13538 matches found
Microsoft Edge Chakra ParseCatch Type Confusion (CVE-2017-11764)
A type confusion vulnerability exists in Microsoft Edge Chakra JavaScript Engine. The vulnerability is due to a lack of validation in the ParseCatch method which results in the generation on a malformed Abstract Syntax Tree AST. A remote attacker could exploit this vulnerability by enticing the...
Mitsubishi Electric E-Designer BEComliSlave Status_bit Stack Buffer Overflow (CVE-2017-9638)
A stack-based buffer overflow vulnerability exists in Mitsubishi's Electric E-Designer. The vulnerability is due to the missing input validation of the Statusbit property of BEComliSlave configuration file. A remote attacker can exploit this vulnerability by enticing a user to visit a maliciously...
Trend Micro Control Manager cmdHandlerTVCSCommander SQL Injection (CVE-2017-11383)
An SQL injection vulnerability exists in Trend Micro Control Manager. The vulnerability is due to improper validation of the user supplied input for cmdHandlerTVCSCommander.dll. A remote, unauthenticated attacker could exploit this vulnerability by sending a crafted request to the target server...
Trend Micro Control Manager cmdHandlerLicenseManager SQL Injection (CVE-2017-11384)
An SQL injection vulnerability exists in Trend Micro Control Manager. The vulnerability is due to improper validation of the user-supplied input for cmdHandlerLicenseManager.dll. A remote, unauthenticated attacker could exploit this vulnerability by sending a crafted request to the target server...
HPE Smart Storage Administrator Code Execution (CVE-2016-8523)
A remote code execution vulnerability exists in HPE Smart Storage Administrator. A remote attacker could exploit this vulnerability by sending a crafted HTTP request to the vulnerable server. Successful exploitation could result in arbitrary code execution in the security context of the process...
HPE Intelligent Management Center RMI Registry Insecure Deserialization (CVE-2017-5792)
An insecure deserialization vulnerability has been reported in HPE Intelligent Management Center. The vulnerability is due to deserialization of untrusted data by RMI Registry while having vulnerable classes in the code path. A remote, unauthenticated attacker can exploit this vulnerability by...
Microsoft Windows Kernel Information Disclosure (CVE-2017-0220)
An information disclosure vulnerability exists within Microsoft Windows. The vulnerability is caused when Microsoft Windows kernel improperly handles objects in memory. Successfully exploiting this vulnerability can result in Elevation-of-Privilege...
Digium Asterisk CDR ast_cdr_setuserfield Buffer Overflow (CVE-2017-16671; CVE-2017-7617)
A buffer overflow exists in the CDR engine of Digium Asterisk. The vulnerability is due to a lack of size checking when setting the user field of a CDR. A remote, authenticated attacker can exploit this vulnerability by sending a crafted message to an affected Asterisk server...
Microsoft Outlook Remote Code Execution (CVE-2017-0106)
A remote code execution vulnerability exists in Microsoft Outlook. The vulnerability is due to the way Microsoft Outlook parses specially crafted email messages. A remote attacker can exploit this vulnerability by enticing the target user to open a specially crafted email message...
Microsoft Windows GDI Elevation of Privilege (MS17-013: CVE-2017-0025)
An elevation of privilege vulnerability exists in Windows Graphics Device Interface GDI. The vulnerability is caused when the Windows Graphics Device Interface fails to properly handle objects in memory. A remote attacker can exploit this vulnerability by running a specially crafted application...
Microsoft Office Memory Corruption (MS17-014: CVE-2017-0030)
A remote code execution vulnerability exists in Microsoft Office. The vulnerability is due to an error in the way Microsoft Office handles objects in memory while parsing specially crafted files. A remote attacker can exploit this issue by enticing a victim to open a specially crafted file...
Microsoft Windows Graphics Component Remote Code Execution (MS17-013: CVE-2017-0014)
A remote code execution vulnerability exists in Windows Graphics Component. The vulnerability is due to the way Windows Graphics Component handles objects in memory. A remote attacker can exploit this vulnerability by enticing the target user to open a specially crafted file...
