Use-after-free

vulnerability

in

the

mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap

function

in

Mozilla

Firefox

before

Firefox

ESR

before

and

Thunderbird

allows

remote

attackers

to

execute

arbitrary

code

via

bidirectional

text.


Captive Network Assistant in Apple OS X before 10.11.5 mishandles a custom URL scheme which allows user-assisted remote attackers to execute arbitrary code via unspecified vectors.


Double free vulnerability in Adobe Reader and Acrobat before 11.0.14 Acrobat and Acrobat Reader DC Classic before 15.006.30119 and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allows attackers to execute arbitrary code via a crafted Graphics State dictionary.


Use-after-free

vulnerability

in

Adobe

Reader

and

Acrobat

before

Acrobat

and

Acrobat

Reader

DC

Classic

before

and

Acrobat

and

Acrobat

Reader

DC

Continuous

before

on

Windows

and

OS

X

allows

attackers

to

execute

arbitrary

code

via

unspecified

vectors

a

different

vulnerability

than

and


Use-after-free vulnerability in the LoadVars.decode function in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-1011 CVE-2016-1013 CVE-2016-1016 and CVE-2016-1031.


Cisco WebEx Meetings Player T29.10 when WRF file support is enabled allows remote attackers to execute arbitrary code via a crafted file aka Bug ID CSCva09375.


HPE Network Automation 9.22 through 9.22.02 and 10.x before 10.00.02 allows remote attackers to execute arbitrary code or obtain sensitive information via unspecified vectors a different vulnerability than CVE-2016-1988.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-1011 CVE-2016-1016 CVE-2016-1017 and CVE-2016-1031.


The extractTree function in unADF allows remote attackers to execute arbitrary code via shell metacharacters in a directory name in an adf file.


Untrusted search path vulnerability in Snort 2.9.7.0-WIN32 allows remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse tcapi.dll that is located in the same folder on a remote file share as a pcap file that is being processed.


Untrusted search path vulnerability in the installer for TrueCrypt 7.2 and 7.1a VeraCrypt before 1.17-BETA and possibly other products allows local users to execute arbitrary code with administrator privileges and conduct DLL hijacking attacks via a Trojan horse DLL in the \application directory\ as demonstrated with the USP10.dll RichEd20.dll NTMarta.dll and SRClient.dll DLLs.


Use-after-free vulnerability in the Transform object implementation in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via a flash.geom.Matrix callback a different vulnerability than CVE-2016-1011 CVE-2016-1013 CVE-2016-1017 and CVE-2016-1031.


The API in Cisco Prime Infrastructure 1.2 through 3.0 and Evolved Programmable Network Manager (EPNM) 1.2 allows remote attackers to execute arbitrary code or obtain sensitive management information via a crafted HTTP request as demonstrated by discovering managed-device credentials aka Bug ID CSCuy10231.


Use-after-free vulnerability in the nsHTMLDocument::SetBody function in dom/html/nsHTMLDocument.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code by leveraging mishandling of a root element aka ZDI-CAN-3574.


HPE Network Automation 9.22 through 9.22.02 and 10.x before 10.00.02 allows remote attackers to execute arbitrary code or obtain sensitive information via unspecified vectors a different vulnerability than CVE-2016-1989.


Cisco Prime Infrastructure 1.2.0 through 2.2(2) and Cisco Evolved Programmable Network Manager (EPNM) 1.2 allow remote attackers to execute arbitrary code via crafted deserialized data in an HTTP POST request aka Bug ID CSCuw03192.


Cisco Prime Infrastructure 3.0 allows remote authenticated users to execute arbitrary code via a crafted HTTP request that is mishandled during viewing of a log file aka Bug ID CSCuw81494.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-1011 CVE-2016-1013 CVE-2016-1016 and CVE-2016-1017.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux Adobe AIR before 21.0.0.176 Adobe AIR SDK before 21.0.0.176 and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-0987 CVE-2016-0988 CVE-2016-0990 CVE-2016-0991 CVE-2016-0994 CVE-2016-0995 CVE-2016-0996 CVE-2016-0997 CVE-2016-0998 and CVE-2016-0999.


Unrestricted

file

upload

vulnerability

in

the

Settings_Vtiger_CompanyDetailsSave_Action

class

in

in

Vtiger

CRM

allows

remote

authenticated

users

to

execute

arbitrary

code

by

uploading

a

crafted

image

file

with

an

executable

extension

then

accessing

it

via

a

direct

request

to

the

file

in

test/logo/.

NOTE:

this

vulnerability

exists

because

of

an

incomplete

fix

for


The web-based management interface on Cisco RV110W devices with firmware before 1.2.1.7 RV130W devices with firmware before 1.0.3.16 and RV215W devices with firmware before 1.3.0.8 allows remote attackers to execute arbitrary code as root via a crafted HTTP request aka Bug ID CSCux82428.


Use-after-free

vulnerability

in

Adobe

Reader

and

Acrobat

before

Acrobat

and

Acrobat

Reader

DC

Classic

before

and

Acrobat

and

Acrobat

Reader

DC

Continuous

before

on

Windows

and

OS

X

allows

attackers

to

execute

arbitrary

code

via

unspecified

vectors

a

different

vulnerability

than

and


Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code by overriding NetConnection object properties to leverage an unspecified \type confusion \ a different vulnerability than CVE-2016-1019.


Crash Reporter in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context via a crafted app.


Use-after-free vulnerability in the mozilla::DataChannelConnection::Close function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code by leveraging mishandling of WebRTC data-channel connections.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-1013 CVE-2016-1016 CVE-2016-1017 and CVE-2016-1031.


OpenCV 3.0.0 has a double free issue that allows attackers to execute arbitrary code.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux Adobe AIR before 21.0.0.176 Adobe AIR SDK before 21.0.0.176 and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-0988 CVE-2016-0990 CVE-2016-0991 CVE-2016-0994 CVE-2016-0995 CVE-2016-0996 CVE-2016-0997 CVE-2016-0998 CVE-2016-0999 and CVE-2016-1000.


Multiple incomplete blacklist vulnerabilities in Apache Sentry before 1.7.0 allow remote authenticated users to execute arbitrary code via the (1) reflect (2) reflect2 or (3) java_method Hive builtin functions.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux Adobe AIR before 20.0.0.260 Adobe AIR SDK before 20.0.0.260 and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-0973 CVE-2016-0974 CVE-2016-0975 CVE-2016-0982 and CVE-2016-0984.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux Adobe AIR before 21.0.0.176 Adobe AIR SDK before 21.0.0.176 and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-0987 CVE-2016-0988 CVE-2016-0990 CVE-2016-0991 CVE-2016-0994 CVE-2016-0995 CVE-2016-0996 CVE-2016-0998 CVE-2016-0999 and CVE-2016-1000.


Double free vulnerability in Adobe Reader and Acrobat before 11.0.14 Acrobat and Acrobat Reader DC Classic before 15.006.30119 and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allows attackers to execute arbitrary code via a crafted ExtGState dictionary.


Windows Reader in Microsoft Windows 8.1 Windows Server 2012 Gold and R2 and Windows 10 allows remote attackers to execute arbitrary code via a crafted Reader file aka \Microsoft Windows Reader Vulnerability.\


Apache Struts 2.x before 2.3.28 allows remote attackers to execute arbitrary code via a \%{}\ sequence in a tag attribute aka forced double OGNL evaluation.


Use-after-free vulnerability in GDI in Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted document aka \Direct3D Use After Free Vulnerability.\


Use-after-free vulnerability in the setInterval method in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux Adobe AIR before 21.0.0.176 Adobe AIR SDK before 21.0.0.176 and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via crafted arguments a different vulnerability than CVE-2016-0987 CVE-2016-0988 CVE-2016-0990 CVE-2016-0991 CVE-2016-0994 CVE-2016-0995 CVE-2016-0997 CVE-2016-0998 CVE-2016-0999 and CVE-2016-1000.


GDI in Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted document aka \Windows Graphics Component RCE Vulnerability.\


Use-after-free vulnerability in AGM.dll in Adobe Reader and Acrobat before 11.0.14 Acrobat and Acrobat Reader DC Classic before 15.006.30119 and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allows attackers to execute arbitrary code via a multiple-layer PDF document a different vulnerability than CVE-2016-0932 CVE-2016-0937 CVE-2016-0940 and CVE-2016-0941.


The EjbObjectInputStream class in Apache TomEE before 1.7.4 and 7.x before 7.0.0-M3 allows remote attackers to execute arbitrary code via a crafted serialized object.


The expansion of '\\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine.


IBM Financial Transaction Manager (FTM) for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013 Financial Transaction Manager (FTM) for Check Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013 and Financial Transaction Manager (FTM) for Corporate Payment Services (CPS) for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013 allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object. IBM X-Force ID: 111084.


The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by opening a JRMP listener.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux Adobe AIR before 20.0.0.260 Adobe AIR SDK before 20.0.0.260 and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-0973 CVE-2016-0974 CVE-2016-0975 CVE-2016-0983 and CVE-2016-0984.


Use-after-free vulnerability in the URLRequest object implementation in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux Adobe AIR before 20.0.0.260 Adobe AIR SDK before 20.0.0.260 and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via a URLLoader.load call a different vulnerability than CVE-2016-0974 CVE-2016-0975 CVE-2016-0982 CVE-2016-0983 and CVE-2016-0984.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux Adobe AIR before 21.0.0.176 Adobe AIR SDK before 21.0.0.176 and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code by using the actionCallMethod opcode with crafted arguments a different vulnerability than CVE-2016-0987 CVE-2016-0988 CVE-2016-0990 CVE-2016-0991 CVE-2016-0995 CVE-2016-0996 CVE-2016-0997 CVE-2016-0998 CVE-2016-0999 and CVE-2016-1000.


