gdiplus.dll in GDI+ in Microsoft Internet Explorer 6 SP1 Windows XP SP2 and SP3 Server 2003 SP1 and SP2 Vista Gold and SP1 Server 2008 Office XP SP3 Office 2003 SP2 and SP3 2007 Microsoft Office System Gold and SP1 Visio 2002 SP2 PowerPoint Viewer 2003 Works 8 Digital Image Suite 2006 SQL Server 2000 Reporting Services SP2 SQL Server 2005 SP2 Report Viewer 2005 SP1 and 2008 and Forefront Client Security 1.0 allows remote attackers to execute arbitrary code via a malformed GIF image file containing many extension markers for graphic control extensions and subsequent unknown labels aka \GDI+ GIF Parsing Vulnerability.\


WPGIMP32.FLT in Microsoft Office 2000 SP3 XP SP3 and 2003 SP2; Office Converter Pack; and Works 8 does not properly parse the length of a WordPerfect Graphics (WPG) file which allows remote attackers to execute arbitrary code via a crafted WPG file aka the \WPG Image File Heap Corruption Vulnerability.\


emacs/lisp/progmodes/python.el in Emacs 22.1 and 22.2 imports Python script from the current working directory during editing of a Python file which allows local users to execute arbitrary code via a Trojan horse Python file.


Array index vulnerability in Microsoft Office Excel 2000 SP3 and 2002 SP3 and Office 2004 and 2008 for Mac allows remote attackers to execute arbitrary code via an Excel file with a crafted array index for a FORMAT record aka the \Excel Index Array Vulnerability.\


Unspecified vulnerability in the PDF distiller component in the BlackBerry Attachment Service in BlackBerry Unite! 1.0 SP1 (1.0.1) before bundle 36 and BlackBerry Enterprise Server 4.1 SP3 (4.1.3) through 4.1 SP5 (4.1.5) allows user-assisted remote attackers to execute arbitrary code via a crafted PDF file attachment.


Microsoft Internet Explorer 6 and 7 does not properly determine the domain or security zone of origin of web script which allows remote attackers to bypass the intended cross-domain security policy and execute arbitrary code or obtain sensitive information via a crafted HTML document aka \HTML Element Cross-Domain Vulnerability.\


The Aggregation module 5.x before 5.x-4.4 for Drupal allows remote attackers to upload files with arbitrary extensions and possibly execute arbitrary code via a crafted feed that allows upload of files with arbitrary extensions.


Microsoft Office 2000 SP3 XP SP3 and 2003 SP2; Office Converter Pack; and Works 8 do not properly parse the length of an Encapsulated PostScript (EPS) file which allows remote attackers to execute arbitrary code via a crafted EPS file aka the \Malformed EPS Filter Vulnerability.\


Format string vulnerability in the window_error function in yelp-window.c in yelp in Gnome after 2.19.90 and before 2.24 allows remote attackers to execute arbitrary code via format string specifiers in an invalid URI on the command line as demonstrated by use of yelp within (1) man or (2) ghelp URI handlers in Firefox Evolution and unspecified other programs.


Mozilla Firefox 3.x before 3.0.1 allows remote attackers to inject arbitrary web script into a chrome document via unspecified vectors as demonstrated by injection into a XUL error page. NOTE: this can be leveraged to execute arbitrary code using CVE-2008-2933.


Multiple unspecified vulnerabilities in Sun Java Platform Micro Edition (aka Java ME J2ME or mobile Java) as distributed in Sun Wireless Toolkit 2.5.2 allow remote attackers to execute arbitrary code via unknown vectors. NOTE: as of 20080807 the only disclosure is a vague pre-advisory with no actionable information. However because it is from a company led by a well-known researcher it is being assigned a CVE identifier for tracking purposes.


Microsoft Office 2000 SP3 and XP SP3; Office Converter Pack; and Works 8 do not properly parse the length of a BMP file which allows remote attackers to execute arbitrary code via a crafted BMP file aka the \Malformed BMP Filter Vulnerability.\


Microsoft Windows Media Player 6.4 Windows Media Format Runtime 7.1 through 11 and Windows Media Services 4.1 9 and 2008 do not properly use the Service Principal Name (SPN) identifier when validating replies to authentication requests which allows remote servers to execute arbitrary code via vectors that employ NTLM credential reflection aka \SPN Vulnerability.\


Unrestricted file upload vulnerability in update_profile.php in PHPmotion 2.0 and earlier allows remote authenticated users to execute arbitrary code by uploading a .php file with a content type of (1) image/gif (2) image/jpeg or (3) image/pjpeg then accessing it via a direct request to the file under pictures/.


The Netrw plugin 125 in netrw.vim in Vim 7.2a.10 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames used by the execute and system functions within the (1) mz and (2) mc commands as demonstrated by the netrw.v2 and netrw.v3 test cases. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712.


Microsoft Windows Media Player 6.4 Windows Media Format Runtime 7.1 through 11 and Windows Media Services 4.1 and 9 incorrectly associate ISATAP addresses with the Local Intranet zone which allows remote servers to capture NTLM credentials and execute arbitrary code through credential-reflection attacks by sending an authentication request aka \ISATAP Vulnerability.\


Microsoft Office 2000 SP3 XP SP3 and 2003 SP2; Office Converter Pack; and Works 8 do not properly parse the length of a PICT file which allows remote attackers to execute arbitrary code via a crafted PICT file with an invalid bits_per_pixel field aka the \PICT Filter Parsing Vulnerability \ a different vulnerability than CVE-2008-3018.


Unspecified vulnerability in multiple JustSystems Ichitaro products allows remote attackers to execute arbitrary code via a crafted JTD document as exploited in the wild in August 2008.


The management console in the Volume Manager Scheduler Service (aka VxSchedService.exe) in Symantec Veritas Storage Foundation for Windows (SFW) 5.0 5.0 RP1a and 5.1 accepts NULL NTLMSSP authentication which allows remote attackers to execute arbitrary code via requests to the service socket that create \snapshots schedules\ registry values specifying future command execution. NOTE: this issue exists because of an incomplete fix for CVE-2007-2279.


Microsoft Office Excel 2000 SP3 2002 SP3 and 2003 SP2 and SP3; Office Excel Viewer 2003; and Office 2004 and 2008 for Mac do not properly validate index values for AxesSet records when loading Excel files which allows remote attackers to execute arbitrary code via a crafted Excel file aka the \Excel Indexing Validation Vulnerability.\


Microsoft Internet Explorer 6 and 7 does not properly determine the domain or security zone of origin of web script which allows remote attackers to bypass the intended cross-domain security policy and execute arbitrary code or obtain sensitive information via a crafted HTML document aka \Event Handling Cross-Domain Vulnerability.\


Microsoft Office 2000 SP3 XP SP3 and 2003 SP2; Office Converter Pack; and Works 8 do not properly parse the length of a PICT file which allows remote attackers to execute arbitrary code via a crafted PICT file aka the \Malformed PICT Filter Vulnerability \ a different vulnerability than CVE-2008-3021.


Unrestricted file upload vulnerability in the writeLogEntry function in system/v_cron_proc.php in PHPizabi 0.848b C1 HFP1 when register_globals is enabled allows remote attackers to upload and execute arbitrary code via a filename in the CONFCRON_LOGFILE parameter and file contents in the CONFLOCALE_LONG_DATE_TIME parameter.


Mozilla Firefox before 2.0.0.16 and 3.x before 3.0.1 Thunderbird before 2.0.0.16 and SeaMonkey before 1.1.11 use an incorrect integer data type as a CSS object reference counter in the CSSValue array (aka nsCSSValue:Array) data structure which allows remote attackers to execute arbitrary code via a large number of references to a common CSS object leading to a counter overflow and a free of in-use memory aka ZDI-CAN-349.


Incomplete blacklist vulnerability in javaUpload.php in Postlet in the FileManager module in CMS Made Simple 1.2.4 and earlier allows remote attackers to execute arbitrary code by uploading a file with a name ending in (1) .jsp (2) .php3 (3) .cgi (4) .dhtml (5) .phtml (6) .php5 or (7) .jar then accessing it via a direct request to the file in modules/FileManager/postlet/.


Mozilla Firefox before 2.0.0.15 Thunderbird 2.0.0.14 and earlier and SeaMonkey before 1.1.10 allow remote attackers to execute arbitrary code via an XUL document that includes a script from a chrome: URI that points to a fastload file related to this file's \privilege level.\


Hpufunction.dll 4.0.0.1 in HP Software Update exposes the unsafe (1) ExecuteAsync and (2) Execute methods which allows remote attackers to execute arbitrary code via an absolute pathname in the first argument.


Sun Java Web Start and Java Plug-in for JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allow remote attackers to execute arbitrary code via a crafted jnlp file that modifies the (1) java.home (2) java.ext.dirs or (3) user.home System Properties aka \Java Web Start File Inclusion\ and CR 6694892.


Skype 3.6.0.248 and other versions before 3.8.0.139 uses a case-sensitive comparison when checking for dangerous extensions which allows user-assisted remote attackers to bypass warning dialogs and possibly execute arbitrary code via a file: URI with a dangerous extension that uses a different case.


Unspecified vulnerability in Microsoft Windows Media Player 11 allows remote attackers to execute arbitrary code via a crafted audio-only file that is streamed from a Server-Side Playlist (SSPL) on Windows Media Server aka \Windows Media Player Sampling Rate Vulnerability.\


Unspecified vulnerability in Apple QuickTime Player on Windows XP SP2 and Vista SP1 allows remote attackers to execute arbitrary code via a crafted QuickTime media file. NOTE: as of 20080429 the only disclosure is a vague pre-advisory with no actionable information. However because it is from a well-known researcher it is being assigned a CVE identifier for tracking purposes.


The mozIJSSubScriptLoader.LoadScript function in Mozilla Firefox before 2.0.0.15 Thunderbird 2.0.0.14 and earlier and SeaMonkey before 1.1.10 does not apply XPCNativeWrappers to scripts loaded from (1) file: URIs (2) data: URIs or (3) certain non-canonical chrome: URIs which allows remote attackers to execute arbitrary code via vectors involving third-party add-ons.


webinc/bxe/scripts/loadsave.php in Flux CMS 1.5.0 and earlier allows remote attackers to execute arbitrary code by overwriting a PHP file in webinc/bxe/scripts/ via a filename in the XML parameter and PHP sequences in the request body then making a direct request for this filename.


Unrestricted file upload vulnerability in calendar_admin.asp in Full Revolution aspWebCalendar 2008 allows remote attackers to upload and execute arbitrary code via the FILE1 parameter in an uploadfileprocess action probably followed by a direct request to the file in calendar/eventimages/.


Unspecified vulnerability in VMCI in VMware Workstation 6 before 6.0.4 build 93057 VMware Player 2 before 2.0.4 build 93057 and VMware ACE 2 before 2.0.2 build 93057 on Windows allows guest OS users to execute arbitrary code on the host OS via unspecified vectors.


The Page destructor in Page.cc in libpoppler in Poppler 0.8.4 and earlier deletes a pageWidgets object even if it is not initialized by a Page constructor which allows remote attackers to execute arbitrary code via a crafted PDF document.