Microsoft Office Information Disclosure (MS17-014: CVE-2017-0027)
An information disclosure vulnerability exists in Microsoft Office. The vulnerability is due to an error in the way Microsoft Office improperly discloses the contents of its memory. A remote attacker can exploit this issue by enticing a victim to open a specially crafted file...
Cisco WebEx Meetings Server and Center Remote Code Execution (CVE-2017-3823)
A remote code execution vulnerability exists in Cisco WebEx Meetings Server and WebEx Meetings Center browser extensions. The vulnerability is due to a design weakness in the API response parser within the extensions.A remote unauthenticated attacker could exploit this vulnerability by enticing a...
Microsoft Windows IME Elevation of Privilege (MS16-130: CVE-2016-7221)
An elevation of privilege vulnerability exists in Windows Input Method Editor IME. The vulnerability is due to the way Input Method Editor improperly handles DLL loading. A locally authenticated attacker can exploit this vulnerability by running a specially crafted application...
Google Chrome Blink ImageBitmap Integer Overflow (CVE-2016-5182)
A heap overflow vulnerability exists in Google Chrome Blink. The vulnerability is due to an integer overflow in a function while processing an HTML file. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted HTML file, potentially leading...
Apache OpenMeetings Event Description Cross-Site Scripting (CVE-2016-2163)
A cross-site scripting vulnerability has been reported in the event handling component of Apache OpenMeetings. The vulnerability is due to insufficient validation of input for event descriptions. A remote, authenticated attacker could exploit this vulnerability by scheduling an event with a craft...
Microsoft Edge PDF Remote Code Execution (MS16-096: CVE-2016-3319; CVE-2017-0291)
A remote code execution vulnerability exists in Microsoft Edge. The vulnerability is due to the way Edge improperly accesses objects in memory. A remote attacker can exploit this issue by enticing a target victim to open a specially crafted PDF file...
Microsoft Office Memory Corruption (MS16-088: CVE-2016-3281)
A remote code execution vulnerability exists in Microsoft Office. The vulnerability is due to an error in the way Microsoft Office improperly handles objects in memory while parsing specially crafted files. A remote attacker can exploit this issue by enticing a victim to open a specially crafted...
Symantec Antivirus Engine ASPack Remote Memory Corruption (CVE-2016-2208)
A Memory Corruption vulnerability exist in the Symantec Antivirus Engine in ASPack early version. This vulnerability is due to incorrect parsing of executables packed by ASPack early version...
Microsoft Graphics Component Remote Code Execution (MS16-055: CVE-2016-0170)
A remote code execution vulnerability exists in Windows Graphics Component. The vulnerability is due to the way Microsoft Windows does not properly handle malformed EMF files. A remote attacker can exploit this vulnerability to execute arbitrary code via a specially crafted request...
Microsoft .NET Framework Denial of Service (MS16-019: CVE-2016-0033)
A Denial of Service vulnerability has been reported in the Microsoft .Net Framework. The vulnerability is due to an error in the way that Microsoft .Net Framework handles XSLT parsing component. A remote attacker could exploit this vulnerability by sending specially crafted data to the target...
WordPress Webdorado Spider Event Calendar Plugin SQL Injection (CVE-2015-2196)
An SQL injection vulnerability exists in Spider Event Calendar 1.4.9 for WordPress allowing remote attackers to execute arbitrary SQL commands...
Microsoft Office Memory Corruption (MS15-116: CVE-2015-6038)
A remote code execution vulnerability exists in Microsoft Office. The vulnerability is caused when the Office software fails to properly validate templates. A remote attacker can exploit this issue by enticing a victim to open a specially crafted file...
Google Android Stagefright 3GPP Metadata Buffer Overread (CVE-2015-3826)
A denial of service vulnerability ,known as Stagefright Vulnerability, has been reported in Android devices core. The vulnerability is due to a buffer overread in 3GPP Metadata. Successful exploitation could result in a denial of service condition...
Microsoft Graphics Component Remote Code Execution (MS15-080: CVE-2015-2455)
A remote code execution vulnerability has been reported in Microsoft Windows Graphics Component. The vulnerability is due to the way Windows components handle specially crafted TTF files. A remote attacker can exploit this issue by enticing a user to view TTF files in shared content...