The Windows font library in Microsoft Office 2010 SP2 Word 2010 SP2 Word Automation Services on SharePoint Server 2010 SP2 and Office Web Apps 2010 SP2 allows remote attackers to execute arbitrary code via a crafted embedded font aka \Microsoft Office Graphics RCE Vulnerability.\


The Adobe Type Manager Library in Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted OpenType font aka \OpenType Font Parsing Vulnerability.\


Use-after-free vulnerability in the Doc object implementation in Adobe Reader and Acrobat before 11.0.14 Acrobat and Acrobat Reader DC Classic before 15.006.30119 and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-0934 CVE-2016-0937 CVE-2016-0940 and CVE-2016-0941.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux Adobe AIR before 21.0.0.176 Adobe AIR SDK before 21.0.0.176 and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-0987 CVE-2016-0988 CVE-2016-0991 CVE-2016-0994 CVE-2016-0995 CVE-2016-0996 CVE-2016-0997 CVE-2016-0998 CVE-2016-0999 and CVE-2016-1000.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux Adobe AIR before 21.0.0.176 Adobe AIR SDK before 21.0.0.176 and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-0987 CVE-2016-0990 CVE-2016-0991 CVE-2016-0994 CVE-2016-0995 CVE-2016-0996 CVE-2016-0997 CVE-2016-0998 CVE-2016-0999 and CVE-2016-1000.


The SMB service in EMC VNXe (VNXe3200 Operating Environment prior to 3.1.5.8711957 and VNXe3100/3150/3300 Operating Environment prior to 2.4.4.22638) VNX1 File OE before 7.1.80.3 VNX2 File OE before 8.1.9.155 and Celerra (all supported versions) does not prevent duplicate NTLM challenge-response nonces which makes it easier for remote attackers to execute arbitrary code or read or write to files via a series of authentication requests a related issue to CVE-2010-0231.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux Adobe AIR before 20.0.0.260 Adobe AIR SDK before 20.0.0.260 and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-0973 CVE-2016-0974 CVE-2016-0975 CVE-2016-0982 and CVE-2016-0983.


Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file related to XStream and groovy.util.Expando.


Use-after-free vulnerability in the instanceof function in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux Adobe AIR before 20.0.0.260 Adobe AIR SDK before 20.0.0.260 and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code by leveraging improper reference handling a different vulnerability than CVE-2016-0973 CVE-2016-0974 CVE-2016-0982 CVE-2016-0983 and CVE-2016-0984.


The

com.ibm.rmi.io.SunSerializableFactory

class

in

IBM

SDK

Java

Technology

Edition

before

before

before

before

and

before

does

not

properly

deserialize

classes

in

an

AccessController

doPrivileged

block

which

allows

remote

attackers

to

bypass

a

sandbox

protection

mechanism

and

execute

arbitrary

code

as

demonstrated

by

the

readValue

method

of

the

com.ibm.rmi.io.ValueHandlerPool.ValueHandlerSingleton

class

which

implements

the

javax.rmi.CORBA.ValueHandler

interface.

NOTE:

this

vulnerability

exists

because

of

an

incomplete

fix

for


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux Adobe AIR before 21.0.0.176 Adobe AIR SDK before 21.0.0.176 and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-0987 CVE-2016-0988 CVE-2016-0990 CVE-2016-0991 CVE-2016-0994 CVE-2016-0995 CVE-2016-0996 CVE-2016-0997 CVE-2016-0999 and CVE-2016-1000.


Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.14 Acrobat and Acrobat Reader DC Classic before 15.006.30119 and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-0932 CVE-2016-0934 CVE-2016-0937 and CVE-2016-0941.


Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux Adobe AIR before 20.0.0.260 Adobe AIR SDK before 20.0.0.260 and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code by leveraging an unspecified \type confusion.\


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux Adobe AIR before 20.0.0.260 Adobe AIR SDK before 20.0.0.260 and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-0973 CVE-2016-0975 CVE-2016-0982 CVE-2016-0983 and CVE-2016-0984.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux Adobe AIR before 21.0.0.176 Adobe AIR SDK before 21.0.0.176 and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-0987 CVE-2016-0988 CVE-2016-0990 CVE-2016-0991 CVE-2016-0994 CVE-2016-0995 CVE-2016-0996 CVE-2016-0997 CVE-2016-0998 and CVE-2016-1000.


Use-after-free vulnerability in the Search object implementation in Adobe Reader and Acrobat before 11.0.14 Acrobat and Acrobat Reader DC Classic before 15.006.30119 and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-0932 CVE-2016-0934 CVE-2016-0937 and CVE-2016-0940.


Use-after-free vulnerability in the OCG object implementation in Adobe Reader and Acrobat before 11.0.14 Acrobat and Acrobat Reader DC Classic before 15.006.30119 and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-0932 CVE-2016-0934 CVE-2016-0940 and CVE-2016-0941.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux Adobe AIR before 21.0.0.176 Adobe AIR SDK before 21.0.0.176 and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-0987 CVE-2016-0988 CVE-2016-0990 CVE-2016-0991 CVE-2016-0994 CVE-2016-0996 CVE-2016-0997 CVE-2016-0998 CVE-2016-0999 and CVE-2016-1000.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux Adobe AIR before 21.0.0.176 Adobe AIR SDK before 21.0.0.176 and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-0987 CVE-2016-0988 CVE-2016-0990 CVE-2016-0994 CVE-2016-0995 CVE-2016-0996 CVE-2016-0997 CVE-2016-0998 CVE-2016-0999 and CVE-2016-1000.


The session-persistence implementation in Apache Tomcat 6.x before 6.0.45 7.x before 7.0.68 8.x before 8.0.31 and 9.x before 9.0.0.M2 mishandles session attributes which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session.


BeanShell (bsh) before 2.0b6 when included on the classpath by an application that uses Java serialization or XStream allows remote attackers to execute arbitrary code via crafted serialized data related to XThis.Handler.


HPE Data Protector before 7.03_108 8.x before 8.15 and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified vectors aka ZDI-CAN-3354.


org.springframework.core.serializer.DefaultDeserializer

in

Spring

AMQP

before

allows

remote

attackers

to

execute

arbitrary

code.


The Broadcom Wi-Fi driver for Android as used by BlackBerry smartphones before Build AAE570 allows remote attackers to execute arbitrary code in the context of the kernel.


HPE Data Protector before 7.03_108 8.x before 8.15 and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified vectors aka ZDI-CAN-3353.


HPE Data Protector before 7.03_108 8.x before 8.15 and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified vectors.


MCollective 2.7.0 and 2.8.x before 2.8.9 as used in Puppet Enterprise allows remote attackers to execute arbitrary code via vectors related to the mco ping command.


HPE Data Protector before 7.03_108 8.x before 8.15 and 9.x before 9.06 allow remote attackers to execute arbitrary code via unspecified vectors related to lack of authentication. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2623.


Multiple vulnerabilities exists in Aruba Instate before 4.1.3.0 and 4.2.3.1 due to insufficient validation of user-supplied input and insufficient checking of parameters which could allow a malicious user to bypass security restrictions obtain sensitive information perform unauthorized actions and execute arbitrary code.


IAB.exe in Rockwell Automation Integrated Architecture Builder (IAB) before 9.6.0.8 and 9.7.x before 9.7.0.2 allows remote attackers to execute arbitrary code via a crafted project file.


HPE Data Protector before 7.03_108 8.x before 8.15 and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified vectors aka ZDI-CAN-3352.


Exponent CMS 2.x before 2.3.7 Patch 3 allows remote attackers to execute arbitrary code via the sc parameter to install/index.php.


The PooledInvokerServlet in JBoss EAP 4.x and 5.x allows remote attackers to execute arbitrary code via a crafted serialized payload.


The Windows font library in Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Office 2007 SP3 Office 2010 SP2 Word Viewer Skype for Business 2016 Lync 2013 SP1 Lync 2010 Lync 2010 Attendee and Live Meeting 2007 Console allows remote attackers to execute arbitrary code via a crafted embedded font aka \Windows Graphics Component RCE Vulnerability \ a different vulnerability than CVE-2016-3303.


Apache Struts 2.3.19 to 2.3.20.2 2.3.21 to 2.3.24.1 and 2.3.25 to 2.3.28 when Dynamic Method Invocation is enabled allow remote attackers to execute arbitrary code via method: prefix related to chained expressions.


Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted git ext:: URL when cloning a subrepository.


Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold 1511 and 1607 allows remote attackers to execute arbitrary code via a crafted web site aka \Windows Graphics Component RCE Vulnerability.\


web2py before 2.14.2 allows remote attackers to obtain the session_cookie_key value via a direct request to examples/simple_examples/status. NOTE: this issue can be leveraged by remote attackers to execute arbitrary code using CVE-2016-3957.


The (1) EPHEMERAL (2) HTTPS (3) MVG (4) MSL (5) TEXT (6) SHOW (7) WIN and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image aka \ImageTragick.\


Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository.


The Windows font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold 1511 and 1607; Office 2007 SP3; Office 2010 SP2; Word Viewer; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Lync 2010 Attendee; and Live Meeting 2007 Console allows remote attackers to execute arbitrary code via a crafted embedded font aka \Windows Graphics Component RCE Vulnerability.\


The VGA module in QEMU improperly performs bounds checking on banked access to video memory which allows local guest OS administrators to execute arbitrary code on the host by changing access modes after setting the bank register aka the \Dark Portal\ issue.


The backend/Login/load/ script in Shopware before 5.1.5 allows remote attackers to execute arbitrary code.


The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository name.


The TextParseUtil.translateVariables method in Apache Struts 2.x before 2.3.20 allows remote attackers to execute arbitrary code via a crafted OGNL expression with ANTLR tooling.


The sample web application in web2py before 2.14.2 might allow remote attackers to execute arbitrary code via vectors involving use of a hardcoded encryption key when calling the session.connect function.