Mozilla Firefox before 2.0.0.15 and SeaMonkey before 1.1.10 do not properly implement JAR signing which allows remote attackers to execute arbitrary code via (1) injection of JavaScript into documents within a JAR archive or (2) a JAR archive that uses relative URLs to JavaScript files.


Unrestricted

file

upload

in

the

mcpuk

file

editor

(atk/attributes/fck/editor/filemanager/browser/mcpuk/connectors/php/config.php)

in

Achievo

through

allows

remote

attackers

to

execute

arbitrary

code

by

uploading

a

file

with

.php

followed

by

a

safe

extension

then

accessing

it

via

a

direct

request

to

the

file

in

the

Achievo

root

directory.

NOTE:

this

is

only

a

vulnerability

in

environments

that

support

multiple

extensions

such

as

Apache

with

the

module

enabled.


** DISPUTED ** scripts/wwwacct in cPanel 11.18.6 STABLE and earlier and 11.23.1 CURRENT and earlier allows remote authenticated users with reseller privileges to execute arbitrary code via shell metacharacters in the Email address field (aka Email text box). NOTE: the vendor disputes this stating \I'm unable to reproduce such an issue on multiple servers running different versions of cPanel.\


Emacs 21 and XEmacs automatically load and execute .flc (fast lock) files that are associated with other files that are edited within Emacs which allows user-assisted attackers to execute arbitrary code.


Unspecified vulnerability in sr_feuser_register 1.4.0 1.6.0 2.2.1 to 2.2.7 2.3.0 to 2.3.6 2.4.0 and 2.5.0 to 2.5.9 extension for TYPO3 allows remote attackers to execute arbitrary code and delete arbitrary files via unspecified attack vectors.


Sun Java System Access Manager 6.3 through 7.1 and Sun Java System Identity Server 6.1 and 6.2 do not properly process XSLT stylesheets in XSLT transforms in XML signatures which allows context-dependent attackers to execute arbitrary code via a crafted stylesheet a related issue to CVE-2007-3715 CVE-2007-3716 and CVE-2007-4289.


Microsoft Office Word 2002 SP3 allows remote attackers to execute arbitrary code via a .doc file that contains malformed data as exploited in the wild in July 2008 and as demonstrated by attachement.doc.


Incomplete blacklist vulnerability in CoreTypes in Apple Mac OS X before 10.5.4 allows user-assisted remote attackers to execute arbitrary code via a (1) .xht or (2) .xhtm file which does not trigger a \potentially unsafe\ warning message in (a) the Download Validation feature in Mac OS X 10.4 or (b) the Quarantine feature in Mac OS X 10.5.


The (1) VBScript (VBScript.dll) and (2) JScript (JScript.dll) scripting engines 5.1 and 5.6 as used in Microsoft Windows 2000 SP4 XP SP2 and Server 2003 SP1 and SP2 do not properly decode script which allows remote attackers to execute arbitrary code via unknown vectors.


Microsoft Excel 2000 SP3 through 2003 SP2 Viewer 2003 Compatibility Pack and Office 2004 and 2008 for Mac allows user-assisted remote attackers to execute arbitrary code via malformed tags in rich text aka \Excel Rich Text Validation Vulnerability.\


The Microsoft VFP_OLE_Server ActiveX control allows remote attackers to execute arbitrary code by invoking the foxcommand method.


Unspecified vulnerability in Microsoft Excel 2000 SP3 and Office for Mac 2004 and 2008 allows user-assisted remote attackers to execute arbitrary code via a crafted .SLK file that is not properly handled when importing the file aka \Excel File Import Vulnerability.\


Red Hat Directory Server 7.1 before SP4 uses insecure permissions for certain directories which allows local users to modify JAR files and execute arbitrary code via unknown vectors.


The fortimon.sys device driver in Fortinet FortiClient Host Security 3.0 MR5 Patch 3 and earlier does not properly initialize its DeviceExtension which allows local users to access kernel memory and execute arbitrary code via a crafted request.


The Comment Upload 4.7.x before 4.7.x-0.1 and 5.x before 5.x-0.1 module for Drupal does not properly use functions in the upload module which allows remote attackers to bypass upload validation and upload arbitrary files and possibly execute arbitrary code via unspecified vectors.


Format string vulnerability in the log function in Georgia SoftWorks SSH2 Server (GSW_SSHD) 7.01.0003 and earlier allows remote attackers to execute arbitrary code via format string specifiers in the username field as demonstrated by a certain LoginPassword message.


Format string vulnerability in the ReportSysLogEvent function in the LPD server in cyan soft Opium OPI Server 4.10.1028 and earlier; cyanPrintIP Easy OPI Professional and Basic 4.10.1030 and earlier; Workstation 4.10.836 and earlier; and Standard 4.10.940 and earlier; might allow remote attackers to execute arbitrary code via format string specifiers in the queue name in a request.


The ActiveDataInfo.LaunchProcess method in the SymAData.ActiveDataInfo.1 ActiveX control 2.7.0.1 in SYMADATA.DLL in multiple Symantec Norton products including Norton 360 1.0 AntiVirus 2006 through 2008 Internet Security 2006 through 2008 and System Works 2006 through 2008 does not properly determine the location of the AutoFix Tool which allows remote attackers to execute arbitrary code via a remote (1) WebDAV or (2) SMB share.


The init_request_info function in sapi/cgi/cgi_main.c in PHP before 5.2.6 does not properly consider operator precedence when calculating the length of PATH_TRANSLATED which might allow remote attackers to execute arbitrary code via a crafted URI.


Unspecified vulnerability in Microsoft Office 2000 SP3 Office XP SP3 Office 2003 SP2 and Office 2004 for Mac allows remote attackers to execute arbitrary code via an Office document that contains a malformed object related to a \memory handling error \ aka \Microsoft Office Execution Jump Vulnerability.\


Microsoft DirectX 8.1 through 9.0c and DirectX on Microsoft XP SP2 and SP3 Server 2003 SP1 and SP2 Vista Gold and SP1 and Server 2008 does not properly perform MJPEG error checking which allows remote attackers to execute arbitrary code via a crafted MJPEG stream in a (1) AVI or (2) ASF file aka the \MJPEG Decoder Vulnerability.\


Unspecified vulnerability in Microsoft Excel 2000 SP3 and 2002 SP2 and Office 2004 and 2008 for Mac allows user-assisted remote attackers to execute arbitrary code via crafted conditional formatting values aka \Excel Conditional Formatting Vulnerability.\


fpx.dll 3.9.8.0 in the FlashPix plugin for IrfanView 4.10 allows remote attackers to execute arbitrary code via a crafted FlashPix (.FPX) file which triggers heap corruption. NOTE: some of these details are obtained from third party information.


Red Hat Directory Server 8.0 when running on Red Hat Enterprise Linux uses insecure permissions for the redhat-idm-console script which allows local users to execute arbitrary code by modifying the script.


Unspecified vulnerability in the HP HPeDiag (aka eSupportDiagnostics) ActiveX control in hpediag.dll in HP Software Update 4.000.009.002 and earlier allows remote attackers to execute arbitrary code or obtain sensitive information via unspecified vectors. NOTE: this might overlap CVE-2007-6513.


The NamoInstaller.NamoInstall.1 ActiveX control in NamoInstaller.dll 3.0.0.1 and earlier in Namo Web Editor in Sejoong Namo ActiveSquare 6 allows remote attackers to execute arbitrary code via a URL in the argument to the Install method. NOTE: some of these details are obtained from third party information.


PatchLink Update client for Unix as used by Novell ZENworks Patch Management Update Agent for Linux/Unix/Mac (LUM) 6.2094 through 6.4102 and other products allows local users to (1) truncate arbitrary files via a symlink attack on the /tmp/patchlink.tmp file used by the logtrimmer script and (2) execute arbitrary code via a symlink attack on the /tmp/plshutdown file used by the rebootTask script.


Apple QuickTime before 7.4 allows remote attackers to execute arbitrary code via a movie file containing a Macintosh Resource record with a modified length value in the resource header which triggers heap corruption.


Microsoft Works 6 File Converter as used in Office 2003 SP2 and SP3 Works 8.0 and Works Suite 2005 allows remote attackers to execute arbitrary code via a .wps file with crafted section header index table information aka \Microsoft Works File Converter Index Table Vulnerability.\


Multiple eval injection vulnerabilities in MyBB 1.2.10 and earlier allow remote attackers to execute arbitrary code via the sortby parameter to (1) forumdisplay.php or (2) a results action in search.php.


Microsoft Windows Vista does not properly enforce the NoDriveTypeAutoRun registry value which allows user-assisted remote attackers and possibly physically proximate attackers to execute arbitrary code by inserting a (1) CD-ROM device or (2) U3-enabled USB device containing a filesystem with an Autorun.inf file and possibly other vectors related to (a) AutoRun and (b) AutoPlay actions.


Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2007 Viewer 2003 Compatibility Pack and Office 2004 for Mac allows user-assisted remote attackers to execute arbitrary code via crafted data validation records aka \Excel Data Validation Record Vulnerability.\


Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2003 SP2 Viewer 2003 and Office 2004 for Mac allows user-assisted remote attackers to execute arbitrary code via crafted macros aka \Macro Validation Vulnerability \ a different vulnerability than CVE-2007-3490.


Unrestricted file upload vulnerability in image.php in PHPizabi 0.848b C1 HFP1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension from the event page then accessing it via a direct request to the file in system/cache/pictures.


AppKit in Apple Mac OS X 10.4.11 inadvertently makes an NSApplication mach port available for inter-process communication instead of inter-thread communication which allows local users to execute arbitrary code via crafted messages to privileged applications.


Unrestricted file upload vulnerability in cp_upload_image.php in LightBlog 9.5 allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in the blog's root directory.


Unspecified vulnerability in NetCfgTool in the System Configuration component in Apple Mac OS X 10.4.11 and 10.5.2 allows local users to bypass authorization and execute arbitrary code via crafted distributed objects.


The MP4 demuxer (mp4.c) for VLC media player 0.8.6d and earlier as used in Miro Player 1.1 and earlier allows remote attackers to overwrite arbitrary memory and execute arbitrary code via a malformed MP4 file.


The Disaster Recovery Framework (DRF) master server in Cisco Unified Communications products including Unified Communications Manager (CUCM) 5.x and 6.x Unified Presence 1.x and 6.x Emergency Responder 2.x and Mobility Manager 2.x does not require authentication for requests received from the network which allows remote attackers to execute arbitrary code via unspecified vectors.


The CairoFont::create function in CairoFontEngine.cc in Poppler possibly before 0.8.0 as used in Xpdf Evince ePDFview KWord and other applications does not properly handle embedded fonts in PDF files which allows remote attackers to execute arbitrary code via a crafted font object related to dereferencing a function pointer associated with the type of this font object.


The Bluetooth stack in Microsoft Windows XP SP2 and SP3 and Vista Gold and SP1 allows physically proximate attackers to execute arbitrary code via a large series of Service Discovery Protocol (SDP) packets.


The Event System in Microsoft Windows 2000 SP4 XP SP2 and SP3 Server 2003 SP1 and SP2 Vista Gold and SP1 and Server 2008 does not properly validate per-user subscriptions which allows remote authenticated users to execute arbitrary code via a crafted event subscription request.


