A malicious application may be able to execute arbitrary code with kernel privileges. This issue is fixed in macOS Big Sur 11.4 Security Update 2021-003 Catalina Security Update 2021-004 Mojave. An out-of-bounds write issue was addressed with improved bounds checking.


Multiple out-of-bounds write issues were addressed with improved bounds checking. This issue is fixed in macOS Monterey 12.0.1 Security Update 2021-007 Catalina macOS Big Sur 11.6.1. A malicious application may be able to execute arbitrary code with kernel privileges.


A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.4 Security Update 2021-003 Catalina Security Update 2021-004 Mojave. A malicious application could execute arbitrary code leading to compromise of user information.


The unofficial vscode-phpmd (aka PHP Mess Detector) extension before 1.3.0 for Visual Studio Code allows remote attackers to execute arbitrary code via a crafted phpmd.command value in a workspace folder.


An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.5 Security Update 2021-004 Catalina Security Update 2021-005 Mojave. An application may be able to execute arbitrary code with kernel privileges.


An application may be able to execute arbitrary code with system privileges. This issue is fixed in macOS Big Sur 11.3 Security Update 2021-002 Catalina. The issue was addressed with improved permissions logic.


Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary code without user interaction. An attacker must be within the same organization or an external party who has been accepted as a contact. NOTE: this is specific to the Zoom Chat software which is different from the chat feature of the Zoom Meetings and Zoom Video Webinars software.


An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.4 Security Update 2021-003 Catalina Security Update 2021-004 Mojave. A malicious application may be able to execute arbitrary code with kernel privileges.


dttray.exe in Greyware Automation Products Inc Domain Time II before 5.2.b.20210331 allows remote attackers to execute arbitrary code via a URL to a malicious update in a spoofed response to the UDP query used to check for updates.


Ops CLI version 2.0.4 (and earlier) is affected by a Deserialization of Untrusted Data vulnerability to achieve arbitrary code execution when the checkout_repo function is called on a maliciously crafted file. An attacker can leverage this to execute arbitrary code on the victim machine.


Adobe Genuine Service versions 7.3 (and earlier) are affected by a privilege escalation vulnerability in the AGSService installer. An authenticated attacker could leverage this vulnerability to achieve read / write privileges to execute arbitrary code. User interaction is required to abuse this vulnerability.


A vulnerability in the Network Access Manager (NAM) module of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to escalate privileges on an affected device. This vulnerability is due to incorrect privilege assignment to scripts executed before user logon. An attacker could exploit this vulnerability by configuring a script to be executed before logon. A successful exploit could allow the attacker to execute arbitrary code with SYSTEM privileges.


Kaseya Unitrends Client/Agent through 10.5 5 allows remote attackers to execute arbitrary code.


A maliciously crafted DWG file in Autodesk Navisworks 2019 2020 2021 2022 can be forced to write beyond allocated boundaries when parsing the DWG files. This vulnerability can be exploited to execute arbitrary code.


A maliciously crafted JT file in Autodesk Inventor 2022 2021 2020 2019 may be forced to read beyond allocated boundaries when parsing the JT file. This vulnerability can be exploited to execute arbitrary code


PDFTron prior to 9.0.7 version may be forced to read beyond allocated boundaries when parsing a maliciously crafted PDF file. This vulnerability can be exploited to execute arbitrary code.


Cross site scripting (XSS) vulnerability in sourcecodester PHP CRUD without Refresh/Reload using Ajax and DataTables Tutorial v1 by oretnom23 allows remote attackers to execute arbitrary code via the first_name last_name and email parameters to /ajax_crud.


A maliciously crafted DWG file in Autodesk Navisworks 2019 2020 2021 2022 can be forced to read beyond allocated boundaries when parsing the DWG files. This vulnerability can be exploited to execute arbitrary code.


ikeyman in IBM IBMHSSSB 1.0 sets the CLASSPATH environmental variable to include the user's own CLASSPATH directories before the system's directories which allows a malicious local user to execute arbitrary code as root via a Trojan horse Ikeyman class.


Unspecified vulnerability in Red Hat Network Satellite Server 5.0.0 allows remote authenticated users to execute arbitrary code via unknown vectors in a \back-end XMLRPC handler.\


Unrestricted file upload vulnerability in phUploader.php in phphq.Net phUploader 1.2 allows remote attackers to upload and execute arbitrary code via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


IBM DB2 UDB 8 before Fixpak 15 and 9.1 before Fixpak 3 allows local users to create arbitrary directories and execute arbitrary code via a \crafted localized message file\ that enables a format string attack possibly involving the (1) OSSEMEMDBG or (2) TRC_LOG_FILE environment variable in db2licd (db2licm).


Unspecified vulnerability in the Modbus/TCP Diagnostic function in MiniHMI.exe for the Automated Solutions Modbus Slave ActiveX Control before 1.5 allows remote attackers to corrupt the heap and possibly execute arbitrary code via malformed Modbus requests to TCP port 502.


Unspecified vulnerability in RemoteDocs R-Viewer before 1.6.3768 allows user-assisted remote attackers to execute arbitrary code via a crafted RDZ archive in which the first file has an executable extension.


Unrestricted file upload vulnerability in upload.php in Barbo91 1.1 allows remote attackers to upload and execute arbitrary code via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


The kadm5_modify_policy_internal function in lib/kadm5/srv/svr_policy.c in the Kerberos administration daemon (kadmind) in MIT Kerberos 5 (krb5) 1.5 through 1.6.2 does not properly check return values when the policy does not exist which might allow remote authenticated users with the \modify policy\ privilege to execute arbitrary code via unspecified vectors that trigger a write to an uninitialized pointer.


Unspecified vulnerability in EMC VMware Workstation before 5.5.5 Build 56455 and 6.x before 6.0.1 Build 55017 Player before 1.0.5 Build 56455 and Player 2 before 2.0.1 Build 55017 ACE before 1.0.3 Build 54075 and ACE 2 before 2.0.1 Build 55017 and Server before 1.0.4 Build 56528 allows authenticated users with administrative privileges on a guest operating system to corrupt memory and possibly execute arbitrary code on the host operating system via unspecified vectors.


The embedded Internet Explorer server control in AOL Instant Messenger (AIM) 6.1.41.2 and 6.2.32.1 AIM Pro and AIM Lite does not properly constrain the use of mshtml.dll's web script and HTML functionality for incoming instant messages which allows remote attackers to place HTML into unexpected contexts or execute arbitrary code as demonstrated by writing arbitrary HTML to a notification window and writing contents of arbitrary local image files to this window via IMG SRC.


Eval injection vulnerability in environment.php in Olate Download (od) 3.4.1 allows context-dependent attackers to execute arbitrary code via a crafted version string as referenced by the (1) PDO::ATTR_SERVER_VERSION or (2) PDO::ATTR_CLIENT_VERSION attribute.