XSLTResult in Apache Struts 2.x before 2.3.20.2 2.3.24.x before 2.3.24.2 and 2.3.28.x before 2.3.28.1 allows remote attackers to execute arbitrary code via the stylesheet location parameter.


The secure_load function in gluon/utils.py in web2py before 2.14.2 uses pickle.loads to deserialize session information stored in cookies which might allow remote attackers to execute arbitrary code by leveraging knowledge of encryption_key.


The Windows font library in Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Office 2007 SP3 Office 2010 SP2 Word Viewer Skype for Business 2016 Lync 2013 SP1 Lync 2010 Lync 2010 Attendee and Live Meeting 2007 Console allows remote attackers to execute arbitrary code via a crafted embedded font aka \Windows Graphics Component RCE Vulnerability \ a different vulnerability than CVE-2016-3304.


The server in Red Hat JBoss Operations Network (JON) before 3.3.6 allows remote attackers to execute arbitrary code via a crafted HTTP request related to message deserialization.


The binary delta decoder in Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a (1) clone (2) push or (3) pull command related to (a) a list sizing rounding error and (b) short records.


Barco ClickShare CSC-1 devices with firmware before 01.09.03 and CSM-1 devices with firmware before 01.06.02 allow remote attackers to execute arbitrary code via unspecified vectors.


Conscrypt in Android 4.x before 4.4.4 5.0.x before 5.0.2 5.1.x before 5.1.1 and 6.x before 2016-08-05 does not properly identify session reuse which allows remote attackers to execute arbitrary code via unspecified vectors aka internal bug 28751153.


Apache Struts 2.3.19 to 2.3.20.2 2.3.21 to 2.3.24.1 and 2.3.25 to 2.3.28 when Dynamic Method Invocation is enabled allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.


Internet Explorer 5.01 5.5 and 6 allows remote attackers to spoof a less restrictive security zone and execute arbitrary code via an HTML page containing URLs that contain hostnames that have been double hex encoded which are decoded twice to generate a malicious hostname aka the \URL Decoding Zone Spoofing Vulnerability.\


Firefox before 1.0.2 allows remote attackers to execute arbitrary code by tricking a user into saving a page as a Firefox sidebar panel then using the sidebar panel to inject Javascript into a privileged page.


GIF file validation error in MSN Messenger 6.2 allows remote attackers in a user's contact list to execute arbitrary code via a GIF image with an improper height and width.


The OLE component in Windows 98 2000 XP and Server 2003 and Exchange Server 5.0 through 2003 does not properly validate the lengths of messages for certain OLE data which allows remote attackers to execute arbitrary code aka the \Input Validation Vulnerability.\


The Server Message Block (SMB) implementation for Windows NT 4.0 2000 XP and Server 2003 does not properly validate certain SMB packets which allows remote attackers to execute arbitrary code via Transaction responses containing (1) Trans or (2) Trans2 commands aka the \Server Message Block Vulnerability \ and as demonstrated using Trans2 FIND_FIRST2 responses with large file name length fields.


The SimpleXMLRPCServer library module in Python 2.2 2.3 before 2.3.5 and 2.4 when used by XML-RPC servers that use the register_instance method to register an object without a _dispatch method allows remote attackers to read or modify globals of the associated module and possibly execute arbitrary code via dotted attributes.


VMware before 4.5.2.8848-r5 searches for gdk-pixbuf shared libraries using a path that includes the rrdharan world-writable temporary directory which allows local users to execute arbitrary code.


The Plugin Finder Service (PFS) in Firefox before 1.0.3 allows remote attackers to execute arbitrary code via a javascript: URL in the PLUGINSPAGE attribute of an EMBED tag.


The alsa-lib package in Red Hat Linux 4 disables stack protection for the libasound.so library which makes it easier for attackers to execute arbitrary code if there are other vulnerabilities in the library.


Windows 2000 XP and Server 2003 does not properly \validate the use of memory regions\ for COM structured storage files which allows attackers to execute arbitrary code aka the \COM Structured Storage Vulnerability.\


Internet Explorer 5.01 5.5 and 6 allows remote attackers to execute arbitrary code via drag and drop events aka the \Drag-and-Drop Vulnerability.\


Kommander in KDE 3.2 through KDE 3.4.0 executes data files without confirmation from the user which allows remote attackers to execute arbitrary code.


The document processing application used by the Windows Shell in Microsoft Windows 2000 Windows XP and Windows Server 2003 allows remote attackers to execute arbitrary code by modifying the CLSID stored in a file so that it is processed by HTML Application Host (MSHTA) as demonstrated using a Microsoft Word document.


Firefox before 1.0 allows the user to store a (1) javascript: or (2) data: URLs as a Livefeed bookmark then executes it in the security context of the currently loaded page when the user later accesses the bookmark which could allow remote attackers to execute arbitrary code.


Unknown vulnerability in PaX from the September 2003 release to 2.2 before 2005.03.05 related to SEGMEXEC or RANDEXEC and VMA mirroring allows local users and possibly remote attackers to bypass intended access restrictions and execute arbitrary code.


Internet Explorer 5.01 5.5 and 6 does not properly validate certain URLs in Channel Definition Format (CDF) files which allows remote attackers to obtain sensitive information or execute arbitrary code aka the \Channel Definition Format (CDF) Cross Domain Vulnerability.\


Carsten's 3D Engine (Ca3DE) March 2004 version and earlier allows remote attackers to execute arbitrary code via text strings that are not null terminated which triggers a null dereference.


Multiple symlink vulnerabilities in portupgrade before 20041226_2 in FreeBSD allow local users to (1) overwrite arbitrary files and possibly replace packages to execute arbitrary code via pkg_fetch (2) overwrite arbitrary files via temporary files when portupgrade upgrades a port or package or (3) create arbitrary zero-byte files via the pkgdb.fixme temporary file.


ColorSync on Mac OS X 10.3.7 and 10.3.8 allows attackers to execute arbitrary code via malformed ICC color profiles that modify the heap.


The (1) stopserver.sh and (2) startserver.sh scripts in Adobe Version Cue on Mac OS X uses the current working directory to find and execute the productname.sh script which allows local users to execute arbitrary code by copying and calling the scripts from a user-controlled directory.


The filecopy function in misc.c in Clam AntiVirus (ClamAV) before 0.85 on Mac OS allows remote attackers to execute arbitrary code via a virus in a filename that contains shell metacharacters which are not properly handled when HFS permissions prevent the file from being deleted and ditto is invoked.


The favicon functionality in Firefox before 1.0.3 and Mozilla Suite before 1.7.7 allows remote attackers to execute arbitrary code via a <LINK rel=\icon\> tag with a javascript: URL in the href attribute aka \Firelinking.\


users.ini.php in BoastMachine 3.0 does not properly restrict the types of files that can be uploaded which allows remote attackers to execute arbitrary code.


Microsoft Agent allows remote attackers to spoof trusted Internet content and execute arbitrary code by disguising security prompts on a malicious Web page.


Cheetah 0.9.15 and 0.9.16 searches the /tmp directory for modules before using the paths in the PYTHONPATH variable which allows local users to execute arbitrary code via a malicious module in /tmp/.


Firefox before 1.0.3 and Mozilla Suite before 1.7.7 when blocking a popup allows remote attackers to execute arbitrary code via a javascript: URL that is executed when the user selects the \Show javascript\ option.


Format string vulnerability in the logPrintBadfile function in delbadfiles.c Iron Bars SHell (ibsh) before 0.3d allows users to \access files outside the home directory\ and possibly execute arbitrary code via certain inputs that are not properly handled in a syslog call.


SilverCity before 0.9.5-r1 installs (1) cgi-styler-form.py (2) cgi-styler.py and (3) source2html.py with read and write world permissions which allows local users to execute arbitrary code.


VCNative for Adobe Version Cue 1.0 and 1.0.1 as used in Creative Suite 1.0 and 1.3 and when running on Mac OS X with Version Cue Workspace allows local users to load arbitrary libraries and execute arbitrary code via the -lib command line argument.


The Client Service for NetWare (CSNW) on Microsoft Windows 2000 SP4 XP SP1 and Sp2 and Server 2003 SP1 and earlier allows remote attackers to execute arbitrary code due to an \unchecked buffer\ when processing certain crafted network messages.


Exponent CMS 0.96.3 and later versions performs a chmod on uploaded files to give them execute permissions which allows remote attackers to execute arbitrary code.


Multiple format string vulnerabilities in logging functions in mod_auth_pgsql before 2.0.3 when used for user authentication against a PostgreSQL database allows remote unauthenticated attackers to execute arbitrary code as demonstrated via the username.


Multiple format string vulnerabilities in Scorched 3D 39.1 (bf) and earlier allow remote attackers to execute arbitrary code via various (1) GLConsole::addLine (2) ServerCommon::sendString (3) ServerCommon::serverLog functions and possibly other unspecified vectors.


Opera before 8.51 on Linux and Unix systems allows remote attackers to execute arbitrary code via shell metacharacters (backticks) in a URL that another product provides in a command line argument when launching Opera.


Multiple eval injection vulnerabilities in the help function in PHPKIT 1.6.1 R2 and earlier when register_globals is enabled allow remote attackers to execute arbitrary code on the server via unknown attack vectors involving uninitialized variables.


Format string vulnerability in RARLAB WinRAR 2.90 through 3.50 allows remote attackers to execute arbitrary code via format string specifiers in a UUE/XXE file which are not properly handled when WinRAR displays diagnostic errors related to an invalid filename.


libungif library before 4.1.0 allows attackers to corrupt memory and possibly execute arbitrary code via a crafted GIF file that leads to an out-of-bounds write.


The AxWebRemoveCtrl ActiveX control for uninstalling the SunnComm MediaMax DRM allows remote attackers to download and execute arbitrary code a similar vulnerability to CVE-2005-3650.


The LPD service in HP-UX 10.20 11.11 (11i) and earlier allows remote attackers to execute arbitrary code via shell metacharacters (\`\ or single backquote) in a request that is not properly handled when an error occurs as demonstrated by killing the connection a different vulnerability than CVE-2002-1473.