Unspecified vulnerability in the ADMIN_SP_C2 procedure in IBM DB2 8 before FP16 9.1 before FP4a and 9.5 before FP1 allows remote authenticated users to execute arbitrary code via unknown vectors. NOTE: the ADMIN_SP_C issue is already covered by CVE-2008-0699.


Windows Explorer in Microsoft Windows Vista up to SP1 and Server 2008 allows user-assisted remote attackers to execute arbitrary code via crafted saved-search (.search-ms) files that are not properly handled when saving aka \Windows Saved Search Vulnerability.\


Array index vulnerability in the Event System in Microsoft Windows 2000 SP4 XP SP2 and SP3 Server 2003 SP1 and SP2 Vista Gold and SP1 and Server 2008 allows remote authenticated users to execute arbitrary code via a crafted event subscription request that is used to access an array of function pointers.


Unspecified vulnerability in Mozilla Firefox before 2.0.0.13 Thunderbird before 2.0.0.13 and SeaMonkey before 1.1.9 allows remote attackers to execute arbitrary code via unknown vectors that cause JavaScript to execute with the wrong principal aka \Privilege escalation via incorrect principals.\


Format string vulnerability in Asterisk Open Source 1.6.x before 1.6.0-beta6 might allow remote attackers to execute arbitrary code via logging messages that are not properly handled by (1) the ast_verbose logging API call or (2) the astman_append function.


Array index vulnerability in Speex 1.1.12 and earlier as used in libfishsound 0.9.0 and earlier including Illiminable DirectShow Filters and Annodex Plugins for Firefox xine-lib before 1.1.12 and many other products allows remote attackers to execute arbitrary code via a header structure containing a negative offset which is used to dereference a function pointer.


Integer signedness error in the xrealloc function (rdesktop.c) in RDesktop 1.5.0 allows remote attackers to execute arbitrary code via unknown parameters that trigger a heap-based overflow. NOTE: the role of the channel_process function was not specified by the original researcher.


MRcgi/MRProcessIncomingForms.pl in Numara FootPrints 8.1 on Linux allows remote attackers to execute arbitrary code via shell metacharacters in the PROJECTNUM parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


The DSM gui_cm_ctrls ActiveX control (gui_cm_ctrls.ocx) as used in multiple CA products including BrightStor ARCServe Backup for Laptops and Desktops r11.5 Desktop Management Suite r11.1 through r11.2 C2; Unicenter r11.1 through r11.2 C2; and Desktop and Server Management r11.1 through r11.2 C2 allows remote attackers to execute arbitrary code via crafted function arguments.


Incomplete blacklist vulnerability in Skype 3.6.0.248 and other versions before 3.8.0.139 allows user-assisted remote attackers to bypass warning dialogs and possibly execute arbitrary code via a file: URI that ends in an executable extension that is not covered by the blacklist.


Double free vulnerability in Web TransferCtrl Class 8 2 1 4 (iManFile.cab) as used in WorkSite Web 8.2 before SP1 P2 allows remote attackers to execute arbitrary code via JavaScript that sets the Server property to a string then sets the string to null.


Argument injection vulnerability in the cai: URI handler in rcplauncher in IBM Lotus Expeditor Client for Desktop 6.1.1 and 6.1.2 as used by Lotus Symphony and possibly other products allows remote attackers to execute arbitrary code by injecting a -launcher option via a cai: URI as demonstrated by a reference to a UNC share pathname.


Unspecified vulnerability in Dokeos 1.8.4 before SP3 allows attackers to execute arbitrary code via unspecified vectors.


Unspecified vulnerability in GNU m4 before 1.4.11 might allow context-dependent attackers to execute arbitrary code related to improper handling of filenames specified with the -F option. NOTE: it is not clear when this issue crosses privilege boundaries.


Incomplete blacklist vulnerability in CoreTypes in Apple Mac OS X before 10.5.3 allows user-assisted remote attackers to execute arbitrary code via an (1) Automator (2) Help (3) Safari or (4) Terminal content type for a downloadable object which does not trigger a \potentially unsafe\ warning message in (a) the Download Validation feature in Mac OS X 10.4 or (b) the Quarantine feature in Mac OS X 10.5.


The (1) SProcRecordCreateContext and (2) SProcRecordRegisterClients functions in the Record extension and the (3) SProcSecurityGenerateAuthorization function in the Security extension in the X server 1.4 in X.Org X11R7.3 allow context-dependent attackers to execute arbitrary code via requests with crafted length values that specify an arbitrary number of bytes to be swapped on the heap which triggers heap corruption.


Microsoft Project 2000 Service Release 1 2002 SP1 and 2003 SP2 allows user-assisted remote attackers to execute arbitrary code via a crafted Project file related to improper validation of \memory resource allocations.\


Unspecified vulnerability in nlnotes.dll in the client in IBM Lotus Notes 6.5 7.0.x before 7.0.2 CCH and 8.0.x before 8.0.1 allows remote attackers to execute arbitrary code via a crafted attachment in an e-mail message sent over SMTP a variant of CVE-2007-6706.


Apple QuickTime before 7.4.5 enables deserialization of QTJava objects by untrusted Java applets which allows remote attackers to execute arbitrary code via a crafted applet.


Unspecified vulnerability in the kernel in Microsoft Windows 2000 SP4 XP SP2 Server 2003 SP1 and SP2 through Vista SP1 and Server 2008 allows local users to execute arbitrary code via unknown vectors related to improper input validation. NOTE: it was later reported that one affected function is NtUserFnOUTSTRING in win32k.sys.


Cisco Show and Share 5(2) 5.2(1) and 5.2(2) before 5.2(2.1) allows remote authenticated users to upload and execute arbitrary code by leveraging video upload privileges aka Bug ID CSCto69857.


The FS_CheckFilenameIsNotExecutable function in qcommon/files.c in the ioQuake3 engine 1.36 and earlier as used in World of Padman Smokin' Guns OpenArena Tremulous and ioUrbanTerror does not properly determine dangerous file extensions which allows remote attackers to execute arbitrary code via a crafted third-party addon that creates a Trojan horse DLL file.


foomatic-rip-hplip in HP Linux Imaging and Printing (HPLIP) 3.11.5 allows remote attackers to execute arbitrary code via a crafted *FoomaticRIPCommandLine field in a .ppd file.


An unspecified ActiveX control in the browser plugin in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5 RealPlayer SP 1.0 through 1.1.5 and RealPlayer Enterprise 2.0 through 2.1.5 allows remote attackers to execute arbitrary code via unknown vectors related to an out-of-bounds condition.


Unspecified vulnerability in Kiwi before 3.74.2 as used in SUSE Studio 1.1 before 1.1.4 allows remote attackers to execute arbitrary code via a crafted archive name in the list of testdrive modified files.


Use-after-free vulnerability in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5 RealPlayer SP 1.0 through 1.1.5 and RealPlayer Enterprise 2.0 through 2.1.5 allows remote attackers to execute arbitrary code via vectors related to a dialog box.


The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect VPN Client) before 2.3.185 on Windows and on Windows Mobile downloads a client executable file (vpndownloader.exe) without verifying its authenticity which allows remote attackers to execute arbitrary code via the url property to a certain ActiveX control in vpnweb.ocx aka Bug ID CSCsy00904.


Unspecified vulnerability in Kiwi before 3.74.2 as used in SUSE Studio 1.1 before 1.1.4 allows remote attackers to execute arbitrary code via a crafted filename in the list of testdrive modified files.


The appendChild function in Mozilla Firefox before 3.6.20 Thunderbird 3.x before 3.1.12 SeaMonkey 2.x and possibly other products does not properly handle DOM objects which allows remote attackers to execute arbitrary code via unspecified vectors that lead to dereferencing of a \dangling pointer.\


EMC RSA Key Manager (RKM) Appliance 2.7 SP1 before 2.7.1.6 when Firefox 4.x or 5.0 is used does not properly terminate a user session upon a logout action which makes it easier for remote attackers to execute arbitrary code by leveraging an unattended workstation.


Unspecified vulnerability on HP NonStop Servers with software H06.x through H06.23.00 and J06.x through J06.12.00 when Samba is used allows remote authenticated users to execute arbitrary code via unknown vectors.


Unspecified vulnerability in ZfHSrvr.exe in Novell ZENworks Handheld Management (ZHM) 7 allows remote attackers to execute arbitrary code via unknown vectors a different vulnerability than CVE-2011-2655.


Unspecified vulnerability in an ActiveX control in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5 RealPlayer SP 1.0 through 1.1.5 and RealPlayer Enterprise 2.0 through 2.1.5 allows remote attackers to execute arbitrary code via unknown vectors.


The Agent service in Iron Mountain Connected Backup 8.4 allows remote attackers to execute arbitrary code via a crafted opcode 13 request that triggers use of the LaunchCompoundFileAnalyzer class to send request data to the System.getRunTime.exec method.


The ISList.ISAvi ActiveX control in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.2 10.3 and 11 SP1 provides access to the mscomct2.ocx file which allows remote attackers to execute arbitrary code by leveraging unspecified mscomct2 flaws.


Use-after-free vulnerability in the AutoUpdate feature in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5 and RealPlayer SP 1.0 through 1.1.5 when an Embedded RealPlayer is used allows remote attackers to execute arbitrary code via unspecified vectors.


libgssapi and libgssglue before 0.4 do not properly check privileges which allows local users to load untrusted configuration files and execute arbitrary code via the GSSAPI_MECH_CONF environment variable as demonstrated using mount.nfs.


ktsuss versions 1.4 and prior spawns the GTK interface to run as root. This can allow a local attacker to escalate privileges to root and use the \GTK_MODULES\ environment variable to possibly execute arbitrary code.


Unspecified vulnerability in Kiwi before 3.74.2 as used in SUSE Studio 1.1 before 1.1.4 allows remote attackers to execute arbitrary code via a filter in a modified file.


The RPC implementation in the server in Novell Cloud Manager 1.1.2 before Patch 3 does not properly initialize objects which allows remote attackers to execute arbitrary code by making RPC calls that leverage incorrect privileges associated with a partially initialized session.


Format string vulnerability in ECTrace.dll in the iMailGateway service in the Internet Mail Gateway in OneBridge Server and DMZ Proxy in Sybase OneBridge Mobile Data Suite 5.5 and 5.6 allows remote attackers to execute arbitrary code via format string specifiers in unspecified string fields related to authentication logging.


The FLV ASSET Xtra component in Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code via unspecified vectors related to an \input validation vulnerability.\


VisiWaveReport.exe in AZO Technologies Inc. VisiWave Site Survey before 2.1.9 allows user-assisted remote attackers to execute arbitrary code via a (1) vws and (2) vwr file with an invalid Type property which triggers an untrusted pointer dereference.


Unspecified vulnerability in ZfHSrvr.exe in Novell ZENworks Handheld Management (ZHM) 7 allows remote attackers to execute arbitrary code via unknown vectors a different vulnerability than CVE-2011-2656.


Adobe Reader and Acrobat 8.x before 8.3 9.x before 9.4.5 and 10.x before 10.1 on Windows and Mac OS X do not properly restrict script which allows attackers to execute arbitrary code via a crafted document related to a \cross document script execution vulnerability.\


Google Picasa before 3.6 Build 105.67 does not properly handle invalid properties in JPEG images which allows remote attackers to execute arbitrary code via a crafted image file.