Unspecified vulnerability in the Shared Trace Service in Hitachi JP1/Cm2/Network Node Manager (NNM) 07-10 through 07-10-05 and NNM Starter Edition Enterprise and 250 08-00 through 08-10 allows remote attackers to execute arbitrary code via unspecified vectors.


The Foreign Function Interface (ffi) extension in PHP 5.0.5 does not follow safe_mode restrictions which allows context-dependent attackers to execute arbitrary code by loading an arbitrary DLL and calling a function as demonstrated by kernel32.dll and the WinExec function. NOTE: this issue does not cross privilege boundaries in most contexts so perhaps it should not be included in CVE.


The swap_char2b function in X.Org X Font Server (xfs) before 1.0.5 allows context-dependent attackers to execute arbitrary code via (1) QueryXBitmaps and (2) QueryXExtents protocol requests with crafted size values that specify an arbitrary number of bytes to be swapped on the heap which triggers heap corruption.


The perl extension in PHP does not follow safe_mode restrictions which allows context-dependent attackers to execute arbitrary code via the Perl eval function. NOTE: this might only be a vulnerability in limited environments.


The mIRC Control Plug-in for Winamp allows user-assisted remote attackers to execute arbitrary code via the '|' (pipe) shell metacharacter in the name of the song in a .mp3 file.


Opera before 9.23 allows remote attackers to execute arbitrary code via crafted Javascript that triggers a \virtual function call on an invalid pointer.\


Multiple unspecified scripts in mIRC allow user-assisted remote attackers to execute arbitrary code via the '|' (pipe) shell metacharacter in the name of the song in a .mp3 file.


Unrestricted file upload vulnerability in output.php in American Financing eMail Image Upload 4.1 allows remote attackers to upload and execute arbitrary code via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


feynmf.pl in feynmf 1.08 as used in TeXLive 2007 allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on the feynmf$$.pl temporary file.


HP Mercury Quality Center (QC) 9.2 and earlier and possibly TestDirector relies on cached client-side scripts to implement \workflow\ and decisions about the \capability\ of a user which allows remote attackers to execute arbitrary code via crafted use of the Open Test Architecture (OTA) API as demonstrated by modifying (1) common.tds (2) defects.tds (3) manrun.tds (4) req.tds (5) testlab.tds or (6) testplan.tds in %tmp%\\TD_80 and then setting the file's properties to read-only.


Queue.dll for the message queuing service (LQserver.exe) in CA BrightStor ARCServe BackUp v9.01 through R11.5 and Enterprise Backup r10.5 allows remote attackers to execute arbitrary code via a malformed ONRPC protocol request for operation 0x76 which causes ARCserve Backup to dereference arbitrary pointers.


The Gentoo ebuild of MLDonkey before 2.9.0-r3 has a p2p user account with an empty default password and valid login shell which might allow remote attackers to obtain login access and execute arbitrary code.


Incomplete blacklist vulnerability in upload_img_cgi.php in Simple PHP Blog before 0.5.1 allows remote attackers to upload dangerous files and execute arbitrary code as demonstrated by a filename ending in .php. or a .htaccess file a different vector than CVE-2005-2733. NOTE: the vulnerability was also present in a 0.5.1 download available in the early morning of 20070923. NOTE: the original 20070920 disclosure provided an incorrect filename img_upload_cgi.php.


The embedded Internet Explorer server control in AOL Instant Messenger (AIM) 6.5.3.12 and earlier allows remote attackers to execute arbitrary code via unspecified web script or HTML in an instant message related to AIM's filtering of \specific tags and attributes\ and the lack of Local Machine Zone lockdown. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2007-4901.


install.php in Drupal 5.x before 5.3 when the configured database server is not reachable allows remote attackers to execute arbitrary code via vectors that cause settings.php to be modified.


The Message Engine RPC service in CA BrightStor ARCServe BackUp v9.01 through R11.5 and Enterprise Backup r10.5 allows attackers to execute arbitrary code by using certain \insecure method calls\ to modify the file system and registry aka \Privileged function exposure.\


Multiple format string vulnerabilities in websrv.cpp in Dawn of Time 1.69s beta4 and earlier allow remote attackers to execute arbitrary code via format string specifiers in the (1) username or (2) password fields when accessing certain \restricted zones\ which are not properly handled by the (a) processWebHeader and (b) filterWebRequest functions.


Format string vulnerability in the ws_addarg function in webserver.c in mt-dappd in Firefly Media Server 0.2.4 and earlier allows remote attackers to execute arbitrary code via a stats method action to /xml-rpc with format string specifiers in the (1) username or (2) password portion of base64-encoded data on the \Authorization: Basic\ HTTP header line.


tiki-graph_formula.php in TikiWiki 1.9.8 allows remote attackers to execute arbitrary code via PHP sequences in the f array parameter which are processed by create_function.


TIBCO SmartSockets RTserver 6.8.0 and earlier RTworks before 4.0.4 and Enterprise Message Service (EMS) 4.0.0 through 4.4.1 allows remote attackers to execute arbitrary code via crafted requests containing values that are used as pointers.


Multiple eval injection vulnerabilities in Php-Stats 0.1.9.2 allow remote authenticated administrators to execute arbitrary code by writing PHP sequences to the php-stats-options record in the _options table which is used in an eval function call by (1) admin.php (2) click.php (3) download.php and unspecified other files as demonstrated by modifying _options through a backup restore action in admin.php.


Unspecified vulnerability in Adobe Acrobat and Reader 8.1 on Windows allows remote attackers to execute arbitrary code via a crafted PDF file related to the mailto: option and Internet Explorer 7 on Windows XP. NOTE: this information is based upon a vague pre-advisory by a reliable researcher.


Unspecified vulnerability in Spin Tracer in Apple Mac OS X 10.5.1 allows local users to execute arbitrary code via unspecified output files involving an \insecure file operation.\


Format string vulnerability in TIBCO SmartPGM FX allows remote attackers to execute arbitrary code via format string specifiers in unspecified vectors. NOTE: as of 20071016 the only disclosure is a vague pre-advisory with no actionable information. However since it is from a well-known researcher it is being assigned a CVE identifier for tracking purposes.


TIBCO SmartSockets RTserver 6.8.0 and earlier RTworks before 4.0.4 and Enterprise Message Service (EMS) 4.0.0 through 4.4.1 allows remote attackers to execute arbitrary code via crafted requests containing values that are used as pointer offsets.


Untrusted search path vulnerability in Adobe Reader and Acrobat 8.1.1 and earlier allows local users to execute arbitrary code via a malicious Security Provider library in the reader's current working directory. NOTE: this issue might be subsumed by CVE-2008-0655.