Stream.cc in Xpdf as used in products such as gpdf kpdf pdftohtml poppler teTeX CUPS libextractor and others allows attackers to modify memory and possibly execute arbitrary code via a DCTDecode stream with (1) a large \number of components\ value that is not checked by DCTStream::readBaselineSOF or DCTStream::readProgressiveSOF (2) a large \Huffman table index\ value that is not checked by DCTStream::readHuffmanTables and (3) certain uses of the scanInfo.numComps value by DCTStream::readScanInfo.


The Saxon XSLT parser in Google Mini Search Appliance and possibly Google Search Appliance allows remote attackers to obtain sensitive information and execute arbitrary code via dangerous Java class methods in select attribute of xsl:value-of tags in XSLT style sheets such as (1) system-property (2) sys:getProperty and (3) run:exec.


Unknown vulnerability in iodbcadmintool in the ODBC Administrator utility in Mac OS X and OS X Server 10.3.9 and 10.4.3 allows local users to execute arbitrary code via unknown attack vectors.


Avi Alkalay man-cgi script allows remote attackers to execute arbitrary code via shell metacharacters in the topic parameter.


The CodeSupport.ocx ActiveX control as used by Sony to uninstall the First4Internet XCP DRM has \safe for scripting\ enabled which allows remote attackers to execute arbitrary code by calling vulnerable functions such as RebootMachine IsAdministrator and ExecuteCode.


The startup script in packages/RedHat/ntop.init in ntop before 3.2 when ntop.conf is writable by users besides root creates temporary files insecurely which allows remote attackers to execute arbitrary code.


Multiple PHP file include vulnerabilities in ezUpload 2.2 allow remote attackers to execute arbitrary code via the path parameter to (1) initialize.php (2) customize.php (3) form.php or (4) index.php.


The Java extensions for QuickTime 6.52 and earlier in Apple Mac OS X 10.3.9 allow untrusted applets to call arbitrary functions in system libraries which allows remote attackers to execute arbitrary code.


config.inc.php in ATutor 1.5.1 and possibly earlier versions uses an incomplete blacklist to check for dangerous file extensions which allows authenticated administrators or educators to execute arbitrary code by uploading files with other executable extensions such as .inc .php4 or others.


Multiple design errors in Microsoft Internet Explorer 5.01 5.5 and 6 allow user-assisted attackers to execute arbitrary code by (1) overlaying a malicious new window above a file download box then (2) using a keyboard shortcut and delaying the display of the file download box until the user hits a shortcut that activates the \Run\ button aka \File Download Dialog Box Manipulation Vulnerability.\


traceroute in Sun Solaris 10 on x86 systems allows local users to execute arbitrary code with PRIV_NET_RAWACCESS privileges via (1) a large number of -g arguments or (2) a malformed -s argument with a trailing . (dot).


AOL Client Software 9.0 uses insecure permissions for its installation path which allows local users to execute arbitrary code with SYSTEM privileges by replacing ACSD.exe with a malicious program.


pnmtopng in netpbm before 10.25 when using the -trans option uses uninitialized size and index variables when converting Portable Anymap (PNM) images to Portable Network Graphics (PNG) which might allow attackers to execute arbitrary code by modifying the stack.


gorum/prod.php in Zorum 3.5 allows remote attackers to execute arbitrary code via shell metacharacters in the argv parameter.


Oracle Forms 4.5 through 10g starts form executables from arbitrary directories and executes them as the Oracle or System user which allows attackers to execute arbitrary code by uploading a malicious .fmx file and referencing it using an absolute pathname argument in the (1) form or (2) module parameters to f90servlet.


Apple QuickTime before 7.0.3 allows user-assisted attackers to overwrite memory and execute arbitrary code via a crafted PICT file that triggers an overflow during expansion.


Firefox before 1.0.5 and Mozilla before 1.7.9 does not properly clone base objects which allows remote attackers to execute arbitrary code by navigating the prototype chain to reach a privileged object.


The dispallclosed2 function in dispallclosed.pl for multiple USANet Creations products including (1) USANet Shopping Mall Software (2) Domain Name Auction Software (3) Standard Classified Ads Software and (4) MakeBid Reverse Auction allows remote attackers to execute arbitrary code via shell metacharacters in the DISPCLOSED parameter.


The history (revision control) function in TWiki 02-Sep-2004 and earlier allows remote attackers to execute arbitrary code via shell metacharacters as demonstrated via the rev parameter to TWikiUsers.


A design error in Opera 8.01 and earlier allows user-assisted attackers to execute arbitrary code by overlaying a malicious new window above a file download dialog box then tricking the user into double-clicking on the \Run\ button aka \link hijacking\.


Format string vulnerability in the Java user interface service (bpjava-msvc) daemon for VERITAS NetBackup Data and Business Center 4.5FP and 4.5MP and NetBackup Enterprise/Server/Client 5.0 5.1 and 6.0 allows remote attackers to execute arbitrary code via the COMMAND_LOGON_TO_MSERVER command.


Safari in WebKit in Mac OS X 10.4 to 10.4.2 directly accesses URLs within PDF files without the normal security checks which allows remote attackers to execute arbitrary code via links in a PDF file.


Macromedia Flash 6 and 7 (Flash.ocx) allows remote attackers to execute arbitrary code via a SWF file with a modified frame type identifier that is used as an out-of-bounds array index to a function pointer.


Format string vulnerability in input_cdda.c in xine-lib 1-beta through 1-beta 3 1-rc 1.0 through 1.0.2 and 1.1.1 allows remote servers to execute arbitrary code via format string specifiers in metadata in CDDB server responses when the victim plays a CD.


Firefox 1.0.3 and 1.0.4 and Netscape 8.0.2 allows remote attackers to execute arbitrary code by tricking the user into using the \Set As Wallpaper\ (in Firefox) or \Set as Background\ (in Netscape) context menu on an image URL that is really a javascript: URL with an eval statement aka \Firewalling.\


Firefox before 1.0.5 allows remote attackers to steal information and possibly execute arbitrary code by using standalone applications such as Flash and QuickTime to open a javascript: URL which is run in the context of the previous page and may lead to code execution if the standalone application loads a privileged chrome: URL.


Web View in Windows Explorer on Microsoft Windows 2000 SP4 XP SP1 and SP2 and Server 2003 does not properly handle certain HTML characters in preview fields which allows remote user-assisted attackers to execute arbitrary code.


Format string vulnerability in the SMTP service in IMail Server 8.20 in Ipswitch Collaboration Suite (ICS) before 2.02 allows remote attackers to execute arbitrary code via format string specifiers to the (1) EXPN (2) MAIL (3) MAIL FROM and (4) RCPT TO commands.


upload_img_cgi.php in Simple PHP Blog (SPHPBlog) does not properly restrict file extensions of uploaded files which could allow remote attackers to execute arbitrary code.


doping.php in ePing plugin 1.02 and earlier for e107 portal allows remote attackers to execute arbitrary code or overwrite files via (1) shell metacharacters in the eping_count parameter or (2) restricted shell metacharacters such as \>\ and \&\ in the eping_host parameter which is not handled by the validation function.


cvsbug in CVS 1.12.12 and earlier creates temporary files insecurely which allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack.


Raritan Dominion SX (DSX) Console Servers DSX16 DSX32 DSX4 DSX8 and DSXA-48 set (1) world-readable permissions for /etc/shadow and (2) world-writable permissions for /bin/busybox which allows local users to obtain hashed passwords or execute arbitrary code as other users.


Multiple untrusted search path vulnerabilities in SUSE Linux 9.3 and 10.0 and possibly other distributions cause the working directory to be added to LD_LIBRARY_PATH which might allow local users to execute arbitrary code via (1) beagle (2) tomboy or (3) blam. NOTE: in August 2007 the tomboy vector was reported for other distributions.


scponlyc in scponly 4.1 and earlier when the operating system supports LD_PRELOAD mechanisms allows local users to execute arbitrary code with root privileges by creating a chroot directory in their home directory hard linking to a system setuid application and using a modified LD_PRELOAD to modify expected function calls in the setuid application.


The Windows Graphical Device Interface library (GDI32.DLL) in Microsoft Windows allows remote attackers to execute arbitrary code via a Windows Metafile (WMF) format image with a crafted SETABORTPROC GDI Escape function call related to the Windows Picture and Fax Viewer (SHIMGVW.DLL) a different vulnerability than CVE-2005-2123 and CVE-2005-2124 and as originally discovered in the wild on unionseek.com.


** UNVERIFIABLE PRERELEASE ** NOTE: this issue describes a problem that can not be independently verified as of 20051208. Unspecified vulnerability in unspecified versions of Real Networks RealPlayer allows attackers to execute arbitrary code. NOTE: the information regarding this issue is extremely vague and does not provide any verifiable information. It has been posted by a reliable reporter with a prerelease disclosure policy. This item has only been assigned a CVE identifier for tracking purposes and to serve as a concrete example for discussion of the newly emerging UNVERIFIABLE and PRERELEASE content decisions in CVE which must be discussed by the Editorial Board. Without additional details or independent verification by reliable sources it is possible that this item might be RECAST or REJECTED.


Multiple format string vulnerabilities in FTGate Technology (formerly known as Floosietek) FTGate 4.4 (aka Build 4.4.000 Oct 26 2005) allow remote attackers to execute arbitrary code via format string specifiers in the (1) USER (2) PASS and (3) TOP commands to the POP3 server; and the (4) LIST and (5) AUTHENTICATE commands to the IMAP server.


Unspecified vulnerability in PEAR installer 1.4.2 and earlier allows user-assisted attackers to execute arbitrary code via a crafted package that can execute code when the pear command is executed or when the Web/Gtk frontend is loaded.