Google SketchUp before 8 does not properly handle edge geometry in SketchUp (aka .SKP) files which allows remote attackers to execute arbitrary code via a crafted file.


The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect VPN Client) before 2.5.3041 and 3.0.x before 3.0.629 on Linux and Mac OS X downloads a client executable file (vpndownloader.exe) without verifying its authenticity which allows remote attackers to execute arbitrary code via the url property to a Java applet aka Bug ID CSCsy05934.


Unspecified vulnerability in Kiwi before 3.74.2 as used in SUSE Studio 1.1 before 1.1.4 allows remote attackers to execute arbitrary code via a crafted filename for a custom RPM.


The file-blocking feature in EMC Documentum eRoom 7.3.x and 7.4.x before 7.4.3.g does not properly restrict the uploading and opening of files with dangerous file types which allows remote authenticated users to execute arbitrary code via an uploaded file.


foomaticrip.c in foomatic-rip in foomatic-filters in Foomatic 4.0.6 allows remote attackers to execute arbitrary code via a crafted *FoomaticRIPCommandLine field in a .ppd file a different vulnerability than CVE-2011-2697.


Use-after-free vulnerability in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5 RealPlayer SP 1.0 through 1.1.5 and RealPlayer Enterprise 2.0 through 2.1.5 when an Embedded RealPlayer is used allows remote attackers to execute arbitrary code via vectors related to a modal dialog.


Unspecified vulnerability in Google Chrome 11.0.696.65 on Windows 7 SP1 allows remote attackers to execute arbitrary code via unknown vectors. NOTE: as of 20110510 the only disclosure is a vague advisory that possibly relates to multiple vulnerabilities or multiple products. However because it is from a well-known researcher it is being assigned a CVE identifier for tracking purposes.


DVRemoteAx.ax 2.1.0.39 in the DVR Remote ActiveX control allows remote attackers to execute arbitrary code via a crafted DVRobot.dll file in a manifest directory on a web server.


The ioQuake3 engine as used in World of Padman 1.2 and earlier Tremulous 1.1.0 and ioUrbanTerror 2007-12-20 does not check for dangerous file extensions before writing to the quake3 directory which allows remote attackers to execute arbitrary code via a crafted third-party addon that creates a Trojan horse DLL file a different vulnerability than CVE-2011-2764.


Use-after-free vulnerability in the nsHTMLSelectElement function in nsHTMLSelectElement.cpp in Mozilla Firefox 4.x through 8.0 Thunderbird 5.0 through 8.0 and SeaMonkey before 2.6 allows remote attackers to execute arbitrary code via vectors involving removal of the parent node of an element.


The host-services component in Symantec pcAnywhere 12.5.x through 12.5.3 and IT Management Suite pcAnywhere Solution 7.0 (aka 12.5.x) and 7.1 (aka 12.6.x) does not properly filter login and authentication data which allows remote attackers to execute arbitrary code via a crafted session on TCP port 5631.


Use-after-free vulnerability in Mozilla Firefox before 3.6.26 and 4.x through 9.0 Thunderbird before 3.1.18 and 5.0 through 9.0 and SeaMonkey before 2.7 might allow remote attackers to execute arbitrary code via vectors related to incorrect AttributeChildRemoved notifications that affect access to removed nsDOMAttribute child nodes.


Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 R2 and R2 SP1 and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page as exploited in the wild in November 2011 by Duqu aka \TrueType Font Parsing Vulnerability.\


The Matroska format decoder in FFmpeg before 0.8.3 does not properly allocate memory which allows remote attackers to execute arbitrary code via a crafted file.


The is_a function in PHP 5.3.7 and 5.3.8 triggers a call to the __autoload function which makes it easier for remote attackers to execute arbitrary code by providing a crafted URL and leveraging potentially unsafe behavior in certain PEAR packages and custom autoloaders.


The extension subsystem in Google Chrome before 17.0.963.78 does not properly handle history navigation which allows remote attackers to execute arbitrary code by leveraging a \Universal XSS (UXSS)\ issue.


Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 do not properly handle OLE objects in memory which allows remote attackers to execute arbitrary code via a crafted object in a file aka \OLE Property Vulnerability.\


Apple Safari before 5.1.1 on Mac OS X does not enforce an intended policy for file: URLs which allows remote attackers to execute arbitrary code via a crafted web site.


Array index error in Microsoft Publisher 2003 SP3 and 2007 SP2 and SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file that leverages incorrect handling of values in memory aka \Publisher Out-of-bounds Array Index Vulnerability.\


Use-after-free vulnerability in Apple Safari 5.1.2 when a plug-in with a blocking function is installed allows user-assisted remote attackers to execute arbitrary code via a crafted web page that is accessed during user interaction with the plug-in leading to improper coordination between an API call and the plug-in unloading functionality as demonstrated by the Adobe Flash and RealPlayer plug-ins.


Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file that leverages incorrect handling of values in memory aka \Publisher Invalid Pointer Vulnerability.\


Untrusted search path vulnerability in eSignal 10.6.2425.1208 and possibly other versions allows local users and possibly remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse JRS_UT.dll that is located in the same folder as a .quo (QUOTE) file. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


The SSL implementation in Apple Safari before 5.1.1 on Mac OS X before 10.7 accesses uninitialized memory during the processing of X.509 certificates which allows remote web servers to execute arbitrary code via a crafted certificate.


The management.asmx module in the Management Web Service in the Unified Network Control (UNC) Server in CA Total Defense (TD) r12 before SE2 sends a cleartext response to unspecified getDBConfigSettings requests which makes it easier for remote attackers to obtain database credentials and subsequently execute arbitrary code by sniffing the network related to the UNCWS Web Service.


Microsoft Publisher 2003 SP3 and 2007 SP2 and SP3 does not properly manage memory allocations for function pointers which allows user-assisted remote attackers to execute arbitrary code via a crafted Publisher file aka \Publisher Function Pointer Overwrite Vulnerability.\


Double free vulnerability in the vba_read_project_strings function in vba_extract.c in libclamav in ClamAV before 0.97 might allow remote attackers to execute arbitrary code via crafted Visual Basic for Applications (VBA) data in a Microsoft Office document. NOTE: some of these details are obtained from third party information.


Unspecified vulnerability in Microsoft Internet Explorer 8 on Windows 7 allows remote attackers to execute arbitrary code via unknown vectors as demonstrated by Stephen Fewer as the second of three chained vulnerabilities during a Pwn2Own competition at CanSecWest 2011.


The JIT compiler in Microsoft .NET Framework 3.5 Gold and SP1 3.5.1 and 4.0 when IsJITOptimizerDisabled is false does not properly handle expressions related to null strings which allows context-dependent attackers to bypass intended access restrictions and consequently execute arbitrary code in opportunistic circumstances by leveraging a crafted application as demonstrated by (1) a crafted XAML browser application (aka XBAP) (2) a crafted ASP.NET application or (3) a crafted .NET Framework application aka \.NET Framework JIT Optimization Vulnerability.\


The ActiveBar1 ActiveX control in the Data Dynamics ActiveBar ActiveX controls as distributed in ActBar.ocx 1.0.6.5 in IBM Rational System Architect 11.4.0.2 11.4.0.1 and earlier does not properly restrict the SetLayoutData method which allows remote attackers to execute arbitrary code via a crafted Data argument a different vulnerability than CVE-2007-3883. NOTE: some of these details are obtained from third party information.


The web management interface on the Cisco RVS4000 Gigabit Security Router with software 1.x before 1.3.3.4 and 2.x before 2.0.2.7 and the WRVS4400N Gigabit Security Router with software before 2.0.2.1 allows remote attackers to read the backup configuration file and consequently execute arbitrary code via unspecified vectors aka Bug ID CSCtn23871.


tftpserver.exe in HP Intelligent Management Center (IMC) 5.0 before E0101L02 allows remote attackers to execute arbitrary code via a (1) large or (2) invalid opcode field related to a function pointer table.


The Blueberry FlashBack ActiveX control in BB FlashBack Recorder.dll in Blueberry BB FlashBack as used in IBM Rational Rhapsody before 7.6.1 and other products does not properly implement the (1) Start (2) PauseAndSave (3) InsertMarker and (4) InsertSoundToFBRAtMarker methods which allows remote attackers to execute arbitrary code via unspecified vectors.


The Bluetooth Stack 2.1 in Microsoft Windows Vista SP1 and SP2 and Windows 7 Gold and SP1 does not prevent access to objects in memory that (1) were not properly initialized or (2) have been deleted which allows remote attackers to execute arbitrary code via crafted Bluetooth packets aka \Bluetooth Stack Vulnerability.\


Microsoft Excel 2003 SP3 and 2007 SP2; Excel in Office 2007 SP2; Excel 2010 Gold and SP1; Excel in Office 2010 Gold and SP1; Office 2004 2008 and 2011 for Mac; Open XML File Format Converter for Mac; Excel Viewer SP2; Office Compatibility Pack for Word Excel and PowerPoint 2007 File Formats SP2; Excel Services on Office SharePoint Server 2007 SP2; Excel Services on Office SharePoint Server 2010 Gold and SP1; and Excel Web App 2010 Gold and SP1 do not properly parse conditional expressions associated with formatting requirements which allows remote attackers to execute arbitrary code via a crafted spreadsheet aka \Excel Conditional Expression Parsing Vulnerability.\


The DKIM implementation in Exim 4.7x before 4.76 permits matching for DKIM identities to apply to lookup items instead of only strings which allows remote attackers to execute arbitrary code or access a filesystem via a crafted identity.


The Program::getActiveUniformMaxLength function in libGLESv2/Program.cpp in libGLESv2.dll in the WebGLES library in Almost Native Graphics Layer Engine (ANGLE) as used in Mozilla Firefox 4.x before 4.0.1 on Windows and in the GPU process in Google Chrome before 10.0.648.205 on Windows allows remote attackers to execute arbitrary code via unspecified vectors related to an \off-by-three\ error.


Microsoft Excel 2007 SP2; Excel in Office 2007 SP2; Excel Viewer SP2; Office Compatibility Pack for Word Excel and PowerPoint 2007 File Formats SP2; and Excel Services on Office SharePoint Server 2007 SP2 do not properly validate the sign of an unspecified array index which allows remote attackers to execute arbitrary code via a crafted spreadsheet aka \Excel Out of Bounds Array Indexing Vulnerability.\


Microsoft Visio 2003 SP3 and 2007 SP2 does not properly validate objects in memory during Visio file parsing which allows remote attackers to execute arbitrary code via a crafted file aka \Move Around the Block RCE Vulnerability.\


Microsoft Excel 2003 SP3 and 2007 SP2; Excel in Office 2007 SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Excel Viewer SP2; and Office Compatibility Pack for Word Excel and PowerPoint 2007 File Formats SP2 do not properly parse records in Excel spreadsheets which allows remote attackers to execute arbitrary code via a crafted spreadsheet aka \Excel Heap Corruption Vulnerability.\


win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 Windows Server 2003 SP2 Windows Vista SP1 and SP2 Windows Server 2008 Gold SP2 R2 and R2 SP1 and Windows 7 Gold and SP1 on 64-bit platforms does not properly validate pointers during the parsing of OpenType (aka OTF) fonts which allows remote attackers to execute arbitrary code via a crafted font file aka \Win32k OTF Validation Vulnerability.\


The OpenURLInDefaultBrowser method in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.2 and RealPlayer SP 1.0 through 1.1.5 launches a default handler for the filename specified in the first argument which allows remote attackers to execute arbitrary code via a .rnx filename corresponding to a crafted RNX file.


Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold Update 1 Update 2 and SP1 provides the MicrosoftClient.jar file containing a signed Java applet which allows remote attackers to execute arbitrary code on client machines via unspecified vectors aka \Poisoned Cup of Code Execution Vulnerability.\


The SMB client in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP1 and SP2 Windows Server 2008 Gold SP2 R2 and R2 SP1 and Windows 7 Gold and SP1 allows remote SMB servers to execute arbitrary code via a crafted (1) SMBv1 or (2) SMBv2 response aka \SMB Response Parsing Vulnerability.\


The Blueberry FlashBack ActiveX control in BB FlashBack Recorder.dll in Blueberry BB FlashBack as used in IBM Rational Rhapsody before 7.6.1 and other products does not properly implement the InsertMarker method which allows remote attackers to execute arbitrary code via unspecified vectors.


In klibc 1.5.20 and 1.5.21 the DHCP options written by ipconfig to /tmp/net-$DEVICE.conf are not properly escaped. This may allow a remote attacker to send a specially crafted DHCP reply which could execute arbitrary code with the privileges of any process which sources DHCP options.


Google Chrome before 11.0.696.71 does not properly handle blobs which allows remote attackers to execute arbitrary code via unspecified vectors that trigger an out-of-bounds write.


Microsoft .NET Framework 1.0 SP3 1.1 SP1 2.0 SP2 3.5.1 and 4 and Silverlight 4 before 4.0.60831 does not properly restrict inheritance which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP) (2) a crafted ASP.NET application (3) a crafted .NET Framework application or (4) a crafted Silverlight application aka \.NET Framework Class Inheritance Vulnerability.\


Microsoft Office 2007 SP2 and 2010 Gold and SP1 does not initialize an unspecified object pointer during the opening of Word documents which allows remote attackers to execute arbitrary code via a crafted document aka \Office Uninitialized Object Pointer Vulnerability.\


Microsoft Excel 2002 SP3 2003 SP3 and 2007 SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Excel Viewer SP2; and Office Compatibility Pack for Word Excel and PowerPoint 2007 File Formats SP2 do not properly validate record structures during parsing of Excel spreadsheets which allows remote attackers to execute arbitrary code via a crafted spreadsheet aka \Excel Insufficient Record Validation Vulnerability.\


The Windows Messenger ActiveX control in msgsc.dll in Microsoft Windows XP SP2 and SP3 allows remote attackers to execute arbitrary code via unspecified vectors that \corrupt the system state \ aka \Microsoft Windows Messenger ActiveX Control Vulnerability.\


Array index error in Microsoft Excel 2003 SP3 and 2007 SP2; Excel in Office 2007 SP2; Excel 2010 Gold and SP1; Excel in Office 2010 Gold and SP1; Office 2004 2008 and 2011 for Mac; Open XML File Format Converter for Mac; Excel Viewer SP2; and Office Compatibility Pack for Word Excel and PowerPoint 2007 File Formats SP2 allows remote attackers to execute arbitrary code via a crafted spreadsheet aka \Excel Out of Bounds Array Indexing Vulnerability.\


Use-after-free vulnerability in WebKit as used in Apple Safari before 5.0.5; iOS before 4.3.2 for iPhone iPod and iPad; iOS before 4.2.7 for iPhone 4 (CDMA); and possibly other products allows remote attackers to execute arbitrary code by adding children to a WBR tag and then removing the tag related to text nodes as demonstrated by Chaouki Bekrar during a Pwn2Own competition at CanSecWest 2011.


Microsoft Visio 2003 SP3 2007 SP2 and 2010 Gold and SP1 does not properly validate objects in memory during Visio file parsing which allows remote attackers to execute arbitrary code via a crafted file aka \pStream Release RCE Vulnerability.\


Multiple unspecified vulnerabilities in Check Point SSL Network Extender (SNX) SecureWorkSpace and Endpoint Security On-Demand as distributed by SecurePlatform IPSO6 Connectra and VSX allow remote attackers to execute arbitrary code via vectors involving a (1) ActiveX control or (2) Java applet.


The Blueberry FlashBack ActiveX control in BB FlashBack Recorder.dll in Blueberry BB FlashBack as used in IBM Rational Rhapsody before 7.6.1 and other products does not properly implement the TestCompatibilityRecordMode method which allows remote attackers to execute arbitrary code via unspecified vectors.


tftpserver.exe in HP Intelligent Management Center (IMC) 5.0 before E0101L02 allows remote attackers to create or overwrite files and subsequently execute arbitrary code via a crafted WRQ request.


The DNS server in Microsoft Windows Server 2008 SP2 R2 and R2 SP1 does not properly handle NAPTR queries that trigger recursive processing which allows remote attackers to execute arbitrary code via a crafted query aka \DNS NAPTR Query Vulnerability.\


The default configuration of the shell_escape_commands directive in conf/texmf.d/95NonPath.cnf in the tex-common package before 2.08.1 in Debian GNU/Linux squeeze Ubuntu 10.10 and 10.04 LTS and possibly other operating systems lists certain programs which might allow remote attackers to execute arbitrary code via a crafted TeX document.


Microsoft .NET Framework 2.0 SP1 and SP2 3.5 Gold and SP1 3.5.1 and 4.0 and Silverlight 4 before 4.0.60531.0 does not properly validate arguments to unspecified networking API functions which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP) (2) a crafted ASP.NET application (3) a crafted .NET Framework application or (4) a crafted Silverlight application aka \.NET Framework Array Offset Vulnerability.\


Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 do not properly handle speech data which allows remote attackers to execute arbitrary code via unspecified vectors that lead to a \stale pointer.\


The SMB client in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP1 and SP2 Windows Server 2008 Gold SP2 R2 and R2 SP1 and Windows 7 Gold and SP1 allows remote SMB servers to execute arbitrary code via a crafted (1) SMBv1 or (2) SMBv2 response aka \SMB Client Response Parsing Vulnerability.\


Argument injection vulnerability in IBM Lotus Notes 8.0.x before 8.0.2 FP6 and 8.5.x before 8.5.1 FP5 allows remote attackers to execute arbitrary code via a cai:// URL containing a --launcher.library option that specifies a UNC share pathname for a DLL file aka SPR PRAD82YJW2.


The XML-RPC implementation on Cisco TelePresence Recording Server devices with software 1.6.x and 1.7.x before 1.7.1 allows remote attackers to overwrite files and consequently execute arbitrary code via a malformed request aka Bug ID CSCti50739.


Unrestricted file upload vulnerability in the EasyEdit module in Lomtec ActiveWeb Professional 3.0 allows remote attackers to execute arbitrary code by uploading an executable file via the UploadDirectory and Accepted Extensions fields in the getImagefile component of EasyEdit.cfm.


Adobe Reader and Acrobat 10.x before 10.0.1 9.x before 9.4.2 and 8.x before 8.2.6 on Windows and Mac OS X allow remote attackers to execute arbitrary code via crafted JP2K record types in a JPEG2000 image in a PDF file which causes heap corruption a different vulnerability than CVE-2011-0596 CVE-2011-0598 and CVE-2011-0599.


The SVGTextElement.getCharNumAtPosition function in Mozilla Firefox before 3.6.20 and 4.x through 5; Thunderbird 3.x before 3.1.12 and other versions before 6; SeaMonkey 2.x before 2.3; and possibly other products does not properly handle SVG text which allows remote attackers to execute arbitrary code via unspecified vectors that lead to a \dangling pointer.\


Adobe Flash Player before 10.3.181.14 on Windows Mac OS X Linux and Solaris and before 10.3.185.21 on Android allows attackers to execute arbitrary code via unspecified vectors related to a \bounds checking\ issue a different vulnerability than CVE-2011-0624 CVE-2011-0625 and CVE-2011-0626.


Integer signedness error in Microsoft Excel 2002 SP3 2003 SP3 2007 SP2 and 2010; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Excel Viewer SP2; and Office Compatibility Pack for Word Excel and PowerPoint 2007 File Formats SP2 allows remote attackers to execute arbitrary code via an XLS file with a large record size aka \Excel Heap Overflow Vulnerability.\


Unspecified vulnerability in jovgraph.exe in jovgraph in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via a malformed displayWidth option in the arg parameter.


Use-after-free vulnerability in the nsXULCommandDispatcher function in Mozilla Firefox before 3.6.18 Thunderbird before 3.1.11 and SeaMonkey through 2.0.14 allows remote attackers to execute arbitrary code via a crafted XUL document that dequeues the current command updater.


Adobe Flash Player before 10.3.181.14 on Windows Mac OS X Linux and Solaris and before 10.3.185.21 on Android allows attackers to execute arbitrary code via unspecified vectors related to a \bounds checking\ issue a different vulnerability than CVE-2011-0623 CVE-2011-0624 and CVE-2011-0625.


The downloads manager in Opera before 11.01 on Windows does not properly determine the pathname of the filesystem-viewing application which allows user-assisted remote attackers to execute arbitrary code via a crafted web site that hosts an executable file.


Microsoft Excel 2002 SP3 2003 SP3 2007 SP2 and 2010; Office 2004 2008 and 2011 for Mac; Open XML File Format Converter for Mac; and Excel Viewer SP2 do not properly handle errors during the parsing of Office Art records in Excel spreadsheets which allows remote attackers to execute arbitrary code via a malformed object record related to a \stray reference \ aka \Excel Linked List Corruption Vulnerability.\


Untrusted search path vulnerability in ImgBurn.exe in ImgBurn 2.4.0.0 2.5.4.0 and other versions allows local users and possibly remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a CUE file.


Integer underflow in the OLE Automation protocol implementation in VBScript.dll in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP1 and SP2 Windows Server 2008 Gold SP2 R2 and R2 SP1 and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted WMF file aka \OLE Automation Underflow Vulnerability.\


A certain ActiveX control in CSDWebInstaller.ocx in Cisco Secure Desktop (CSD) does not properly verify the signature of an unspecified downloaded program which allows remote attackers to execute arbitrary code by spoofing the CSD installation process a different vulnerability than CVE-2010-0589.


Use-after-free vulnerability in the JSON.stringify method in js3250.dll in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14 and SeaMonkey before 2.0.12 might allow remote attackers to execute arbitrary code via unspecified vectors related to the js_HasOwnProperty function and garbage collection.


RealNetworks RealPlayer 11.0 through 11.1 SP 1.0 through 1.1.5 and 14.0.0 through 14.0.1 and Enterprise 2.0 through 2.1.4 uses predictable names for temporary files which allows remote attackers to conduct cross-domain scripting attacks and execute arbitrary code via the OpenURLinPlayerBrowser function.