Eval injection vulnerability in adodb-perf-module.inc.php in ADOdb Lite 1.42 and earlier as used in products including CMS Made Simple SAPID CMF Journalness PacerCMS and Open-Realty allows remote attackers to execute arbitrary code via PHP sequences in the last_module parameter.


Incomplete blacklist vulnerability in tiki-graph_formula.php in TikiWiki before 1.9.8.2 allows remote attackers to execute arbitrary code by using variable functions and variable variables to write variables whose names match the whitelist a different vulnerability than CVE-2007-5423.


Unspecified vulnerability in BitDefender allows attackers to execute arbitrary code via unspecified vectors aka EEYEB-20071024. NOTE: as of 20071029 the only disclosure is a vague pre-advisory with no actionable information. However since it is from a well-known researcher it is being assigned a CVE identifier for tracking purposes.


Unspecified vulnerability in Server Message Block Version 2 (SMBv2) signing support in Microsoft Windows Vista allows remote attackers to force signature re-computation and execute arbitrary code via a crafted SMBv2 packet aka \SMBv2 Signing Vulnerability.\


The format string protection mechanism in IMAPD for Perdition Mail Retrieval Proxy 1.17 and earlier allows remote attackers to execute arbitrary code via an IMAP tag with a null byte followed by a format string specifier which is not counted by the mechanism.


Format string vulnerability in the logging function in the Oracle OPMN daemon as used on Oracle Enterprise Grid Console server 10.2.0.1 allows remote attackers to execute arbitrary code via format string specifiers in the URI in an HTTP request to port 6003 aka Oracle reference number 6296175. NOTE: this might be the same issue as CVE-2007-0282 or CVE-2007-0280 but there are insufficient details to be sure.


Format string vulnerability in the mdiag_initialize function in gtk/src/rbgtkmessagedialog.c in Ruby-GNOME 2 (aka Ruby/Gnome2) 0.16.0 and SVN versions before 20071127 allows context-dependent attackers to execute arbitrary code via format string specifiers in the message parameter.


The Oracle database component in Sun Management Center (Sun MC) 3.6.1 3.6 and 3.5 Update 1 has a default account which allows remote attackers to obtain database access and execute arbitrary code.


Menalto Gallery before 2.2.4 does not properly check for malicious file extensions during file uploads which allows attackers to execute arbitrary code via the (1) Core application or (2) MIME module.


The XInput extension in X.Org Xserver before 1.4.1 allows context-dependent attackers to execute arbitrary code via requests related to byte swapping and heap corruption within multiple functions a different vulnerability than CVE-2007-4990.


Multiple double free vulnerabilities in Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1 allow user-assisted remote attackers to execute arbitrary code via malformed (1) Seektable values or (2) Seektable Data Offsets in a .FLAC file.


Multiple format string vulnerabilities in the configuration file in SonicWALL GLobal VPN Client 3.1.556 and 4.0.0.810 allow user-assisted remote attackers to execute arbitrary code via format string specifiers in the (1) Hostname tag or the (2) name attribute in the Connection tag. NOTE: there might not be any realistic circumstances in which this issue crosses privilege boundaries.


Unspecified vulnerability in Apple QuickTime 7.2 on Windows XP allows remote attackers to execute arbitrary code via unknown attack vectors probably a different vulnerability than CVE-2007-6166. NOTE: this information is based upon a vague advisory by a vulnerability information sales organization that does not coordinate with vendors or release advisories with actionable information. A CVE has been assigned for tracking purposes but duplicates with other CVEs are difficult to determine. However the organization has stated that this is different than CVE-2007-6166.


Adobe Flash Player 9.0.115.0 and earlier and 8.0.39.0 and earlier allows remote attackers to execute arbitrary code via an SWF file with a modified DeclareFunction2 Actionscript tag which prevents an object from being instantiated properly.


Mail in Apple Mac OS X Leopard (10.5.1) allows user-assisted remote attackers to execute arbitrary code via an AppleDouble attachment containing an apparently-safe file type and script in a resource fork which does not warn the user that a separate program is going to be executed. NOTE: this is a regression error related to CVE-2006-0395.


Unspecified vulnerability in nlnotes.dll in the client in IBM Lotus Notes 6.5 7.0.x before 7.0.2 CCH or 7.0.3 and possibly 8.0 allows remote attackers to execute arbitrary code via crafted text in an e-mail message sent over SMTP.


Use-after-free vulnerability in the Edge server in Adobe Flash Media Server 2 before 2.0.5 and Connect Enterprise Server 6 before SP3 allows remote attackers to execute arbitrary code via an unspecified sequence of Real Time Message Protocol (RTMP) requests.


The IMWeb.IMWebControl.1 ActiveX control in IMWeb.dll 7.0.0.x and possibly IMWebControl.dll in iMesh 7.1.0.x and earlier allows remote attackers to execute arbitrary code via a certain argument to the SetHandler method.


A certain ActiveX control in axvlc.dll in VideoLAN VLC 0.8.6 before 0.8.6d allows remote attackers to execute arbitrary code via crafted arguments to the (1) addTarget (2) getVariable or (3) setVariable function resulting from a \bad initialized pointer \ aka a \recursive plugin release vulnerability.\


SpntSvc.exe daemon in Trend Micro ServerProtect 5.58 for Windows before Security Patch 4 exposes unspecified dangerous sub-functions from StRpcSrv.dll in the DCE/RPC interface which allows remote attackers to obtain \full file system access\ and execute arbitrary code.


Unspecified vulnerability in ClamAV 0.91.1 and 0.91.2 allows remote attackers to execute arbitrary code via a crafted e-mail message. NOTE: this information is based upon a vague advisory by a vulnerability information sales organization that does not coordinate with vendors or release actionable advisories. A CVE has been assigned for tracking purposes but duplicates with other CVEs are difficult to determine.


Format string vulnerability in the helptags_one function in src/ex_cmds.c in Vim 6.4 and earlier and 7.x up to 7.1 allows user-assisted remote attackers to execute arbitrary code via format string specifiers in a help-tags tag in a help file related to the helptags command.


Apple QuickTime Java extensions (QTJava.dll) as used in Safari and other browsers and when Java is enabled allows remote attackers to execute arbitrary code via parameters to the toQTPointer method in quicktime.util.QTHandleRef which can be used to modify arbitrary memory when creating QTPointerRef objects as demonstrated during the \PWN 2 0WN\ contest at CanSecWest 2007.


** DISPUTED ** Unspecified vulnerability in administration.php in xodagallery allows remote attackers to execute arbitrary code via the cmd parameter. NOTE: CVE disputes this vulnerability because administration.php does not use the cmd parameter for inclusion.


Apple QuickTime for Java 7.1.6 on Mac OS X and Windows does not properly restrict QTObject subclassing which allows remote attackers to execute arbitrary code via a web page containing a user-defined class that accesses unsafe functions that can be leveraged to write to arbitrary memory locations.