PHP remote file inclusion vulnerability in phpDocumentor 1.3.0 rc4 and earlier when register_globals is enabled allows remote attackers to execute arbitrary code via a URL in the (1) FORUMLIB parameter in Documentation/tests/bug-559668.php and (2) the root_dir parameter in docbuilder/file_dialog.php.


Adobe Macromedia MX 2004 products Captivate Contribute 2 Contribute 3 and eLicensing client install the Macromedia Licensing Service with the Users group permitted to configure the service including the path to executable which allows local users to execute arbitrary code as Local System.


** UNVERIFIABLE PRERELEASE ** NOTE: this issue describes a problem that can not be independently verified as of 20051208. Unspecified vulnerability in unspecified versions of Real Networks RealPlayer allows remote attackers to execute arbitrary code. NOTE: it is not known whether this issue should be MERGED with CVE-2005-4126. The information regarding this issue is extremely vague and does not provide any verifiable information. It has been posted by a reliable reporter with a prerelease disclosure policy. This item has only been assigned a CVE identifier for tracking purposes and to serve as a concrete example for discussion of the newly emerging UNVERIFIABLE and PRERELEASE content decisions in CVE which must be discussed by the Editorial Board. Without additional details or independent verification by reliable sources it is possible that this item might be RECAST or REJECTED.


Unrestricted file upload vulnerability in PHPFM before 0.2.3 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension to an accessible directory as demonstrated using a file with a .php extension aka \upload phpshell.\


SAP 6.4 before 6.40 patch 4 6.2 before 6.20 patch 1364 4.6 before 4.6D patch 1767 45 before 45B patch 913 40 before 40B patch 1008 and 31 before 31I patch 735 do not properly restrict process execution by lnaxdm/sapsys which allows remote attackers to execute arbitrary code via a certain UDP packet that ends with the name of a local executable file aka the \FX SAP R/3 gwrd vuln.\


Unrestricted file upload vulnerability in toendaCMS before 0.6.2 Stable allows remote authenticated administrators to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in data/images/albums.


Winamp 2.65 through 3.0 stores skin files in a predictable file location which allows remote attackers to execute arbitrary code via a URL reference to (1) wsz and (2) wal files that contain embedded code.


sastcpd in SAS/Base 8.0 allows local users to execute arbitrary code by setting the authprog environment variable to reference a malicious program which is then executed by sastcpd.


W3Mail 1.0.2 through 1.0.5 with server side scripting (SSI) enabled in the attachments directory does not properly restrict the types of files that can be uploaded as attachments which allows remote attackers to execute arbitrary code by sending code in MIME attachments then requesting the attachments.


User-mode Linux (UML) 2.4.17-8 does not restrict access to kernel address space which allows local users to execute arbitrary code.


Artekopia Netjuke before 1.0 b7 allows remote attackers to execute arbitrary code on the web server possibly via the section parameter which is passed to an eval call.


Working Resources Inc. BadBlue Enterprise Edition 1.7 through 1.74 attempts to restrict administrator actions to the IP address of the local host but does not provide additional authentication which allows remote attackers to execute arbitrary code via a web page containing an HTTP POST request that accesses the dir.hts page on the localhost and adds an entire hard drive to be shared.


InterScan VirusWall 3.52 for Windows allows remote attackers to bypass virus protection and possibly execute arbitrary code via HTTP 1.1 gzip content encoding.


ptrace in the QNX realtime operating system (RTOS) 4.25 and 6.1.0 allows programs to attach to privileged processes which could allow local users to execute arbitrary code by modifying running processes.


InterScan VirusWall 3.6 for Linux and 3.52 for Windows allows remote attackers to bypass virus protection and possibly execute arbitrary code via HTTP 1.1 chunked transfer encoding.


The Email Sanitizer before 1.133 for Procmail allows remote attackers to bypass the mail filter and execute arbitrary code via crafted recursive multipart MIME attachments.


Format string vulnerability in the allowuser code for the Stellar-X msntauth authentication module as distributed in Squid 2.4.STABLE6 and earlier allows remote attackers to execute arbitrary code via format strings in the user name which are not properly handled in a syslog call.


Format string vulnerability in TraceEvent function for ntop before 2.1 allows remote attackers to execute arbitrary code by causing format strings to be injected into calls to the syslog function via (1) an HTTP GET request (2) a user name in HTTP authentication or (3) a password in HTTP authentication.


Format string vulnerabilities in Oracle Listener Control utility (lsnrctl) for Oracle 9.2 and 9.0 8.1 and 7.3.4 allow remote attackers to execute arbitrary code on the Oracle DBA system by placing format strings into certain entries in the listener.ora configuration file.


Linux Directory Penguin NsLookup CGI script (nslookup.pl) 1.0 allows remote attackers to execute arbitrary code via shell metacharacters in the (1) query or (2) type parameters.


The Java logging feature for the Java Virtual Machine in Internet Explorer writes output from functions such as System.out.println to a known pathname which can be used to execute arbitrary code.


The decompression algorithm in zlib 1.1.3 and earlier as used in many different utilities and packages causes inflateEnd to release certain memory more than once (a \double free\) which may allow local and remote attackers to execute arbitrary code via a block of malformed compression data.


Linux Directory Penguin traceroute.pl CGI script 1.0 allows remote attackers to execute arbitrary code via shell metacharacters in the host parameter.


The HTML Help facility in Microsoft Windows 98 98 Second Edition Millennium Edition NT 4.0 NT 4.0 Terminal Server Edition Windows 2000 and Windows XP uses the Local Computer Security Zone when opening .chm files from the Temporary Internet Files folder which allows remote attackers to execute arbitrary code via HTML mail that references or inserts a malicious .chm file containing shortcuts that can be executed aka \Code Execution via Compiled HTML Help File.\


Format string vulnerability in RPC wall daemon (rpc.rwalld) for Solaris 2.5.1 through 8 allows remote attackers to execute arbitrary code via format strings in a message that is not properly provided to the syslog function when the wall command cannot be executed.


members.asp in Snitz Forums 2000 version 3.3.03 and earlier allows remote attackers to execute arbitrary code via a SQL injection attack on the parameters (1) M_NAME (2) UserName (3) FirstName (4) LastName or (5) INITIAL.


Microsoft Internet Explorer 5.01 and 6.0 allow remote attackers to execute arbitrary code via malformed Content-Disposition and Content-Type header fields that cause the application for the spoofed file type to pass the file back to the operating system for handling rather than raise an error message aka the first variant of the \Content Disposition\ vulnerability.


The IRC script included in Light 2.7.x before 2.7.30p5 and 2.8.x before 2.8pre10 running EPIC allows remote attackers to execute arbitrary code if the user joins a channel whose topic includes EPIC4 code.


Format string vulnerability in certain third party modifications to mod_dav for logging bad gateway messages (e.g. Oracle9i Application Server 9.0.2) allows remote attackers to execute arbitrary code via a destination URI that forces a \502 Bad Gateway\ response which causes the format string specifiers to be returned from dav_lookup_uri() in mod_dav.c which is then used in a call to ap_log_rerror().


LogWatch before 2.5 allows local users to execute arbitrary code via a symlink attack on the logwatch temporary directory.


CNet CatchUp before 1.3.1 allows attackers to execute arbitrary code via a .RVP file that creates a file with an arbitrary extension (such as .BAT) which is executed during a scan.


Vulnerability in VNC TightVNC and TridiaVNC allows local users to execute arbitrary code as LocalSystem by using the Win32 Messaging System to bypass the VNC GUI and access the \Add new clients\ dialogue box.


The Web Folder component for Internet Explorer 5.5 and 6.0 writes an error message to a known location in the temporary folder which allows remote attackers to execute arbitrary code by injecting it into the error message then referring to the error message file via a mhtml: URL.


The decoder for Macromedia Shockwave Flash allows remote attackers to execute arbitrary code via a malformed SWF header that contains more data than the specified length.


Dynamic Guestbook 3.0 allows remote attackers to execute arbitrary code via shell metacharacters in the gbdaten parameter.


Heap corruption vulnerability in the \at\ program allows local users to execute arbitrary code via a malformed execution time which causes at to free the same memory twice.


Multiple format string vulnerabilities in in.rarpd (ARP server) on Solaris Caldera UnixWare and Open UNIX and possibly other operating systems allows remote attackers to execute arbitrary code via format strings that are not properly handled in the functions (1) syserr and (2) error.


db.php in phpBB 2.0 (aka phpBB2) RC-3 and earlier allows remote attackers to execute arbitrary code from remote servers via the phpbb_root_path parameter.


Off-by-one overflow in the CVS PreservePermissions of rcs.c for CVSD before 1.11.2 allows local users to execute arbitrary code.


Microsoft SQL Server 2000 SP2 when configured as a distributor allows attackers to execute arbitrary code via the @scriptfile parameter to the sp_MScopyscript stored procedure.


xfsmd for IRIX 6.5 through 6.5.16 allows remote attackers to execute arbitrary code via shell metacharacters that are not properly filtered from several calls to the popen() function such as export_fs().


Microsoft Internet Explorer 5.01 5.5 and 6.0 allows remote attackers to execute arbitrary code under fewer security restrictions via a malformed web page that requires NetBIOS connectivity aka \Zone Spoofing through Malformed Web Page\ vulnerability.


Format string vulnerabilities in the logging routines for dynamic DNS code (print.c) of ISC DHCP daemon (DHCPD) 3 to 3.0.1rc8 with the NSUPDATE option enabled allow remote malicious DNS servers to execute arbitrary code via format strings in a DNS server response.


Format string vulnerability in mmsyslog function allows remote attackers to execute arbitrary code via (1) the USER command to mmpop3d for mmmail 0.0.13 and earlier (2) the HELO command to mmsmtpd for mmmail 0.0.13 and earlier or (3) the USER command to mmftpd 0.0.7 and earlier.