The Java Servlet framework on Cisco TelePresence Recording Server devices with software 1.6.x before 1.6.2 and Cisco TelePresence Multipoint Switch (CTMS) devices with software 1.0.x 1.1.x 1.5.x and 1.6.x does not require administrative authentication for unspecified actions which allows remote attackers to execute arbitrary code via a crafted request aka Bug IDs CSCtf42005 and CSCtf42008.


The SMB Server service in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP1 and SP2 Windows Server 2008 Gold SP2 R2 and R2 SP1 and Windows 7 Gold and SP1 does not properly validate fields in SMB requests which allows remote attackers to execute arbitrary code via a malformed request in a (1) SMBv1 or (2) SMBv2 packet aka \SMB Transaction Parsing Vulnerability.\


The OpenType Compact Font Format (CFF) driver in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP1 and SP2 Windows Server 2008 Gold SP2 and R2 and Windows 7 does not properly validate parameter values in OpenType fonts which allows remote attackers to execute arbitrary code via a crafted font aka \OpenType Font Encoded Character Vulnerability.\


Microsoft Excel 2002 SP3 and 2003 SP3 Office 2004 and 2008 for Mac and Open XML File Format Converter for Mac do not properly parse Office Art objects which allows remote attackers to execute arbitrary code via vectors related to a function pointer aka \Excel Dangling Pointer Vulnerability.\


Adobe Reader and Acrobat 10.x before 10.0.1 9.x before 9.4.2 and 8.x before 8.2.6 on Windows and Mac OS X allow remote attackers to execute arbitrary code via a 3D file a different vulnerability than CVE-2011-0591 CVE-2011-0592 CVE-2011-0593 CVE-2011-0595 and CVE-2011-0600.


Unspecified vulnerability in Sybase EAServer 5.x and 6.x before 6.3 ESD#2 as used in Appeon Replication Server Messaging Edition (RSME) and WorkSpace allows remote attackers to install arbitrary web services and execute arbitrary code related to a \design vulnerability.\


Adobe Flash Player before 10.3.181.14 on Windows Mac OS X Linux and Solaris and before 10.3.185.21 on Android allows attackers to execute arbitrary code via unspecified vectors related to a \bounds checking\ issue a different vulnerability than CVE-2011-0623 CVE-2011-0625 and CVE-2011-0626.


The Management Console (webagent.exe) in Cisco Security Agent 5.1 5.2 and 6.0 before 6.0.2.145 allows remote attackers to create arbitrary files and execute arbitrary code via unspecified parameters in a crafted st_upload request.


DCR.sys driver in SecurStar DriveCrypt 5.4 5.3 and earlier allows local users to execute arbitrary code via a crafted argument to the 0x00073800 IOCTL.


Use-after-free vulnerability in the Web Workers implementation in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14 and SeaMonkey before 2.0.12 allows remote attackers to execute arbitrary code via vectors related to a JavaScript Worker and garbage collection.


Use-after-free vulnerability in Microsoft Office XP SP3 Office 2003 SP3 Office 2007 SP2 Office 2004 and 2008 for Mac and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via malformed shape data in the Office drawing file format aka \Microsoft Office Graphic Object Dereferencing Vulnerability.\


HP OpenView Performance Insight Server 5.2 5.3 5.31 5.4 and 5.41 contains a \hidden account\ in the com.trinagy.security.XMLUserManager Java class which allows remote attackers to execute arbitrary code via the doPost method in the com.trinagy.servlet.HelpManagerServlet class.


Topaz Systems SigPlus Pro ActiveX Control 3.95 and possibly other versions before 4.29 allows remote attackers to execute arbitrary code by calling the exposed unsafe (1) SetLogFilePath and (2) SigMessage methods to create arbitrary files with arbitrary content.


The administrative web interface on Cisco TelePresence Recording Server devices with software 1.6.x and Cisco TelePresence Multipoint Switch (CTMS) devices with software 1.0.x 1.1.x 1.5.x and 1.6.x allows remote attackers to create or overwrite arbitrary files and possibly execute arbitrary code via a crafted request aka Bug IDs CSCth85786 and CSCth61065.


DNSAPI.dll in the DNS client in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP1 and SP2 Windows Server 2008 Gold SP2 R2 and R2 SP1 and Windows 7 Gold and SP1 does not properly process DNS queries which allows remote attackers to execute arbitrary code via (1) a crafted LLMNR broadcast query or (2) a crafted application aka \DNS Query Vulnerability.\


The Bitmap parsing component in rt3d.dll in Adobe Reader and Acrobat 10.x before 10.0.1 9.x before 9.4.2 and 8.x before 8.2.6 on Windows and Mac OS X allow remote attackers to execute arbitrary code via a crafted image that causes an invalid pointer calculation related to 4/8-bit RLE compression a different vulnerability than CVE-2011-0596 CVE-2011-0598 and CVE-2011-0602.


crs.exe in the Cell Manager Service in the client in HP Data Protector does not properly validate credentials associated with the hostname domain and username which allows remote attackers to execute arbitrary code by sending unspecified data over TCP related to the webreporting client the applet domain and the java username.


The Java Servlet framework on Cisco TelePresence Multipoint Switch (CTMS) devices with software 1.0.x 1.1.x 1.5.x and 1.6.x does not require administrative authentication for unspecified actions which allows remote attackers to execute arbitrary code via a crafted request aka Bug ID CSCtf01253.


t1lib 5.1.2 and earlier as used in Xpdf before 3.02pl6 teTeX and other products uses an invalid pointer in conjunction with a dereference operation which allows remote attackers to execute arbitrary code via a crafted Type 1 font in a PDF document as demonstrated by testz.2184122398.pdf.


Adobe Flash Player before 10.3.181.14 on Windows Mac OS X Linux and Solaris and before 10.3.185.21 on Android allows attackers to execute arbitrary code via unspecified vectors related to a \bounds checking\ issue a different vulnerability than CVE-2011-0623 CVE-2011-0624 and CVE-2011-0626.


Mozilla Firefox before 3.5.19 and 3.6.x before 3.6.17 and SeaMonkey before 2.0.14 does not properly use nsTreeRange data structures which allows remote attackers to execute arbitrary code via unspecified vectors that lead to a \dangling pointer.\


SBE.dll in the Stream Buffer Engine in Windows Media Player and Windows Media Center in Microsoft Windows XP SP2 and SP3 Windows XP Media Center Edition 2005 SP3 Windows Vista SP1 and SP2 Windows 7 Gold and SP1 and Windows Media Center TV Pack for Windows Vista does not properly parse Digital Video Recording (.dvr-ms) files which allows remote attackers to execute arbitrary code via a crafted file aka \DVR-MS Vulnerability.\


Unspecified vulnerability in Adobe Flash Player 11.1.102.55 on Windows and Mac OS X allows remote attackers to execute arbitrary code via a crafted SWF file as demonstrated by the second of two vulnerabilities exploited by the Intevydis vd_adobe_fp module in VulnDisco Step Ahead (SA). NOTE: as of 20111207 this disclosure has no actionable information. However because the module author is a reliable researcher the issue is being assigned a CVE identifier for tracking purposes.


Best Practical Solutions RT 3.6.x 3.7.x and 3.8.x before 3.8.12 and 4.x before 4.0.6 when the VERPPrefix and VERPDomain options are enabled allows remote attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2011-5092 and CVE-2011-5093.


The bzexe command in bzip2 1.0.5 and earlier generates compressed executables that do not properly handle temporary files during extraction which allows local users to execute arbitrary code by precreating a temporary directory.


CEServer.exe in the CEServer component in the Remote Agent module in InduSoft Web Studio 6.1 and 7.0 does not require authentication which allows remote attackers to execute arbitrary code via vectors related to creation of a file loading a DLL and process control.


Integer underflow in RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a crafted width value in an MPG file.


Unspecified vulnerability in RealNetworks RealPlayer before 15.0.0 and Mac RealPlayer before 12.0.0.1703 allows remote attackers to execute arbitrary code via an invalid codec name.


Unrestricted file upload vulnerability in includes/inline_image_upload.php in AutoSec Tools V-CMS 1.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in temp/.


webvrpcs.exe in Advantech/BroadWin WebAccess allows remote attackers to execute arbitrary code or obtain a security-code value via a long string in an RPC request to TCP port 4592.


Missing escaping of ESSID values in sysconfig of SUSE Linux Enterprise allows attackers controlling an access point to cause execute arbitrary code. Affected releases are sysconfig prior to 0.83.7-2.1.


The IDAPython plugin before 1.5.2.3 in IDA Pro allows user-assisted remote attackers to execute arbitrary code via a crafted IDB file related to improper handling of certain swig_runtime_data files in the current working directory.


IBM Tivoli Netcool/Reporter 2.2 before 2.2.0.8 allows remote attackers to execute arbitrary code via vectors related to an unspecified CGI program used with the Apache HTTP Server.


Unspecified vulnerability in Piwik 1.2 through 1.4 allows remote attackers with the view permission to execute arbitrary code via unknown attack vectors.


The RV30 codec in RealNetworks RealPlayer before 15.0.0 and Mac RealPlayer before 12.0.0.1703 does not initialize an unspecified index value which allows remote attackers to execute arbitrary code via unknown vectors.


The set_mgmt_parameters function in item.py in cobbler before 2.2.2 allows context-dependent attackers to execute arbitrary code via vectors related to the use of the yaml.load function instead of the yaml.safe_load function as demonstrated using Puppet.


The RV10 codec in RealNetworks RealPlayer before 15.0.0 and Mac RealPlayer before 12.0.0.1703 allows remote attackers to execute arbitrary code via a crafted sample height.


in

SilverStripe

before

might

allow

remote

attackers

to

execute

arbitrary

code

via

a

crafted

cookie

in

a

user

comment

submission

which

is

not

properly

handled

when

it

is

deserialized.


The PageListSort function in scripts/pagelist.php in PmWiki 2.x before 2.2.35 allows remote attackers to execute arbitrary code via PHP sequences in a crafted order parameter in a pagelist directive leading to unintended use of the PHP create_function function.


The default configuration of the HP CM8060 Color MFP with Edgeline; Color LaserJet 3xxx 4xxx 5550 9500 CMxxxx CPxxxx and Enterprise CPxxxx; Digital Sender 9200c and 9250c; LaserJet 4xxx 5200 90xx Mxxxx and Pxxxx; and LaserJet Enterprise 500 color M551 600 M4555 MFP and P3015 enables the Remote Firmware Update (RFU) setting which allows remote attackers to execute arbitrary code by using a session on TCP port 9100 to upload a crafted firmware update.


DBServer.exe in HP Data Protector Media Operations 6.11 and earlier allows remote attackers to execute arbitrary code via a crafted request containing a large value in a length field.


Unspecified vulnerability in Adobe Flash Player 11.1.102.55 on Windows and Mac OS X allows remote attackers to execute arbitrary code via a crafted SWF file as demonstrated by the first of two vulnerabilities exploited by the Intevydis vd_adobe_fp module in VulnDisco Step Ahead (SA). NOTE: as of 20111207 this disclosure has no actionable information. However because the module author is a reliable researcher the issue is being assigned a CVE identifier for tracking purposes.


Siemens WinCC flexible 2004 2005 2007 and 2008; WinCC V11 (aka TIA portal); the TP OP MP Comfort Panels and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime allow user-assisted remote attackers to execute arbitrary code via a crafted project file related to the HMI web server and runtime loader.