The agent remote upgrade interface in Symantec Enterprise Security Manager (ESM) before 20070405 does not verify the authenticity of upgrades which allows remote attackers to execute arbitrary code via software that implements the agent upgrade protocol.


The gssrpc__svcauth_gssapi function in the RPC library in MIT Kerberos 5 (krb5) 1.6.1 and earlier might allow remote attackers to execute arbitrary code via a zero-length RPC credential which causes kadmind to free an uninitialized pointer during cleanup.


Unspecified vulnerability in Microsoft Windows 2000 XP and Server 2003 allows user-assisted remote attackers to execute arbitrary code via unspecified vectors. NOTE: this information is based upon a vague pre-advisory with no actionable information. However the advisory is from a reliable source.


Format string vulnerability in the IBM Lenovo Access Support acpRunner ActiveX control as distributed in acpcontroller.dll before 1.2.8.0 and possibly acpir.dll before 1.0.0.9 (Automated Solutions 1.0 before fix pack 1) allows remote attackers to execute arbitrary code via format string specifiers in unknown data.


The IOCTL handling in srescan.sys in the ZoneAlarm Spyware Removal Engine (SRE) in Check Point ZoneAlarm before 5.0.156.0 allows local users to execute arbitrary code via certain IOCTL lrp parameter addresses.


Integer underflow in Preview in PDFKit on Apple Mac OS X 10.4.10 allows remote attackers to execute arbitrary code via a crafted PDF file.


libmp4v2.dll in Winamp 5.02 through 5.34 allows user-assisted remote attackers to execute arbitrary code via a certain .MP4 file. NOTE: some of these details are obtained from third party information.


The FTP Server in Cisco IOS 11.3 through 12.4 does not properly check user authorization which allows remote attackers to execute arbitrary code and have other impact including reading startup-config as demonstrated by a crafted MKD command that involves access to a VTY device and overflows a buffer aka bug ID CSCek55259.


The admin console in Ignite Realtime Openfire 3.3.0 and earlier (formerly Wildfire) does not properly specify a filter mapping in web.xml which allows remote attackers to gain privileges and execute arbitrary code by accessing functionality that is exposed through DWR as demonstrated using the downloader.


The tblinf32.dll (aka vstlbinf.dll) ActiveX control for Internet Explorer 5.01 6 SP1 and 7 uses an incorrect IObjectsafety implementation which allows remote attackers to execute arbitrary code by requesting the HelpString property involving a crafted DLL file argument to the TypeLibInfoFromFile function which overwrites the HelpStringDll property to call the DLLGetDocumentation function in another DLL file aka \ActiveX Object Vulnerability.\


QuickTime for Java in Apple Quicktime before 7.2 does not properly check permissions which allows remote attackers to disable security controls and execute arbitrary code via crafted Java applets.


Unspecified vulnerability in the Core RDBMS component for Oracle Database 9.0.1.5+ 9.2.0.7 and 10.1.0.4 on Windows systems has unknown impact and attack vectors aka DB03. NOTE: as of 20070424 Oracle has not disputed reliable claims that DB03 occurs because RDBMS uses a NULL Discretionary Access Control List (DACL) for the Oracle process and certain shared memory sections which allows local users to inject threads and execute arbitrary code via the OpenProcess OpenThread and SetThreadContext functions (DB03).


Multiple format string vulnerabilities in FileZilla before 2.2.32 allow remote attackers to execute arbitrary code via format string specifiers in (1) FTP server responses or (2) data sent by an FTP server. NOTE: some of these details are obtained from third party information.


The JDirect support in QuickTime for Java in Apple Quicktime before 7.2 exposes certain dangerous interfaces which allows remote attackers to execute arbitrary code via crafted Java applets.


Quartz Composer on Apple Mac OS X 10.4.10 does not initialize a certain object pointer which might allow user-assisted remote attackers to execute arbitrary code via a crafted Quartz Composer file.


Multiple unspecified \input validation error\ vulnerabilities in multiple ActiveX controls in NavComUI.dll as used in multiple Norton AntiVirus Internet Security and System Works products for 2006 allows remote attackers to execute arbitrary code via (1) the AnomalyList property to AxSysListView32 and (2) Anomaly property to AxSysListView32OAA.


Multiple format string vulnerabilities in AFFLIB 2.2.6 allow remote attackers to execute arbitrary code via certain command line parameters which are used in (1) warn and (2) err calls possibly involving (a) lib/s3.cpp (b) tools/afconvert.cpp (c) tools/afcopy.cpp (d) tools/afinfo.cpp (e) aimage/imager.cpp and (f) tools/afxml.cpp. NOTE: this identifier is intended to address the vectors that were not fixed in CVE-2007-2054 but the unfixed vectors were not explicitly listed.


Multiple format string vulnerabilities in AFFLIB before 2.2.6 allow remote attackers to execute arbitrary code via certain command line parameters which are used in (1) warn and (2) err calls in (a) lib/s3.cpp (b) tools/afconvert.cpp (c) tools/afcopy.cpp (d) tools/afinfo.cpp (e) aimage/aimage.cpp (f) aimage/imager.cpp and (g) tools/afxml.cpp. NOTE: the aimage.cpp vector (e) has since been recalled from the researcher's original advisory since the code is not called in any version of AFFLIB.


The Java interface to CoreAudio on Apple Mac OS X 10.3.9 and 10.4.10 does not properly check the bounds of heap read and write operations which allows remote attackers to execute arbitrary code via a crafted applet.


Unspecified vulnerability in mDNSResponder in Apple Mac OS X allows remote attackers to execute arbitrary code via unspecified vectors a related issue to CVE-2007-2386.


Multiple array index errors in the (1) get_intra_block (2) get_inter_block_h263 and (3) get_inter_block_mpeg functions in src/bitstream/mbcoding.c in Xvid 1.1.2 allow remote attackers to execute arbitrary code via a crafted (a) Avi (b) H.263 or (c) MPEG file.


config/general.php in Quick.Cart 2.2 and earlier uses a default username and password which allows remote attackers to access the application via a login action to admin.php. NOTE: this can be leveraged to upload and execute arbitrary code.


The init script (sysstat.in) in sysstat 5.1.2 up to 7.1.6 creates /tmp/sysstat.run insecurely which allows local users to execute arbitrary code.


The Java interface to CoreAudio on Apple Mac OS X 10.3.9 and 10.4.10 does not restrict object instantiation and manipulation to valid heap addresses which allows remote attackers to execute arbitrary code via a crafted applet.


The IOCTL 9031 (BIOCGSTATS) handler in the NPF.SYS device driver in WinPcap before 4.0.1 allows local users to overwrite memory and execute arbitrary code via malformed Interrupt Request Packet (Irp) parameters.


