs. A remote attacker can exploit this vulnerability to execute arbitrary code...

Preemptive Protection against Microsoft Active Directory Certificate Services Cross-Site Scripting (MS11-051; CVE-2011-1264)

A cross-site scripting vulnerability has been reported in Microsoft Active Directory Certificate Services...

Microsoft Excel 4.0 Workbook file detected

A remote code execution vulnerability has been reported in Microsoft Excel. A remote attacker could exploit this vulnerability to execute arbitrary code in an affected system...

Microsoft Host Integration Server snabase.exe Denial of Service (CVE-2011-2007)

A denial of service DoS vulnerability has been reported in Microsoft Host Integration Server HIS. HIS is a gateway application that provides host access and integration, extending Microsoft Windows to other systems by integrating mission-critical host applications, data sources, messaging and...