TimThumb (timthumb.php) before 2.0 does not validate the entire source with the domain white list which allows remote attackers to upload and execute arbitrary code via a URL containing a white-listed domain in the src parameter then accessing it via a direct request to the file in the cache directory as exploited in the wild in August 2011.


The Cook codec in RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via crafted channel data.


Invensys Wonderware HMI Reports 3.42.835.0304 and earlier as used in Ocean Data Systems Dream Report before 4.0 and other products allows user-assisted remote attackers to execute arbitrary code via a malformed file that triggers a \write access violation.\


Unspecified vulnerability in RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a crafted MP4 file.


The GENESIS32 IcoSetServer ActiveX control in ICONICS GENESIS32 9.21 and BizViz 9.21 configures the trusted zone on the basis of user input which allows remote attackers to execute arbitrary code via a crafted web site related to a \Workbench32/WebHMI component SetTrustedZone Policy vulnerability.\


Unrestricted file upload vulnerability in incident_attachments.php in Support Incident Tracker (aka SiT!) 3.65 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in unspecified directory a different program than CVE-2011-3833.


Multiple unrestricted file upload vulnerabilities in the WP Symposium plugin before 11.12.24 for WordPress allow remote attackers to execute arbitrary code by uploading a file with an executable extension using (1) uploadify/upload_admin_avatar.php or (2) uploadify/upload_profile_avatar.php then accessing it via a direct request to the file in an unspecified directory inside the webroot.


Unrestricted file upload vulnerability in inc/swf/swfupload.swf in Dotclear 2.3.1 and 2.4.2 allows remote attackers to execute arbitrary code by uploading a file with an executable PHP extension then accessing it via a direct request to the file in an unspecified directory.


Unrestricted file upload vulnerability in models/importcsv.php in the Fabrik (com_fabrik) component before 2.1.1 for Joomla! allows remote authenticated users with Manager privileges to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in an unspecified directory.


Best Practical Solutions RT 4.x before 4.0.6 does not properly implement the DisallowExecuteCode option which allows remote authenticated users to bypass intended access restrictions and execute arbitrary code by leveraging access to a privileged account a different vulnerability than CVE-2011-4458 and CVE-2011-5092.


Unrestricted file upload vulnerability in QuiXplorer 2.3 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension using the upload action to index.php then accessing it via a direct request to the file in an unspecified directory.


Multiple incomplete blacklist vulnerabilities in the Simple File Upload (mod_simplefileuploadv1.3) module before 1.3.5 for Joomla! allow remote attackers to execute arbitrary code by uploading a file with a (1) php5 (2) php6 or (3) double (e.g. .php.jpg) extension then accessing it via a direct request to the file in images/ as exploited in the wild in January 2012.


Incorrect authorization vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows local users to execute arbitrary code via unspecified vectors.


The av-centerd SOAP service in AlienVault OSSIM before 4.8.0 allows remote attackers to create arbitrary files and execute arbitrary code via a crafted set_file request.


The av-centerd SOAP service in AlienVault OSSIM before 4.8.0 allows remote attackers to execute arbitrary code via a crafted remote_task request related to injecting an ssh public key.


Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to execute arbitrary code via a crafted packet to the CLI channel.


TYPO3 before 4.1.14 4.2.x before 4.2.13 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains an insecure default value of the variable fileDenyPattern which could allow remote attackers to execute arbitrary code on the backend.


Incomplete blacklist vulnerability in Launch Services in Apple Mac OS X 10.5.8 allows user-assisted remote attackers to execute arbitrary code via a .fileloc file which does not trigger a \potentially unsafe\ warning message in the Quarantine feature.


Incomplete blacklist vulnerability in SuiteCRM 7.2.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension.


Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.0.7 allows remote attackers to execute arbitrary code by uploading a crafted .htaccess file in an import.zip file and accessing an uploaded PHP file.


Off-by-one error in the ReadBlobString function in blob.c in ImageMagick before 6.3.5-9 allows context-dependent attackers to execute arbitrary code via a crafted image file which triggers the writing of a '\\0' character to an out-of-bounds address.


Off-by-one error in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8f allows remote attackers to execute arbitrary code via unspecified vectors.


Off-by-one error in ClamAV before 0.92 allows remote attackers to execute arbitrary code via a crafted MS-ZIP compressed CAB file.


Off-by-one error in IOAcceleratorFamily in Apple OS X through 10.10.2 allows attackers to execute arbitrary code in a privileged context via a crafted app.


udp.c in the Linux kernel before 4.5 allows remote attackers to execute arbitrary code via UDP traffic that triggers an unsafe second checksum calculation during execution of a recv system call with the MSG_PEEK flag.


A certain ActiveX control in BaiduBar.dll in Baidu Soba Search Bar 5.4 allows remote attackers to execute arbitrary code via a request containing \a link to download and a file to execute \ possibly involving remote file inclusion.


IBM Cloud Pak System 2.3 and 2.3.0.1 could allow a remote attacker to upload arbitrary files which could allow the attacker to execute arbitrary code on the vulnerable server. IBM X-Force ID: 158280.


IBM Cloud Pak System 2.3 could allow a local privileged attacker to upload arbitrary files. By intercepting the request and modifying the file extention the attacker could execute arbitrary code on the server. IBM X-Force ID: 191705.


NetApp Clustered Data ONTAP 8.3.x before 8.3.2P12 allows remote authenticated users to execute arbitrary code on the storage controller via unspecified vectors.


PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to execute arbitrary code via shell metacharacters in an unspecified context.


Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.


Type confusion in V8 in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.


Type confusion in V8 in Google Chrome prior to 61.0.3163.79 for Mac Windows and Linux and 61.0.3163.81 for Android allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.


Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux Windows and Mac and 59.0.3071.92 for Android allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.


Type confusion in V8 in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.


Insufficient data validation in developer tools in Google Chrome on OS X prior to 74.0.3729.108 allowed a local attacker to execute arbitrary code via a crafted string copied to clipboard.


Insufficient data validation in V8 builtins string generator could lead to out of bounds read and write access in V8 in Google Chrome prior to 62.0.3202.94 and allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.


Insufficient data validation in developer tools in Google Chrome prior to 81.0.4044.92 allowed a remote attacker who had convinced the user to use devtools to execute arbitrary code via a crafted HTML page.


IBM Db2 for Linux UNIX and Windows (includes Db2 Connect Server) 9.7 10.1 10.5 11.1 and 11.5 could allow a local user to execute arbitrary code and conduct DLL hijacking attacks.


IBM DB2 for Linux UNIX and Windows (includes DB2 Connect Server) 9.7 10 1 10.5 and 11.1 could allow a local user to execute arbitrary code and conduct DLL hijacking attacks. IBM X-Force ID: 140209.


IBM DB2 for Linux UNIX and Windows (includes DB2 Connect Server) 9.7 10.1 10.5 and 11.1 could allow a local user to execute arbitrary code due to a format string error. IBM X-Force ID: 143023.


The default configuration of xterm on Debian GNU/Linux sid and possibly Ubuntu enables the allowWindowOps resource which allows user-assisted attackers to execute arbitrary code or have unspecified other impact via escape sequences.


The default configuration of glot-www through 2018-05-19 allows remote attackers to execute arbitrary code because glot-code-runner supports os.system within a \python\ \files\ \content\ JSON file.


The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.11 and 4.0.x before 4.0.9 allows remote authenticated users to execute arbitrary code via unspecified vectors aka Ref ID 35249.


The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.11 and 4.0.x before 4.0.9 allows remote authenticated users to execute arbitrary code via unspecified vectors aka Ref ID 34896.


The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.12 4.0.x before 4.0.10 and 4.1.x before 4.1.4 allows remote attackers to execute arbitrary code via unspecified vectors aka Ref ID 36983.


On D-Link DIR-823G devices ExportSettings.sh upload_settings.cgi GetDownLoadSyslog.sh and upload_firmware.cgi do not require authentication which allows remote attackers to execute arbitrary code.


Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to an untrusted pointer dereference which may allow an attacker to execute arbitrary code and cause the application to crash.


Secure Elements Class 5 AVR (aka C5 EVM) before 2.8.1 do not validate the source address of a message which allows remote attackers to (1) execute arbitrary code on a client or (2) forge messages to the server.


XML external entity (XXE) vulnerability in the RSSDashlet dashlet in SugarCRM before 6.5.17 allows remote attackers to read arbitrary files or potentially execute arbitrary code via a crafted DTD in an XML request.


Unrestricted File Upload in ShowDoc v2.9.5 allows remote attackers to execute arbitrary code via the 'file_url' parameter in the component AdminUpdateController.class.php'.


Unrestricted

File

Upload

in

JEECG

and

earlier

allows

remote

attackers

to

execute

arbitrary

code

or

gain

privileges

by

uploading

a

crafted

file

to

the

component

\jeecgFormDemoController.do?commonUpload\.


Unrestricted File Upload in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the component 'admin/upload_file_do.php'.


Unrestricted File Upload in Bludit v3.8.1 allows remote attackers to execute arbitrary code by uploading malicious files via the component 'bl-kereln/ajax/upload-logo.php'.


Adobe Flash Media Server (FMS) 3.0.x before 3.0.7 3.5.x before 3.5.5 and 4.0.x before 4.0.1 allows attackers to execute arbitrary code via unspecified vectors related to a \segmentation fault vulnerability.\


Adobe Flash Media Server (FMS) before 3.0.6 and 3.5.x before 3.5.4 allows attackers to execute arbitrary code via unspecified vectors related to a \JS method vulnerability.\


Adobe Flash Player before 10.0.42.34 and Adobe AIR before 1.5.3 might allow attackers to execute arbitrary code via unspecified vectors related to a \data injection vulnerability.\


Adobe Flash Player before 18.0.0.255 and 19.x before 19.0.0.226 on Windows and OS X and before 11.2.202.540 on Linux allows attackers to execute arbitrary code by leveraging an unspecified \type confusion \ a different vulnerability than CVE-2015-7647.


Adobe Flash Player before 18.0.0.255 and 19.x before 19.0.0.226 on Windows and OS X and before 11.2.202.540 on Linux allows attackers to execute arbitrary code by leveraging an unspecified \type confusion \ a different vulnerability than CVE-2015-7648.


Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code by leveraging an unspecified \type confusion.\


Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code by leveraging an unspecified \type confusion.\


Macromedia Flash Player before 6.0.65.0 allows remote attackers to execute arbitrary code via certain malformed data headers in Shockwave Flash file format (SWF) files a different issue than CAN-2002-0846.


Adobe Flash Player before 10.3.183.10 on Windows Mac OS X Linux and Solaris and before 10.3.186.7 on Android allows remote attackers to execute arbitrary code via crafted streaming media related to a \logic error vulnerability.\


A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker thus allowing the attacker to execute arbitrary code.


A flaw was found in RPC request using gfs2_create_req in glusterfs server. An authenticated attacker could use this flaw to create arbitrary files and execute arbitrary code on glusterfs server nodes.


A flaw was found in RPC request using gfs3_mknod_req supported by glusterfs server. An authenticated attacker could use this flaw to write files to an arbitrary location via path traversal and execute arbitrary code on a glusterfs server node.