Microsoft Internet Explorer 5.01 and 6.0 allow remote attackers to execute arbitrary code via malformed Content-Disposition and Content-Type header fields that cause the application for the spoofed file type to pass the file back to the operating system for handling rather than raise an error message aka the second variant of the \Content Disposition\ vulnerability.


The digital signature mechanism for the Adobe Acrobat PDF viewer only verifies the PE header of executable code for a plug-in which can allow attackers to execute arbitrary code in certified mode by making the plug-in appear to be signed by Adobe.


SoftwareUpdate for MacOS 10.1.x does not use authentication when downloading a software update which could allow remote attackers to execute arbitrary code by posing as the Apple update server via techniques such as DNS spoofing or cache poisoning and supplying Trojan Horse updates.


dhcpcd DHCP client daemon 1.3.22 and earlier allows local users to execute arbitrary code via shell metacharacters that are fed from a dhcpd .info script into a .exe script.


in

Mantis

before

allows

remote

attackers

to

execute

arbitrary

code

or

read

arbitrary

files

via

the

parameters

or

a

cookie.


bugzilla_email_append.pl in Bugzilla 2.14.x before 2.14.4 and 2.16.x before 2.16.1 allows remote attackers to execute arbitrary code via shell metacharacters in a system call to processmail.


os._execvpe from os.py in Python 2.2.1 and earlier creates temporary files with predictable names which could allow local users to execute arbitrary code via a symlink attack.


Cross-Frame scripting vulnerability in the WebBrowser control as used in Internet Explorer 5.5 and 6.0 allows remote attackers to execute arbitrary code read arbitrary files or conduct other unauthorized activities via script that accesses the Document property which bypasses <frame> and <iframe> domain restrictions.


Unknown vulnerability in html2ps HTML/PostScript converter 1.0 when used within LPRng allows remote attackers to execute arbitrary code via \unsanitized input.\


Gallery photo album package before 1.3.1 allows local and possibly remote attackers to execute arbitrary code via a modified GALLERY_BASEDIR variable that points to a directory or URL that contains a Trojan horse init.php script.


filters/image-gif.c in Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 does not properly check for zero-length GIF images which allows remote attackers to execute arbitrary code via modified chunk headers as demonstrated by nogif.


The COM_CHANGE_USER command in MySQL 3.x before 3.23.54 and 4.x to 4.0.6 allows remote attackers to execute arbitrary code via a long response.


ZoneAlarm Pro 3.0 MailSafe allows remote attackers to bypass filtering and possibly execute arbitrary code via email attachments containing a trailing dot after the file extension.


overflow.cgi CGI script in Sun Cobalt RaQ 4 with the SHP (Security Hardening Patch) installed allows remote attackers to execute arbitrary code via a POST request with shell metacharacters in the email parameter.


Qualcomm Eudora 5.1 allows remote attackers to execute arbitrary code via an HTML e-mail message that uses a file:// URL in a t:video tag to reference an attached Windows Media Player file containing JavaScript code which is launched and executed in the My Computer zone by Internet Explorer.


OpenLDAP2 (OpenLDAP 2) 2.2.0 and earlier allows remote or local attackers to execute arbitrary code when libldap reads the .ldaprc file within applications that are running with extra privileges.


NetDDE Agent on Windows NT 4.0 4.0 Terminal Server Edition Windows 2000 and Windows XP allows local users to execute arbitrary code as LocalSystem via \shatter\ style attack by sending a WM_COPYDATA message followed by a WM_TIMER message as demonstrated by GetAd aka \Flaw in Windows WM_TIMER Message Handling Could Enable Privilege Elevation.\


Microsoft Virtual Machine (VM) up to and including build 5.0.3805 allows remote attackers to execute arbitrary code by including a Java applet that invokes COM (Component Object Model) objects in a web site or an HTML mail.


openwebmail_init in Open WebMail 1.81 and earlier allows local users to execute arbitrary code via .. (dot dot) sequences in a login name such as the name provided in the sessionid parameter for openwebmail-abook.pl which is used to find a configuration file that specifies additional code to be executed.


Signedness error in Thomas Hauck Jana Server 2.x through 2.2.1 and 1.4.6 and earlier allows remote attackers to execute arbitrary code via long (1) Username (2) Password or (3) Hostname entries.


wp-admin/options.php in WordPress MU before 1.3.2 and WordPress 2.3.2 and earlier does not properly validate requests to update an option which allows remote authenticated users with manage_options and upload_files capabilities to execute arbitrary code by uploading a PHP script and adding this script's pathname to active_plugins.


Untrusted search path vulnerability in the Python interface in Epiphany 2.22.3 and possibly other versions allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).


Format string vulnerability in the vinagre_utils_show_error function (src/vinagre-utils.c) in Vinagre 0.5.x before 0.5.2 and 2.x before 2.24.2 might allow remote attackers to execute arbitrary code via format string specifiers in a crafted URI or VNC server response.


Mozilla Firefox 2.x before 2.0.0.18 and SeaMonkey 1.x before 1.1.13 do not properly check when the Flash module has been dynamically unloaded properly which allows remote attackers to execute arbitrary code via a crafted SWF file that \dynamically unloads itself from an outside JavaScript function \ which triggers an access of an expired memory address.


Multiple unspecified vulnerabilities in the web management interface in Avaya Communication Manager (CM) 3.1 before 3.1.4 SP2 4.0 before 4.0.3 SP1 and 5.0 before 5.0 SP3 allow remote authenticated users to execute arbitrary code via unknown attack vectors in the (1) Set Static Routes and (2) Backup History components.


Unspecified vulnerability in PHPCow allows remote attackers to execute arbitrary code via unknown vectors related to a \file inclusion vulnerability \ as exploited in the wild in November 2008.


Untrusted search path vulnerability in the Python plugin in Dia 0.96.1 and possibly other versions allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).


The HTML parsing engine in Opera before 9.63 allows remote attackers to execute arbitrary code via crafted web pages that trigger an invalid pointer calculation and heap corruption.


Unrestricted file upload vulnerability in Kwalbum 2.0.4 2.0.2 and earlier when PICS_PATH is located in the web root allows remote authenticated users with upload capability to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file under items/ related to the ReplaceBadFilenameChars function in include/ItemAdder.php. NOTE: some of these details are obtained from third party information.


The LDBserver service in the server in CA ARCserve Backup 11.1 through 12.0 on Windows allows remote attackers to execute arbitrary code via a handle_t argument to an RPC endpoint in which the argument refers to an incompatible procedure.


Untrusted search path vulnerability in the (1) \VST plugin with Python scripting\ and (2) \VST plugin for writing score generators in Python\ in Csound 5.08.2 and possibly other versions allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).


Multiple unrestricted file upload vulnerabilities in Kusaba 1.0.4 and earlier allow remote authenticated users to execute arbitrary code by uploading a file with an executable extension using (1) load_receiver.php or (2) a shipainter action to paint_save.php then accessing the uploaded file via a direct request to this file in their user directory.


html2text.php in Chuggnutt HTML to Text Converter as used in PHPMailer before 5.2.10 RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta Mahara and AtMail Open 1.03 allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch.


Untrusted search path vulnerability in the Python interface in Eye of GNOME (eog) 2.22.3 and possibly other versions allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).


The Nokia 6131 Near Field Communication (NFC) phone with 05.12 firmware automatically installs software upon completing the download of a JAR file which makes it easier for remote attackers to execute arbitrary code via a crafted URI record in an NDEF tag.


Unrestricted file upload vulnerability in admin/upload_form.php in wPortfolio 0.3 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in admin/tmp/.


Untrusted search path vulnerability in the PySys_SetArgv API function in Python 2.6 and earlier and possibly later versions prepends an empty string to sys.path when the argv0 argument does not contain a path separator which might allow local users to execute arbitrary code via a Trojan horse Python file in the current working directory.


The Server service in Microsoft Windows 2000 SP4 XP SP2 and SP3 Server 2003 SP1 and SP2 Vista Gold and SP1 Server 2008 and 7 Pre-Beta allows remote attackers to execute arbitrary code via a crafted RPC request that triggers the overflow during path canonicalization as exploited in the wild by Gimmiv.A in October 2008 aka \Server Service Vulnerability.\


The XPConnect component in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2 Thunderbird before 2.0.0.17 and SeaMonkey before 1.1.12 allows remote attackers to \pollute XPCNativeWrappers\ and execute arbitrary code with chrome privileges via vectors related to (1) chrome XBL and (2) chrome JS.


The SysInspector AntiStealth driver (esiasdrv.sys) 3.0.65535.0 in ESET System Analyzer Tool 1.1.1.0 allows local users to execute arbitrary code via a certain METHOD_NEITHER IOCTL request to \\Device\\esiasdrv that overwrites a pointer.


The search-ms protocol handler in Windows Explorer in Microsoft Windows Vista Gold and SP1 and Server 2008 uses untrusted parameter data obtained from incorrect parsing which allows remote attackers to execute arbitrary code via a crafted HTML document aka \Windows Search Parsing Vulnerability.\


Unrestricted file upload vulnerability in the DownloadsPlus module in PHP-Nuke allows remote attackers to execute arbitrary code by uploading a file with (1) .htm (2) .html or (3) .txt extensions then accessing it via a direct request to the file. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: it is unclear how allowing the upload of .html or .txt files supports arbitrary code execution; this might be legitimate functionality.


Opera before 9.52 on Windows Linux FreeBSD and Solaris when processing custom shortcut and menu commands can produce argument strings that contain uninitialized memory which might allow user-assisted remote attackers to execute arbitrary code or conduct other attacks via vectors related to activation of a shortcut.


Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2 Thunderbird before 2.0.0.17 and SeaMonkey before 1.1.12 allow remote attackers to create documents that lack script-handling objects and execute arbitrary code with chrome privileges via vectors related to (1) the document.loadBindingDocument function and (2) XSLT.