Unspecified vulnerability in Windows Vista Contacts Gadget in Windows Vista allows user-assisted remote attackers to execute arbitrary code via crafted contact information that is not properly handled when it is imported.


Multiple \pointer overwrite\ vulnerabilities in Ingres database server 2006 9.0.4 r3 2.6 and 2.5 as used in multiple CA (formerly Computer Associates) products allow remote attackers to execute arbitrary code by sending certain TCP data at different times to the Ingres Communications Server Process (iigcc) which calls the (1) QUinsert or (2) QUremove functions with attacker-controlled input.


The Java interface to CoreAudio on Apple Mac OS X 10.3.9 and 10.4.10 contains an unsafe interface that is exposed by JDirect which allows remote attackers to free arbitrary memory and thereby execute arbitrary code.


The Java XML Digital Signature implementation in Sun JDK and JRE 6 before Update 2 does not properly process XSLT stylesheets in XSLT transforms in XML signatures which allows context-dependent attackers to execute arbitrary code via a crafted stylesheet a related issue to CVE-2007-3715.


Unspecified vulnerability in Windows Vista Weather Gadgets in Windows Vista allows remote attackers to execute arbitrary code via crafted HTML attributes.


Multiple

format

string

vulnerabilities

in

qtextedit.cpp

qdatatable.cpp

qsqldatabase.cpp

qsqlindex.cpp

qsqlrecord.cpp

qglobal.cpp

and

qsvgdevice.cpp

in

QTextEdit

in

Trolltech

Qt

before

allow

remote

attackers

to

execute

arbitrary

code

via

format

string

specifiers

in

text

used

to

compose

an

error

message.


Mozilla Firefox before 2.0.0.5 allows remote attackers to execute arbitrary code with chrome privileges by calling an event handler from an unspecified \element outside of a document.\


Unspecified vulnerability in QuickTime for Java in Apple QuickTime before 7.3 allows remote attackers to execute arbitrary code via untrusted Java applets that gain privileges via unspecified vectors.


The kernel in Apple Mac OS X 10.4 through 10.4.10 does not reset the current Mach Thread Port or Thread Exception Port when executing a setuid program which allows local users to execute arbitrary code by creating the port before launching the setuid program then writing to the address space of the setuid process.


CRLF injection vulnerability in Yet another Bulletin Board (YaBB) 2.1 allows remote attackers to obtain administrative access via requests to (1) register.pl or (2) profile.pl that write CRLF sequences to a .vars file. NOTE: this can be leveraged to execute arbitrary code.


Unspecified vulnerability in Microsoft Windows Media Player 7.1 9 10 and 11 allows remote attackers to execute arbitrary code via a skin file (WMZ or WMD) with crafted header information that is not properly handled during decompression aka \Windows Media Player Code Execution Vulnerability Decompressing Skins.\


Camel (camel-imap-folder.c) in the mailer component for Evolution Data Server 1.11 allows remote IMAP servers to execute arbitrary code via a negative SEQUENCE value in GData which is used as an array index.


PHP 4 before 4.4.5 and PHP 5 before 5.2.1 when register_globals is enabled allows context-dependent attackers to execute arbitrary code via deserialization of session data which overwrites arbitrary global variables as demonstrated by calling session_decode on a string beginning with \_SESSION|s:39:\.


The resource system in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allows context-dependent attackers to execute arbitrary code by interrupting certain functions in the GD (ext/gd) extension and unspecified other extensions via a userspace error handler which can be used to destroy and modify internal resources.


Double free vulnerability in the GSS-API library (lib/gssapi/krb5/k5unseal.c) as used by the Kerberos administration daemon (kadmind) in MIT krb5 before 1.6.1 when used with the authentication method provided by the RPCSEC_GSS RPC library allows remote authenticated users to execute arbitrary code and modify the Kerberos key database via a message with an \an invalid direction encoding\.


Microsoft Excel 2000 SP3 2002 SP3 2003 SP2 2003 Viewer and Office Excel 2007 does not properly validate version information which allows user-assisted remote attackers to execute arbitrary code via a crafted Excel file aka \Calculation Error Vulnerability\.


Format

string

vulnerability

in

the

function

in

in

Evolution

Shared

Memo

and

possibly

earlier

versions

allows

user-assisted

remote

attackers

to

execute

arbitrary

code

via

format

specifiers

in

the

categories

of

a

crafted

shared

memo.


Double free vulnerability in the unserializer in PHP 4.4.5 and 4.4.6 allows context-dependent attackers to execute arbitrary code by overwriting variables pointing to (1) the GLOBALS array or (2) the session data in _SESSION. NOTE: this issue was introduced when attempting to patch CVE-2007-1701 (MOPB-31-2007).


Word (or Word Viewer) in Microsoft Office 2000 SP3 XP SP3 2003 SP2 2004 for Mac and Works Suite 2004 2005 and 2006 does not properly parse certain rich text \property strings of certain control words \ which allows user-assisted remote attackers to trigger heap corruption and execute arbitrary code aka the \Word RTF Parsing Vulnerability.\


Unspecified vulnerability in the IOPCServer::RemoveGroup function in the OPCDA interface in Takebishi Electric DeviceXPlorer OLE for Process Control (OPC) Server before 3.12 Build3 allows remote attackers to execute arbitrary code via unspecified vectors involving access to arbitrary memory. NOTE: this issue affects the (1) HIDIC (2) MELSEC (3) FA-M3 (4) MODBUS and (5) SYSMAC OPC Servers.


The PHP COM extensions for PHP on Windows systems allow context-dependent attackers to execute arbitrary code via a WScript.Shell COM object as demonstrated by using the Run method of this object to execute cmd.exe which bypasses PHP's safe mode.


The session extension in PHP 4 before 4.4.5 and PHP 5 before 5.2.1 calculates the reference count for the session variables without considering the internal pointer from the session globals which allows context-dependent attackers to execute arbitrary code via a crafted string in the session_register after unsetting HTTP_SESSION_VARS and _SESSION which destroys the session data Hashtable.


Double free vulnerability in PHP before 4.4.7 and 5.x before 5.2.2 allows context-dependent attackers to execute arbitrary code by interrupting the session_regenerate_id function as demonstrated by calling a userspace error handler or triggering a memory limit violation.


Parallels Desktop for Mac before 20070216 implements Drag and Drop by sharing the entire host filesystem as the .psf share which allows local users of the guest operating system to write arbitrary files to the host filesystem and execute arbitrary code via launchd by writing a plist file to a LaunchAgents directory.