Double free vulnerability in the DefaultICCintents function in cmscnvrt.c in liblcms2 in Little CMS 2.x before 2.6 allows remote attackers to execute arbitrary code via a malformed ICC profile that triggers an error in the default intent handler.


Double free vulnerability in Microsoft Outlook 2007 SP3 and 2010 SP1 and SP2 allows remote attackers to execute arbitrary code by including many nested S/MIME certificates in an e-mail message aka \Message Certificate Vulnerability.\


Double free vulnerability in the NFS component in Apple Mac OS X 10.4 through 10.4.10 allows remote authenticated users to execute arbitrary code via a crafted AUTH_UNIX RPC packet.


Double free vulnerability in the Widget Library (libxfcegui4) in Xfce before 4.4.2 might allow remote attackers to execute arbitrary code via unknown vectors related to the \cliend id program name and working directory in session management.\


Double free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.


Double free vulnerability in SAP Crystal Reports allows remote attackers to execute arbitrary code via crafted connection string record in an RPT file.


Double free vulnerability in Microsoft Word 2002 SP3 allows remote attackers to execute arbitrary code via a Word document with crafted List Format Override (LFO) records aka \Word Pointer Vulnerability.\


Double free vulnerability in the IMAP server component in GroupWise Internet Agent (GWIA) in Novell GroupWise before 8.02HP allows remote attackers to execute arbitrary code via a large parameter in a LIST command.


Double free vulnerability in the krb5_rd_cred function for MIT Kerberos 5 (krb5) 1.3.1 and earlier may allow local users to execute arbitrary code.


Double free vulnerability in dtlogin in CDE on Solaris HP-UX and other operating systems allows remote attackers to execute arbitrary code via a crafted XDMCP packet.


Double free vulnerability in Adobe Flash Player before 13.0.0.264 and 14.x through 16.x before 16.0.0.296 on Windows and OS X and before 11.2.202.440 on Linux allows attackers to execute arbitrary code via unspecified vectors.


Double free vulnerability in isode.eddy in Isode M-Vault Server 11.3 allows remote attackers to execute arbitrary code via a crafted LDAP request as demonstrated by ProtoVer Sample LDAP.


Double free vulnerability in Microsoft Silverlight 4 before 4.1.10329 on Windows allows remote attackers to execute arbitrary code via vectors involving crafted XAML glyphs aka \Silverlight Double-Free Vulnerability.\


Double free vulnerability in GreenBrowser before 6.0.1002 when the keyword search bar (F6) is activated allows remote attackers to execute arbitrary code via a crafted iframe.


Double free vulnerability in the SplDoublyLinkedList::offsetSet function in ext/spl/spl_dllist.c in PHP 7.x before 7.0.6 allows remote attackers to execute arbitrary code via a crafted index.


Double free vulnerability in the ICEP dissector in Ethereal before 0.10.11 may allow remote attackers to execute arbitrary code.


Double free vulnerability in the krb5_recvauth function in MIT Kerberos 5 (krb5) 1.4.1 and earlier allows remote attackers to execute arbitrary code via certain error conditions.


Double free vulnerability in the XML parser in Trillian before 3.1.12.0 allows remote attackers to execute arbitrary code via a crafted XML expression related to the \IMG SRC ID.\


Intel Graphics Driver in Apple OS X before 10.9.4 does not properly restrict an unspecified OpenGL API call which allows attackers to execute arbitrary code via a crafted application.


Libnotify in Apple iOS before 8 and Apple TV before 7 lacks proper bounds checking on write operations which allows attackers to execute arbitrary code as root via a crafted application.


IOHIDFamily in Apple iOS before 8.1.3 Apple OS X before 10.10.2 and Apple TV before 7.0.3 does not properly validate resource-queue metadata which allows attackers to execute arbitrary code in a privileged context via a crafted app.


MobileStorageMounter in Apple iOS before 9.2 and tvOS before 9.1 mishandles the timing of trust-cache loading which allows attackers to execute arbitrary code in a privileged context via a crafted app.


AppleMobileFileIntegrity in Apple iOS before 9.2 and tvOS before 9.1 does not prevent changes to access-control structures which allows attackers to execute arbitrary code in a privileged context via a crafted app.


dyld in Apple iOS before 9.2 and tvOS before 9.1 mishandles segment validation which allows attackers to execute arbitrary code in a privileged context via a crafted app.


dyld in Apple iOS before 9.2 tvOS before 9.1 and watchOS before 2.1 mishandles segment validation which allows attackers to execute arbitrary code in a privileged context via a crafted app.


CFURL in Apple iOS before 8.3 and Apple OS X before 10.10.3 does not properly validate URLs which allows remote attackers to execute arbitrary code via a crafted web site.


IOSurface in Apple iOS before 8.2 Apple OS X through 10.10.2 and Apple TV before 7.1 allows attackers to execute arbitrary code in a privileged context via a crafted app that leverages \type confusion\ during serialized-object handling.


AppleMobileFileIntegrity in Apple iOS before 10 and OS X before 10.12 mishandles process entitlement and Team ID values in the task port inheritance policy which allows attackers to execute arbitrary code in a privileged context via a crafted app.


WebKit in Apple iOS before 10 tvOS before 10 iTunes before 12.5.1 on Windows and Safari before 10 mishandles error prototypes which allows remote attackers to execute arbitrary code via a crafted web site.


Installer in Apple Mac OS X before 10.8.5 provides an option to continue a package's installation after encountering a revoked certificate which might allow user-assisted remote attackers to execute arbitrary code via a crafted package.


Dictionary in Apple Mac OS X 10.5.8 allows remote attackers to create arbitrary files with any contents and thereby execute arbitrary code via crafted JavaScript related to a \design issue.\


Mail in Apple Mac OS X 10.3.9 and 10.4.6 allows remote attackers to execute arbitrary code via an enriched text e-mail message with \invalid color information\ that causes Mail to allocate and initialize arbitrary classes.


WebKit in Apple Mac OS X 10.3.x through 10.3.9 and 10.4 through 10.4.8 allows remote attackers to execute arbitrary code via a crafted HTML file which accesses previously deallocated objects.


Foundation in Apple Mac OS X 10.4.11 might allow context-dependent attackers to execute arbitrary code via a malformed selector name to the NSSelectorFromString API which causes an \unexpected selector\ to be used.


WindowServer in Apple OS X through 10.9.2 does not prevent session creation by a sandboxed application which allows attackers to bypass the sandbox protection mechanism and execute arbitrary code via a crafted application.


Bluetooth in Apple OS X before 10.9.5 does not properly validate API calls which allows attackers to execute arbitrary code in a privileged context via a crafted application.


CoreStorage in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context via a crafted app.


CFNetwork in Apple Safari before 5.0.6 on Windows allows remote web servers to execute arbitrary code by replaying the NTLM credentials of a client user related to a \credential reflection\ issue.


WebKit in Apple Safari before 4.0 does not prevent remote loading of local Java applets which allows remote attackers to execute arbitrary code gain privileges or obtain sensitive information via an APPLET or OBJECT element.


WebKit in Apple Safari before 5.0.6 has improper libxslt security settings which allows remote attackers to create arbitrary files and consequently execute arbitrary code via a crafted web site. NOTE: this may overlap CVE-2011-1425.


WebKit in Google Chrome before 25.0.1364.160 allows remote attackers to execute arbitrary code via vectors that leverage \type confusion.\


stmkfont in HP-UX B.11.00 through B.11.23 relies on the user-specified PATH when executing certain commands which allows local users to execute arbitrary code by modifying the PATH environment variable to point to malicious programs.


LaunchServices in Mac OS X 10.3.4 and 10.2.8 automatically registers and executes new applications which could allow attackers to execute arbitrary code without warning the user.


COM+ in Microsoft Windows does not properly \create and use memory structures \ which allows local users or remote attackers to execute arbitrary code.


WordPad in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly parse fields in Word documents which allows remote attackers to execute arbitrary code via a crafted .doc file aka \WordPad Converter Parsing Vulnerability.\


Array index error in the virtio_load function in hw/virtio/virtio.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm image.


Array index error in the XFree86-Misc extension in X.Org Xserver before 1.4.1 allows context-dependent attackers to execute arbitrary code via a PassMessage request containing a large array index.


Array index error in IOAcceleratorFamily in Apple OS X before 10.9.4 allows attackers to execute arbitrary code via a crafted application.


Array index error in Adobe Reader and Acrobat 8.x before 8.2.5 and 9.x before 9.4 on Mac OS X allows attackers to execute arbitrary code via unspecified vectors.


Array index error in RealNetworks RealPlayer 11.0 through 11.1 and RealPlayer SP 1.0 through 1.0.1 allows remote attackers to execute arbitrary code via malformed sample data in a RealMedia .IVR file related to a \malformed IVR pointer index\ issue.


Array index error in Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64 and Adobe AIR before 2.0.2.12610 might allow attackers to execute arbitrary code via unspecified \types of Adobe Flash code.\


Array index error in RealNetworks RealPlayer 11.0 through 11.1 on Windows allows remote attackers to execute arbitrary code via a malformed header in a RealMedia .IVR file.


Array index error in Adobe Reader and Acrobat 9.x before 9.2 8.x before 8.1.7 and possibly 7.x through 7.1.4 might allow attackers to execute arbitrary code via unspecified vectors.


Array index error in Adobe Shockwave Player before 11.5.2.602 allows remote attackers to execute arbitrary code via crafted Shockwave content on a web site. NOTE: some of these details are obtained from third party information.


Array index error in smal_decode_segment function in LibRaw before 0.17.1 allows context-dependent attackers to cause memory errors and possibly execute arbitrary code via vectors related to indexes.


Array index error in tetrinet.c in gtetrinet 0.7.8 and earlier allows remote attackers to execute arbitrary code via a packet specifying a negative number of players which is used as an array index.


Array index error in 3S CODESYS Gateway-Server before 2.3.9.27 allows remote attackers to execute arbitrary code via a crafted packet.


Array index error in Adobe Shockwave Player before 11.6.8.638 allows attackers to execute arbitrary code via unspecified vectors.


Array index error in the xrdp_bitmap_def_proc function in xrdp/funcs.c in xrdp 0.4.1 and earlier allows remote attackers to execute arbitrary code via vectors that manipulate the value of the edit_pos structure member.


Array index error in VLC media player 0.9.2 allows remote attackers to overwrite arbitrary memory and execute arbitrary code via an XSPF playlist file with a negative identifier tag which passes a signed comparison.


Array index error in pax in Apple Mac OS X 10.5.2 allows context-dependent attackers to execute arbitrary code via an archive with a crafted length value.


Array index error in the sdpplin_parse function in input/libreal/sdpplin.c in xine-lib 1.1.10.1 allows remote RTSP servers to execute arbitrary code via a large streamid SDP parameter.


Array index error in libmpdemux/demux_mov.c in MPlayer 1.0 rc2 and earlier might allow remote attackers to execute arbitrary code via a QuickTime MOV file with a crafted stsc atom tag.


Array index error in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before HP3 allows remote attackers to execute arbitrary code via a crafted yearly RRULE variable in a VCALENDAR attachment in an e-mail message.


Array index error in the RV30 codec in RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via unspecified vectors.