The Windows Search component in Microsoft Windows Vista Gold and SP1 and Server 2008 does not properly free memory during a save operation for a Windows Search file which allows remote attackers to execute arbitrary code via a crafted saved-search file aka \Windows Saved Search Vulnerability.\


Unrestricted file upload vulnerability in processFiles.php in FOSS Gallery Admin and FOSS Gallery Public 1.0 beta allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in the root directory.


Microsoft Windows 2000 Gold through SP4 XP Gold through SP3 Server 2003 SP1 and SP2 Vista Gold and SP1 and Server 2008 allows remote SMB servers to execute arbitrary code on a client machine by replaying the NTLM credentials of a client user as demonstrated by backrush aka \SMB Credential Reflection Vulnerability.\ NOTE: some reliable sources report that this vulnerability exists because of an insufficient fix for CVE-2000-0834.


The XPConnect component in Mozilla Firefox before 2.0.0.17 allows remote attackers to \pollute XPCNativeWrappers\ and execute arbitrary code with chrome privileges via vectors related to a SCRIPT element.


Unrestricted file upload vulnerability in the image upload component in Camera Life 2.6.2b4 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in a user directory under images/photos/upload.


Active Directory in Microsoft Windows 2000 SP4 does not properly allocate memory for (1) LDAP and (2) LDAPS requests which allows remote attackers to execute arbitrary code via a crafted request aka \Active Directory Overflow Vulnerability.\


Microsoft Office Excel 2000 SP3 2002 SP3 2003 SP3 and 2007 Gold and SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Office Compatibility Pack for Word Excel and PowerPoint 2007 File Formats Gold and SP1; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via a crafted Excel spreadsheet that contains a malformed formula which triggers \pointer corruption\ during the loading of formulas from this spreadsheet aka \File Format Parsing Vulnerability.\


The Download Manager in Adobe Acrobat Professional and Reader 8.1.2 and earlier allows remote attackers to execute arbitrary code via a crafted PDF document that calls an AcroJS function with a long string argument triggering heap corruption.


Use-after-free vulnerability in the CRecordInstance::TransferToDestination function in mshtml.dll in Microsoft Internet Explorer 5.01 6 6 SP1 and 7 allows remote attackers to execute arbitrary code via DSO bindings involving (1) an XML Island (2) XML DSOs or (3) Tabular Data Control (TDC) in a crafted HTML or XML document as demonstrated by nested SPAN or MARQUEE elements and exploited in the wild in December 2008.


Unrestricted file upload vulnerability in upload.php in Phlatline's Personal Information Manager (pPIM) 1.0 and earlier allows remote attackers to execute arbitrary code by uploading a .php file then accessing it via a direct request to the file in the top-level directory.


The loadModule function in lib/WebGUI/Asset.pm in WebGUI before 7.5.30 (stable) allows remote attackers to execute arbitrary code by uploading a Perl module and accessing it via a crafted URL.


Multiple untrusted search path vulnerabilities in Portage before 2.1.4.5 include the current working directory in the Python search path which allows local users to execute arbitrary code via a modified Python module that is loaded by the (1) ys-apps/portage (2) net-mail/fetchmail (3) app-editors/leo ebuilds and other ebuilds.


Unrestricted file upload vulnerability in the \Add Image Macro\ feature in WebCards 1.3 allows remote authenticated administrators to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the uploaded file.


manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a sort parameter containing PHP sequences which are processed by create_function within the multi_sort function in core/utility_api.php.


The CMsgReader::readRect function in the VNC Viewer component in RealVNC VNC Free Edition 4.0 through 4.1.2 Enterprise Edition E4.0 through E4.4.2 and Personal Edition P4.0 through P4.4.2 allows remote VNC servers to execute arbitrary code via crafted RFB protocol data related to \encoding type.\


The LaunchObj ActiveX control before 5.2.2.865 in launcher.dll in Symantec AppStream Client 5.2.x before 5.2.2 SP3 MP1 does not properly validate downloaded files which allows remote attackers to execute arbitrary code via the installAppMgr method and unspecified other methods.


Incomplete blacklist vulnerability in the Quarantine feature in CoreTypes in Apple Mac OS X 10.5 before 10.5.6 allows user-assisted remote attackers to execute arbitrary code via an executable file with the content type indicating no application association for the file which does not trigger a \potentially unsafe\ warning message.


The IPSEC livetest tool in Openswan 2.4.12 and earlier and 2.6.x through 2.6.16 allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on the (1) ipseclive.conn and (2) ipsec.olts.remote.log temporary files. NOTE: in many distributions and the upstream version this tool has been disabled.


Array index error in Adobe Reader and Acrobat and the Explorer extension (aka AcroRd32Info) 8.1.2 8.1.1 and earlier allows remote attackers to execute arbitrary code via a crafted PDF document that triggers an out-of-bounds write related to parsing of Type 1 fonts.


libraries/database_interface.lib.php in phpMyAdmin before 2.11.9.1 allows remote authenticated users to execute arbitrary code via a request to server_databases.php with a sort_by parameter containing PHP sequences which are processed by create_function.


HP OpenView Network Node Manager (OV NNM) 7.01 7.51 and 7.53 allows remote attackers to execute arbitrary code via shell metacharacters in argument fields to the (1) webappmon.exe or (2) OpenView5.exe CGI program. NOTE: this issue may be partially covered by CVE-2009-0205.


Unrestricted file upload vulnerability in image_upload.php in the SimpleBoard (com_simpleboard) component 1.0.1 and earlier for Mambo allows remote attackers to execute arbitrary code by uploading a file with an executable extension and an image/jpeg content type then accessing this file via a direct request to the file in components/com_simpleboard/ a different vulnerability than CVE-2006-3528.


Unrestricted file upload vulnerability in bigdump.php in Alexey Ozerov BigDump 0.29b allows remote attackers to execute arbitrary code by uploading a file with an executable extension followed by a .sql extension then accessing this file via a direct request. NOTE: some of these details are obtained from third party information.


Format string vulnerability in the Epic Games Unreal engine client as used in multiple games allows remote servers to execute arbitrary code via (1) the CLASS parameter in a DLMGR command (2) a malformed package (PKG) and possibly (3) the LEVEL parameter in a WELCOME command.


Unrestricted file upload vulnerability in upload_flyer.php in 2532designs 2532|Gigs 1.2.2 Stable allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in flyers/.


Unrestricted file upload vulnerability in Photos/create_album.php in Social Groupie allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in Member_images/.


Unrestricted file upload vulnerability in Full Revolution aspWebAlbum 3.2 allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in pics/ related to the uploadmedia action in album.asp.


Unrestricted file upload vulnerability in form_upload.php in PHPG Upload 1.0 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


viewrq.php in nweb2fax 0.2.7 and earlier allows remote attackers to execute arbitrary code via shell metacharacters in the var_filename parameter in a (1) tif or (2) pdf format action.


Unrestricted file upload vulnerability in Collabtive 0.4.8 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension and using a text/plain MIME type then accessing it via a direct request to the file in files/ related to (1) the showproject action in managefile.php or (2) the Messages feature.


Unrestricted file upload vulnerability in editimage.php in Apartment Search Script allows remote attackers to execute arbitrary code by uploading a file with an executable extension and a GIF header then accessing this file via a direct request to a renamed file in Member_Admin/logo/.


Unrestricted file upload vulnerability in editresume_next.php in Zeeways ZEEJOBSITE 2.0 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a photo in a profile edit action then accessing the file via a direct request to jobseekers/logos/.


Unrestricted file upload vulnerability in image_processing.php in the e-Commerce Plugin 3.4 and earlier for Wordpress allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in wp-content/plugins/wp-shopping-cart/.


Unrestricted file upload vulnerability in ScriptsFeed Auto Classifieds allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a profile logo then accessing it via a direct request to the file in cars_images/.


Unrestricted file upload vulnerability in process.php in Tizag Countdown Creator 3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension via index.php then accessing the uploaded file via a direct request to the file in pics/. NOTE: some of these details are obtained from third party information.


Unrestricted file upload vulnerability in PHPStore Complete Classifieds allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a logo then accessing it via a direct request to the file in classifieds1/yellow_images/.


Unrestricted

file

upload

vulnerability

in

in

QuickerSite

allows

remote

attackers

to

execute

arbitrary

code

by

uploading

a

file

with

an

executable

extension

then

accessing

it

via

a

direct

request

to

the

file.


Unrestricted file upload vulnerability in ScriptsFeed Realtor Classifieds System (aka Real Estate Classifieds) allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a profile logo then accessing it via a direct request to the file in re_images/.


html/index.php in TorrentFlux 2.3 allows remote authenticated users to execute arbitrary code via a URL with a file containing an executable extension in the url_upload parameter which is downloaded by TorrentFlux and can be accessed via a direct request in a html/downloads/ user directory.


Unrestricted file upload vulnerability in auth.php in phpEmployment 1.8 allows remote attackers to execute arbitrary code by uploading a file with an executable extension during a regnew action then accessing it via a direct request to the file in photoes/.


Unrestricted

file

upload

vulnerability

in

in

FCKeditor

as

used

in

CMS

Nuke

ET

and

other

products

allows

remote

attackers

to

execute

arbitrary

code

by

creating

a

file

with

PHP

sequences

preceded

by

a

ZIP

header

uploading

this

file

via

a

FileUpload

action

with

the

application/zip

content

type

and

then

accessing

this

file

via

a

direct

request

to

the

file

in

UserFiles/File/

probably

a

related

issue

to

NOTE:

some

of

these

details

are

obtained

from

third

party

information.


Unrestricted file upload vulnerability in uploadp.php in New Earth Programming Team (NEPT) imgupload (aka Image Uploader) 1.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension and a modified content type then accessing this file via a direct request as demonstrated by an upload with an image/jpeg content type. NOTE: some of these details are obtained from third party information.


Unrestricted file upload vulnerability in ScriptsFeed Recipes Listing Portal allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a recipe photo then accessing it via a direct request to the file in pictures/.