Microsoft Internet Explorer 7.0 on Windows XP and Vista allows remote attackers to conduct phishing attacks and possibly execute arbitrary code via a res: URI to navcancl.htm with an arbitrary URL as an argument which displays the URL in the location bar of the \Navigation Canceled\ page and injects the script into the \Refresh the page\ link aka Navigation Cancel Page Spoofing Vulnerability.\


Cross-zone scripting vulnerability in the DOM templates (domplates) used by the console.log function in the Firebug extension before 1.03 for Mozilla Firefox allows remote attackers to bypass zone restrictions read arbitrary file:// URIs or execute arbitrary code in the browser chrome as demonstrated via the runFile function related to lack of HTML escaping in the property name.


The ovrimos_close function in the Ovrimos extension for PHP before 4.4.5 can trigger efree of an arbitrary address which might allow context-dependent attackers to execute arbitrary code.


Integer signedness error in the _zend_mm_alloc_int function in the Zend Memory Manager in PHP 5.2.0 allows remote attackers to execute arbitrary code via a large emalloc request related to an incorrect signed long cast as demonstrated via the HTTP SOAP client in PHP and via a call to msg_receive with the largest positive integer value of maxsize.


Unspecified vulnerability in Publisher 2007 in Microsoft Office 2007 allows remote attackers to execute arbitrary code via unspecified vectors related to a \file format vulnerability.\ NOTE: this information is based upon a vague pre-advisory with no actionable information. However the advisory is from a reliable source.


The RPC service in mediasvr.exe in CA BrightStor ARCserve Backup 11.5 SP2 build 4237 allows remote attackers to execute arbitrary code via crafted xdr_handle_t data in RPC packets which is used in calculating an address for a function call as demonstrated using the 191 (0xbf) RPC request.


Cross-zone scripting vulnerability in the DOM templates (domplates) used by the console.log function in the Firebug extension before 1.04 for Mozilla Firefox allows remote attackers to bypass zone restrictions read arbitrary file:// URIs or execute arbitrary code in the browser chrome by overwriting the toString function via a certain function declaration related to incorrect identification of anonymous JavaScript functions a different issue than CVE-2007-1878.


Unspecified vulnerability in the EmbeddedWB Web Browser ActiveX control allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


The resource system in PHP 5.0.0 through 5.2.1 allows context-dependent attackers to execute arbitrary code by interrupting the hash_update_file function via a userspace (1) error or (2) stream handler which can then be used to destroy and modify internal resources. NOTE: it was later reported that PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 are also affected.


** DISPUTED ** PatrolAgent.exe in BMC Performance Manager does not require authentication for requests to modify configuration files which allows remote attackers to execute arbitrary code via a request on TCP port 3181 for modification of the masterAgentName and masterAgentStartLine SNMP parameters. NOTE: the vendor disputes this vulnerability stating that it does not exist when the system is properly configured.


index.php in WebMplayer before 0.6.1-Alpha allows remote attackers to execute arbitrary code via shell metacharacters in an exec function call. NOTE: some sources have referred to this as eval injection in the param parameter but CVE source inspection suggests that this is erroneous.


The Hypervisor in Microsoft Xbox 360 kernel 4532 and 4548 does not properly verify the parameters passed to the syscall dispatcher which allows attackers with physical access to bypass code-signing requirements and execute arbitrary code.


Adobe

ColdFusion

MX

for

Linux

and

Solaris

uses

insecure

permissions

for

certain

scripts

and

directories

which

allows

local

users

to

execute

arbitrary

code

or

obtain

sensitive

information

via

the

CFReportBuilderInstaller.exe

.com.zerog.registry.xml

uninstall.lax

license.txt

Readme.htm

.com.zerog.registry.xml

or

files;

or

certain

files

in

lib/wsconfig/.


Double free vulnerability in the session extension in PHP 5.2.0 and 5.2.1 allows context-dependent attackers to execute arbitrary code via illegal characters in a session identifier which is rejected by an internal session storage module which calls the session identifier generator with an improper environment leading to code execution when the generator is interrupted as demonstrated by triggering a memory limit violation or certain PHP errors.


PUBCONV.DLL in Microsoft Office Publisher 2007 does not properly clear memory when transferring data from disk to memory which allows user-assisted remote attackers to execute arbitrary code via a malformed .pub page via a certain negative value which bypasses a sanitization procedure that initializes critical pointers to NULL aka the \Publisher Invalid Memory Reference Vulnerability\.


Multiple integer signedness errors in the printf function family in PHP 4 before 4.4.5 and PHP 5 before 5.2.1 on 64 bit machines allow context-dependent attackers to execute arbitrary code via (1) certain negative argument numbers that arise in the php_formatted_print function because of 64 to 32 bit truncation and bypass a check for the maximum allowable value; and (2) a width and precision of -1 which make it possible for the php_sprintf_appendstring function to place an internal buffer at an arbitrary memory location.


The Javascript engine in Mozilla 1.7 and earlier on Sun Solaris 8 9 and 10 might allow remote attackers to execute arbitrary code via vectors involving garbage collection that causes deletion of a temporary object that is still being used. NOTE: this issue might be related to CVE-2006-3805.


Multiple format string vulnerabilities in comm.c in Rhapsody IRC 0.28b allow remote attackers to execute arbitrary code via format string specifiers to the create_ctcp_message function using the message argument to the (1) me or (2) ctcp commands and possibly related vectors involving the (3) whois (4) mode and (5) topic commands.


The JNILoader ActiveX control (STJNILoader.ocx) 3.1.0.26 in IBM Lotus Notes Sametime before 7.5 allows remote attackers to load arbitrary DLL libraries and execute arbitrary code via arbitrary arguments to the loadLibrary function.


Microsoft Word in Office 2000 SP3 XP SP3 Office 2003 SP2 Works Suite 2004 to 2006 and Office 2004 for Mac does not correctly check the properties of certain documents and warn the user of macro content which allows user-assisted remote attackers to execute arbitrary code.


Microsoft Excel 2000 SP3 2002 SP3 2003 SP2 2004 for Mac and v.X for Mac allows user-assisted remote attackers to execute arbitrary code via a malformed string aka \Excel Malformed String Vulnerability.\


Microsoft Internet Explorer 5.01 SP4 on Windows 2000 SP4; 6 SP1 on Windows 2000 SP4; 6 and 7 on Windows XP SP2 or Windows Server 2003 SP1 or SP2; and possibly 7 on Windows Vista does not properly \instantiate certain COM objects as ActiveX controls \ which allows remote attackers to execute arbitrary code via a crafted COM object from chtskdic.dll.


Word (or Word Viewer) in Microsoft Office 2000 SP3 XP SP3 2003 SP2 2004 for Mac and Works Suite 2004 2005 and 2006 does not properly handle data in a certain array which allows user-assisted remote attackers to execute arbitrary code aka the \Word Array Overflow Vulnerability.\


The HTML Help ActiveX control (Hhctrl.ocx) in Microsoft Windows 2000 SP3 XP SP2 and Professional 2003 SP1 allows remote attackers to execute arbitrary code via unspecified functions related to uninitialized parameters.