Oracle Data Quality Trillium Based SetEntities Type Confusion (CVE-2015-0444)
A remote code execution vulnerability exists in Oracle Data Quality TSS12.LoaderWizard.lwctrl ActiveX control. The vulnerability is due to a type confusion when handling data passed to SetEntities. A remote attacker can exploit this vulnerability by enticing a user to access a maliciously crafted...
Microsoft Internet Explorer Memory Corruption (MS15-065: CVE-2015-2372)
A remote code execution vulnerability has been reported in Microsoft Internet Explorer. The vulnerability is due to an error in the way that Internet Explorer accesses an object that has not been correctly initialized or has been deleted. A remote attacker can exploit this issue by enticing a use...
Microsoft Internet Explorer Memory Corruption (MS15-065: CVE-2015-2397)
A remote code execution vulnerability has been reported in Microsoft Internet Explorer. The vulnerability is due to an error in the way that Internet Explorer accesses an object that has not been correctly initialized or has been deleted. A remote attacker can exploit this issue by enticing a use...
PHP ftp_genlist method Integer Overflow (CVE-2015-4022)
A code execution vulnerability exists in PHP's ftpgenlist method. The vulnerability is due to lack of integer overflow detection when calculating the size of the response to the FTP LIST command. A remote attacker can exploit the vulnerability by hosting an FTP server and sending crafted ata to a...
IBM Tivoli Storage Manager FastBack Mount Stack Buffer Overflow (CVE-2015-0120)
A stack buffer overflow vulnerability exists in IBM Tivoli Storage Manager FastBack Mount. The vulnerability is due to insufficient input validation of parameters to the CRYPTOSEncryptBufferToBuffer function. A remote unauthenticated attacker could exploit this vulnerability by sending crafted...
IBM Java ProxyUtil Sandbox Breach - Ver2 (CVE-2012-4820)
A sandbox breach vulnerability exists in IBM Java. The vulnerability is due to an access control failure in the "com.ibm.rmi.util.ProxyUtil" package. A remote attacker can exploit this vulnerability by enticing the target user to open a crafted web page...
Oracle WebCenter Forms Recognition Sssplt30.ocx Arbitrary File Creation - Ver2 (CVE-2012-1710)
A directory traversal vulnerability has been reported in Oracle WebCenter Forms Recognition. The vulnerability is due to insufficient validation of parameters used in a certain method in the Sssplt30 ActiveX control. A remote attacker can exploit this vulnerability by enticing a target user to op...
Microsoft Excel Malformed Chart Sheet Substream Memory Corruption (MS10-038) - Ver2 (CVE-2010-0823)
Microsoft Excel is a spreadsheet application released by the Microsoft Corporation. Its native file format is the Binary Interchange File Format BIFF, which is available is several versions. An Excel file contains information about the various spreadsheets that form an Excel workbook, the data an...
Microsoft Internet Explorer Table Layout Memory Corruption - Ver2 (CVE-2008-2258)
A memory corruption vulnerability has been reported in Microsoft Internet Explorer. The vulnerability is due to a memory corruption in the way Internet Explorer handles HTML tables. Remote attackers can entice target users to visit a malicious web page via a vulnerable version of the Internet...
Apple Quicktime MJPEG Frame stsd Atom Heap Overflow - Ver2 (CVE-2013-1020)
A buffer overflow vulnerability has been reported in Apple Quicktime. The vulnerability is due to improper processing of mjpeg movies with an improper jpeg frame size in the stsd atom. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the...
Microsoft HSC URL Remote Code Execution (MS04-015) - Ver2 (CVE-2004-0199)
A vulnerability exists in the way Microsoft Help and Support Center HSC validates URLs with the scheme hcp://. There is a vulnerability in the way the Microsoft Help and Support Center processes URL strings. The vulnerability could be exploited to download and execute malicious programs on a...