Eaton MGEOPS Network Shutdown Module before 3.10 Build 13 allows remote attackers to execute arbitrary code by adding a custom action to the MGE frontend via pane_actionbutton.php and then executing this action via exec_action.php.


Unrestricted file upload vulnerability in index.php in the Twitter Clone (TClone) plugin for ReVou Micro Blogging allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in settings/my_photo.


Unrestricted file upload vulnerability in eZoneScripts Dating Website script allows remote attackers to execute arbitrary code via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Unrestricted file upload vulnerability in Yehe 2.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in the envoyer feature. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Unrestricted file upload vulnerability in viewprofile.php in Zeeways ZEEPROPERTY 1.0 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a photo in a profile modification then accessing a related file via a direct request to the file in companylogo/.


Unrestricted file upload vulnerability in PHPStore Auto Classifieds allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a logo then accessing it via a direct request to the file in cars/cars_images/.


Unrestricted file upload vulnerability in includes/imageupload.php in 7Shop 1.1 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in images/artikel/.


Avira AntiVir Premium Premium Security Suite AntiVir Professional and AntiVir Personal - FREE allows local users to execute arbitrary code via a crafted IOCTL request that overwrites a kernel pointer.


Unrestricted file upload vulnerability in \Add Pen/Author Name\ feature in addpen.php in AvailScript Article Script allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in photos/.


Unrestricted file upload vulnerability in Mini File Host 1.5 allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in an unspecified directory as demonstrated by creating a name.php file.


Unrestricted file upload vulnerability in PHPStore Job Search (aka PHPCareers) allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a resume photo then accessing it via a direct request to the file in jobseekers/jobseeker_profile_images.


The Scanner File Utility (aka listener) in Kyocera Mita (KM) 3.3.0.1 does not restrict the filenames or extensions of uploaded files which makes it easier for remote attackers to execute arbitrary code or overwrite files by leveraging CVE-2008-7110 and CVE-2008-7109.


Unrestricted file upload vulnerability in filesystem3.class.php in eFront 3.5.1 build 2710 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension as an avatar then accessing it via a direct request to the file in (1) student/avatars/ or (2) professor/avatars/.


Unrestricted file upload vulnerability in upload.php in PhotoPost vBGallery 2.4.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension followed by a safe extension then accessing it via a direct request to the file in a certain path. NOTE: this may be the same vulnerability as CVE-2008-0251 but this is not clear due to lack of details from the vendor.


Unrestricted file upload vulnerability in upload.php in Page Manager 2006-02-04 allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in an unspecified directory.


Unrestricted file upload vulnerability in EkinBoard 1.1.0 and earlier allows remote attackers to execute arbitrary code by uploading an avatar file with an executable extension followed by a safe extension then accessing it via a direct request to the file in uploaded/avatars/.


Unrestricted file upload vulnerability in admin/index.php in Download Manager module 1.0 for LoveCMS 1.6.2 Final allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in uploads/.


Unrestricted file upload vulnerability in usercp.php in AlilG Application AliBoard Beta allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as an avatar then accessing it via a direct request to the file in uploads/avatars/.


The silc_http_server_parse function in lib/silchttp/silchttpserver.c in the internal HTTP server in silcd in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.9 allows remote attackers to overwrite a stack location and possibly execute arbitrary code via a crafted Content-Length header related to incorrect use of a %lu format string.


Unrestricted file upload vulnerability in editlogo.php in AvailScript Jobs Portal Script allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as an image or logo then accessing it via a direct request to the file in an unspecified directory.


Unrestricted file upload vulnerability in user.modify.profile.php in Kalptaru Infotech Ltd. Star Articles 6.0 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a profile photo then accessing it via a direct request to the file in authorphoto/.


The silc_asn1_encoder function in lib/silcasn1/silcasn1_encode.c in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.8 allows remote attackers to overwrite a stack location and possibly execute arbitrary code via a crafted OID value related to incorrect use of a %lu format string.


Unrestricted file upload vulnerability in profile.php in Pre Projects Pre Real Estate Listings allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a profile logo then accessing it via a direct request to the file in re_images/.


Unrestricted file upload vulnerability in the add2 action in a_upload.php in OneCMS 2.4 and possibly earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension and using a safe content type such as image/gif then accessing it via a direct request to the file in an unspecified directory.


Unspecified vulnerability in Synfig Animation Studio before 0.61.08 allows attackers to execute arbitrary code via a crafted .sif file.


Unrestricted

file

upload

vulnerability

in

upload.php

in

the

Giulio

Ganci

Wp

Downloads

Manager

module

for

WordPress

allows

remote

attackers

to

execute

arbitrary

code

by

uploading

a

file

with

an

executable

extension

via

the

upfile

parameter

then

accessing

it

via

a

direct

request

to

the

file

in

wp-content/plugins/downloads-manager/upload/.


Unrestricted file upload vulnerability in the File Manager in the admin panel in Twentyone Degrees Symphony 1.7.01 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension to a directory specified in the destination parameter then accessing the uploaded file via a direct request as demonstrated using workspace/masters/.


Unspecified vulnerability in the CLR stored procedure deployment from IBM Database Add-Ins for Visual Studio in the Visual Studio Net component in IBM DB2 9.1 before Fixpak 5 and 9.5 before Fixpak 2 allows remote authenticated users to execute arbitrary code via unknown vectors.


The shellescape function in Vim 7.0 through 7.2 including 7.2a.10 allows user-assisted attackers to execute arbitrary code via the \!\ (exclamation point) shell metacharacter in (1) the filename of a tar archive and possibly (2) the filename of the first file in a tar archive which is not properly handled by the VIM TAR plugin (tar.vim) v.10 through v.22 as demonstrated by the shellescape tarplugin.v2 tarplugin and tarplugin.updated test cases. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712. NOTE: this issue has the same root cause as CVE-2008-3075. NOTE: due to the complexity of the associated disclosures and the incomplete information related to them there may be inaccuracies in this CVE description and in external mappings to this identifier.


Multiple unspecified vulnerabilities in Nokia Series 40 3rd edition FP1 and possibly later devices allow remote attackers to execute arbitrary code via unknown vectors probably related to MIDP privilege escalation and persistent MIDlets aka \ISSUES 11-15.\ NOTE: as of 20080807 the only disclosure is a vague pre-advisory with no actionable information. However because it is from a company led by a well-known researcher it is being assigned a CVE identifier for tracking purposes.


Microsoft Office Excel 2000 SP3 2002 SP3 2003 SP2 and SP3 and 2007 Gold and SP1; Office Excel Viewer 2003 Gold and SP3; Office Excel Viewer; Office Compatibility Pack 2007 Gold and SP1; Office SharePoint Server 2007 Gold and SP1; and Office 2004 and 2008 for Mac do not properly parse Country record values when loading Excel files which allows remote attackers to execute arbitrary code via a crafted Excel file aka the \Excel Record Parsing Vulnerability.\


The Filesys::SmbClientParser module 2.7 and earlier for Perl allows remote SMB servers to execute arbitrary code via a folder name containing shell metacharacters.


Unspecified vulnerability in HP Enterprise Discovery 2.0 through 2.52 on Windows allows remote authenticated users to execute arbitrary code via unknown vectors. NOTE: the initial description of this CVE was inadvertently associated with libxml2 but it should be for HP Enterprise Discovery.


awstatstotals.php in AWStats Totals 1.0 through 1.14 allows remote attackers to execute arbitrary code via PHP sequences in the sort parameter which is used by the multisort function when dynamically creating an anonymous PHP function.


nslookup.exe in Microsoft Windows XP SP2 allows user-assisted remote attackers to execute arbitrary code as demonstrated by an attempted DNS zone transfer and as exploited in the wild in August 2008.


Argument injection vulnerability in a URI handler in Microsoft Office XP SP3 2003 SP2 and SP3 2007 Office System Gold and SP1 and Office OneNote 2007 Gold and SP1 allow remote attackers to execute arbitrary code via a crafted onenote:// URL aka \Uniform Resource Locator Validation Error Vulnerability.\


The Hash-based Message Authentication Code (HMAC) provider in Java on Apple Mac OS X 10.4.11 10.5.4 and 10.5.5 uses an uninitialized variable which allows remote attackers to execute arbitrary code via a crafted applet related to an \error checking issue.\


src/configure.in in Vim 5.0 through 7.1 when used for a build with Python support does not ensure that the Makefile-conf temporary file has the intended ownership and permissions which allows local users to execute arbitrary code by modifying this file during a time window or by creating it ahead of time with permissions that prevent its modification by configure.


The shellescape function in Vim 7.0 through 7.2 including 7.2a.10 allows user-assisted attackers to execute arbitrary code via the \!\ (exclamation point) shell metacharacter in (1) the filename of a ZIP archive and possibly (2) the filename of the first file in a ZIP archive which is not properly handled by zip.vim in the VIM ZIP plugin (zipPlugin.vim) v.11 through v.21 as demonstrated by the zipplugin and zipplugin.v2 test cases. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712. NOTE: this issue has the same root cause as CVE-2008-3074. NOTE: due to the complexity of the associated disclosures and the incomplete information related to them there may be inaccuracies in this CVE description and in external mappings to this identifier.


Multiple unspecified vulnerabilities in Nokia Series 40 3rd edition devices allow remote attackers to execute arbitrary code via unknown vectors probably related to MIDP privilege escalation and persistent MIDlets aka \ISSUES 3-10.\ NOTE: as of 20080807 the only disclosure is a vague pre-advisory with no actionable information. However because it is from a company led by a well-known researcher it is being assigned a CVE identifier for tracking purposes.


The Hewlett-Packard Graphics Language (HPGL) filter in CUPS before 1.3.9 allows remote attackers to execute arbitrary code via crafted pen width and pen color opcodes that overwrite arbitrary memory.


Unrestricted file upload vulnerability in ecrire/images.php in Dotclear 1.2.7.1 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in images.