The redirect function in Form.pm for (1) LedgerSMB before 1.1.5 and (2) SQL-Ledger allows remote authenticated users to execute arbitrary code via redirects related to callbacks a different issue than CVE-2006-5872.


The Javascript SVG support in Opera before 9.10 does not properly validate object types in a createSVGTransformFromMatrix request which allows remote attackers to execute arbitrary code via JavaScript code that uses an invalid object in this request that causes a controlled pointer to be referenced during the virtual function call.


Integer underflow in the SSLv2 support in Mozilla Network Security Services (NSS) before 3.11.5 as used by Firefox before 1.5.0.10 and 2.x before 2.0.0.2 SeaMonkey before 1.0.8 Thunderbird before 1.5.0.10 and certain Sun Java System server products before 20070611 allows remote attackers to execute arbitrary code via a crafted SSLv2 server message containing a public key that is too short to encrypt the \Master Secret\ which results in a heap-based overflow.


Remote file inclusion vulnerability in scripts2/objcache in cPanel WebHost Manager (WHM) allows remote attackers to execute arbitrary code via a URL in the obj parameter. NOTE: a third party claims that this issue is not file inclusion because the contents are not parsed but the attack can be used to overwrite files in /var/cpanel/objcache or provide unexpected web page contents.


The Tape Engine service in Computer Associates (CA) BrightStor ARCserve Backup 9.01 through 11.5 Enterprise Backup 10.5 and CA Server/Business Protection Suite r2 allows remote attackers to execute arbitrary code via certain data in opnum 0xBF in an RPC request which is directly executed.


scripts/cronscript.php in SysCP 1.2.15 and earlier includes and executes arbitrary PHP scripts that are referenced by the panel_cronscript table in the SysCP database which allows attackers with database write privileges to execute arbitrary code by constructing a PHP file and adding its filename to this table.


Microsoft Internet Explorer 5.01 6 and 7 uses certain COM objects from (1) Msb1fren.dll (2) Htmlmm.ocx and (3) Blnmgrps.dll as ActiveX controls which allows remote attackers to execute arbitrary code via unspecified vectors a different issue than CVE-2006-4697.


Double free vulnerability in the Adobe Acrobat Reader Plugin before 8.0.0 as used in Mozilla Firefox 1.5.0.7 allows remote attackers to execute arbitrary code by causing an error via a javascript: URI call to document.write in the (1) FDF (2) XML or (3) XFDF AJAX request parameters.


The Alibaba Alipay PTA Module ActiveX control (PTA.DLL) allows remote attackers to execute arbitrary code via a JavaScript function that invokes the Remove method with an invalid index argument which is used as an offset for a function call.


Microsoft Excel 2000 2002 2003 Viewer 2003 Office 2004 for Mac and Office v.X for Mac does not properly handle certain opcodes which allows user-assisted remote attackers to execute arbitrary code via a crafted XLS file which results in an \Improper Memory Access Vulnerability.\ NOTE: an early disclosure of this issue used CVE-2006-3432 but only CVE-2007-0028 should be used.


Microsoft Excel 2000 SP3 2002 SP3 2003 SP2 2004 for Mac and v.X for Mac allows user-assisted remote attackers to execute arbitrary code via an Excel file with an out-of-range Column field in certain BIFF8 record types which references arbitrary memory.


Ipswitch WS_FTP Server 5.04 allows FTP site administrators to execute arbitrary code on the system via a long input string to the (1) iFTPAddU or (2) iFTPAddH file or to a (3) edition module.


The LDAP service in Windows Active Directory in Microsoft Windows 2000 Server SP4 Server 2003 SP1 and SP2 Server 2003 x64 Edition and SP2 and Server 2003 for Itanium-based Systems SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted LDAP request with an unspecified number of \convertible attributes.\


Multiple eval injection vulnerabilities in Vote! Pro 4.0 and possibly earlier allow remote attackers to execute arbitrary code via requests to unspecified PHP scripts with the poll_id parameter which is supplied to eval function calls a different set of vectors than CVE-2007-0504. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.


Eval injection vulnerability in poll_frame.php in Vote! Pro 4.0 and possibly other scripts allows remote attackers to execute arbitrary code via the poll_id parameter which is supplied to an eval function call a different vulnerability type than CVE-2005-4632.


Multiple format string vulnerabilities in (1) the cdio_log_handler function in modules/access/cdda/access.c in the CDDA (libcdda_plugin) plugin and the (2) cdio_log_handler and (3) vcd_log_handler functions in modules/access/vcdx/access.c in the VCDX (libvcdx_plugin) plugin in VideoLAN VLC 0.7.0 through 0.8.6 allow user-assisted remote attackers to execute arbitrary code via format string specifiers in an invalid URI as demonstrated by a udp://-- URI in an M3U file.


The DHCP server in EMC VMware Workstation before 5.5.5 Build 56455 and 6.x before 6.0.1 Build 55017 Player before 1.0.5 Build 56455 and Player 2 before 2.0.1 Build 55017 ACE before 1.0.3 Build 54075 and ACE 2 before 2.0.1 Build 55017 and Server before 1.0.4 Build 56528 allows remote attackers to execute arbitrary code via a malformed packet that triggers \corrupt stack memory.\


Multiple eval injection vulnerabilities in iGeneric iG Shop 1.0 allow remote attackers to execute arbitrary code via the action parameter which is supplied to an eval function call in (1) cart.php and (2) page.php. NOTE: a later report and CVE analysis indicate that the vulnerability is present in 1.4.


Microsoft Exchange Server 2000 SP3 2003 SP1 and SP2 and 2007 does not properly decode certain MIME encoded e-mails which allows remote attackers to execute arbitrary code via a crafted base64-encoded MIME e-mail message.


The wininet.dll FTP client code in Microsoft Internet Explorer 5.01 and 6 might allow remote attackers to execute arbitrary code via an FTP server response of a specific length that causes a terminating null byte to be written outside of a buffer which causes heap corruption.


Unspecified vulnerability in the Cryptographic API Component Object Model Certificates ActiveX control (CAPICOM.dll) in Microsoft CAPICOM and BizTalk Server 2004 SP1 and SP2 allows remote attackers to execute arbitrary code via unspecified vectors aka the \CAPICOM.Certificates Vulnerability.\


Microsoft Outlook 2002 and 2003 allows user-assisted remote attackers to execute arbitrary code via a malformed VEVENT record in an .iCal meeting request or ICS file.