Corel Multiple Products Multiple Insecure Library Loading (CVE-2014-8393)
Multiple insecure library loading vulnerabilities have been reported in multiple Corel products. The vulnerabilities are due to the insecure loading of a number of libraries. These include but are not limited to, Wintab32.dll, TDMgd3.089.dll, wacommt.dll, and quserex.dll. A remote attacker could...
Wordpress Shopping Cart Plugin Unrestricted File Upload (CVE-2014-9308)
An unauthorized file upload vulnerability has been reported in Wordpress Shopping Cart Plugin. A remote attacker could exploit this vulnerability by uploading a file to a server running the vulnerable application. Successful exploitation of this vulnerability could allow a remote attacker to...
Microsoft Application Compatibility Infrastructure Elevation of Privilege (MS15-001; CVE-2015-0002)
A privilege escalation vulnerability exists in Microsoft Windows Application Compatibility Cache. The vulnerability is due to a lack of validation of administrator privileges while running a specially crafted application. An authenticated attacker can exploit this issue by sending a specially...
Adobe Acrobat and Reader Memory Corruption (APSB14-28: CVE-2014-8458)
A memory corruption vulnerability has been reported in Adobe Reader and Acrobat. The vulnerability is due to an error in Adobe Reader and Acrobat while parsing a corrupted PDF file. A remote attacker may exploit this vulnerability by enticing a target user to open a specially crafted PDF file...
InduSoft Web Studio Unauthenticated Insecure Remote Operations Code Execution - Ver2 (CVE-2011-4051)
A code execution vulnerability has been reported in the Remote Agent component of InduSoft Web Studio. The vulnerability is due to the absence of authentication for incoming requests to the Remote Agent service. An attacker could exploit this vulnerability by sending crafted requests to the...
RealNetworks HELIX Server Denial of Service - Ver2 (CVE-2004-0389)
A denial-of-service vulnerability has been reported in Realnetworks Helix Universal Server. Successful exploitation of this vulnerability would allow a remote attacker to create a denial of service condition on the affected system...
Digium Asterisk Manager User Shell Command Execution - Ver2 (CVE-2012-2414)
A security bypass vulnerability has been reported in Digium Asterisk. The vulnerability is due to an error in the way the server validates permissions while executing shell commands from unauthorized users. A remote attacker can exploit this issue by sending specially crafted AMI requests to the...
Windows Explorer ICO File Format Divide by Zero Denial of Service - Ver2 (CVE-2007-2237)
A denial-of-service vulnerability has been reported in Microsoft Windows XP. Successful exploitation of this vulnerability would allow a remote attacker to create a denial of service condition on the affected system...
Peercast URL Format String Exploit Code Execution - Ver2 (CVE-2005-1806)
A code execution vulnerability has been reported in Peercast. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...
Microsoft Internet Explorer Use After Free Remote Code Execution (CVE-2014-8967)
A use after free vulnerability exists in Microsoft Internet Explorer. The vulnerability is due to an error while handling certain objects when processing HTML and script code. A remote unauthenticated attacker could exploit this vulnerability by enticing the target user to open a specially crafte...
Microsoft Exchange Server Outlook Web Access URL Redirection (MS14-075; CVE-2014-6336)
A spoofing vulnerability exists in Microsoft Exchange Server. The vulnerability is due to an error in Microsoft Exchange when Microsoft Outlook Web Access OWA fails to properly validate redirection tokens. A remote attacker can exploit this issue by enticing a victim to open a specially crafted...
Advantech WebAccess SCADA webeye.ocx ip_address Parameter Buffer Overflow (CVE-2014-8388)
A stack buffer overflow exists in Advantech's WebAccess SCADA software. The vulnerability is due to insufficient input validation of the ipaddress parameter contained in the webeye.ocx ActiveX control, a part of the WebAccess Client. A remote, unauthenticated attacker could exploit this...
Belkin N750 Router Unauthenticated Remote Command Execution (CVE-2014-1635)
A buffer overflow vulnerability has been reported in Belkin N750 router. The vulnerability is due to improper input validation in the router's Web interface. A remote attacker could exploit this vulnerability by sending a malicious HTTP POST request to the victim. Successful exploitation of this...