Unspecified vulnerability in Microsoft Powerpoint allows remote user-assisted attackers to execute arbitrary code via unknown attack vectors as exploited by Trojan.PPDropper.G. NOTE: as of 20070213 it is not clear whether this is the same issue as CVE-2006-5296 CVE-2006-4694 CVE-2006-3876 CVE-2006-3877 or older issues.


wkcvqd01.dll in Microsoft Works 6 File Converter as used in Office 2003 SP2 Works 8.0 and Works Suite 2005 allows remote attackers to execute arbitrary code via a .wps file with crafted section length headers aka \Microsoft Works File Converter Input Validation Vulnerability.\


Unspecified vulnerability in Microsoft Excel 2000 XP 2003 and 2004 for Mac and possibly other Office products allows remote user-assisted attackers to execute arbitrary code via unknown attack vectors as demonstrated by Exploit-MSExcel.h in targeted zero-day attacks.


Cross-zone scripting vulnerability in Apple Quicktime 3 to 7.1.3 allows remote user-assisted attackers to execute arbitrary code and list filesystem contents via a QuickTime movie (.MOV) with an HREF Track (HREFTrack) that contains an automatic action tag with a local URI which is executed in a local zone during preview as exploited by a MySpace worm.


Unrestricted file upload vulnerability in the Project issue tracking 4.7.0 through 5.x before 20070123 a module for Drupal allows remote authenticated users to execute arbitrary code by attaching a file with executable or multiple extensions to a project issue.


The comment_form_add_preview function in comment.module in Drupal before 4.7.6 and 5.x before 5.1 and vbDrupal allows remote attackers with \post comments\ privileges and access to multiple input filters to execute arbitrary code by previewing comments which are not processed by \normal form validation routines.\


** DISPUTED ** PHP remote file inclusion vulnerability in Trevorchan 0.7 and earlier allows remote attackers to execute arbitrary code via the tc_configrootdir parameter to (1) upgrade.php (2) paint_save.php (3) menu.php (4) manage.php and (5) banned.php. NOTE: his issue has been disputed by reliable third parties who state that the variable is set before use in config.php.


Format string vulnerability in the afsacl.so VFS module in Samba 3.0.6 through 3.0.23d allows context-dependent attackers to execute arbitrary code via format string specifiers in a filename on an AFS file system which is not properly handled during Windows ACL mapping.


The NativeAppServlet in ManageEngine Desktop Central MSP before 90075 allows remote attackers to execute arbitrary code via a crafted JSON object.


The build_index_from_tree function in index.py in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a commit with a directory path starting with .git/ which is not properly handled when checking out a working tree.


Huawei

Tecal

and

earlier

versions

Tecal

Tecal

and

earlier

versions

Tecal

Tecal

and

earlier

versions

Tecal

Tecal

and

earlier

versions

Tecal

and

earlier

versions

Tecal

and

earlier

versions

Tecal

and

earlier

versions

Tecal

and

earlier

versions

Tecal

and

earlier

versions

Tecal

and

earlier

versions

Tecal

and

earlier

versions

Tecal

and

earlier

versions

Tecal

and

earlier

versions

Tecal

and

earlier

versions

Tecal

and

earlier

versions

Tecal

and

earlier

versions

Tecal

and

earlier

versions

Tecal

and

earlier

versions

Tecal

and

earlier

versions

Tecal

and

earlier

versions

Tecal

and

earlier

versions

Tecal

and

earlier

versions

Tecal

and

earlier

versions

Tecal

and

earlier

versions

Tecal

and

earlier

versions

Tecal

and

earlier

versions

Tecal

and

earlier

versions

Tecal

and

earlier

versions

Tecal

and

earlier

versions

Tecal

and

earlier

versions

could

allow

attackers

to

execute

arbitrary

code

or

restart

the

system

via

crafted

DNS

packets.


Insecure use of temporary files in xbindkeys-config 0.1.3-2 allows remote attackers to execute arbitrary code.


Mule Enterprise Management Console (MMC) does not properly restrict access to handler/securityService.rpc which allows remote authenticated users to gain administrator privileges and execute arbitrary code via a crafted request that adds a new user. NOTE: this issue was originally reported for ESB Runtime 3.5.1 but it originates in MMC.


Unrestricted file upload vulnerability in lib_nonajax.php in the CformsII plugin 14.7 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension via the cf_uploadfile2 parameter then accessing the file via a direct request to the file in the default upload directory.


The installer in Thomson Reuters Fixed Assets CS 13.1.4 and earlier uses weak permissions for connectbgdl.exe which allows local users to execute arbitrary code by modifying this program.


The STWConfig ActiveX control in Samsung SmartViewer does not properly initialize a variable which allows remote attackers to execute arbitrary code via unspecified vectors.


functions_vbseo_hook.php in the VBSEO module for vBulletin allows remote authenticated users to execute arbitrary code via the HTTP Referer header to visitormessage.php.


Unrestricted

file

upload

vulnerability

in

in

the

WP

EasyCart

(aka

WordPress

Shopping

Cart)

plugin

before

allows

remote

authenticated

users

to

execute

arbitrary

code

by

uploading

a

file

with

an

executable

extension

then

accessing

it

via

a

direct

request

to

the

file

in

products/banners/.


Dozer improperly uses a reflection-based approach to type conversion which might allow remote attackers to execute arbitrary code via a crafted serialized object.


The AdView.AdViewer.1 ActiveX control in Autodesk Design Review (ADR) before 2013 Hotfix 1 allows remote attackers to execute arbitrary code via a crafted DWF file.


Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.


The gollum-grit_adapter Ruby gem dependency in gollum before 3.1.1 and the gollum-lib gem dependency in gollum-lib before 4.0.1 when the string \master\ is in any of the wiki documents allows remote authenticated users to execute arbitrary code via the -O or --open-files-in-pager flags.


Unrestricted file upload vulnerability in uploadScript.php in InfiniteWP Admin Panel before 2.4.4 when the allWPFiles query parameter is set allows remote attackers to execute arbitrary code by uploading a file with a double extension then accessing it via a direct request to the file in the uploads directory as demonstrated by the .php.swp filename.


Multiple untrusted search path vulnerabilities in Huawei eSpace Desktop before V200R003C00 allow local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) mfc71enu.dll (2) mfc71loc.dll (3) tcapi.dll or (4) airpcap.dll.


Unrestricted file upload vulnerability in UploadHandler.php in the WP Symposium plugin 14.11 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in server/php/.


Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36 5.5.x before 5.5.20 and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys within the serialized properties of an object a different vulnerability than CVE-2004-1019.


The TLS/SSL Server in McAfee Network Data Loss Prevention (NDLP) before 9.3 uses weak cipher algorithms which makes it easier for remote authenticated users to execute arbitrary code via unspecified vectors.


Pluck CMS 4.7.2 allows remote attackers to execute arbitrary code via the blog form feature.


Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery as used in the Creative Solutions Creative Contact Form (formerly Sexy Contact Form) before 1.0.0 for WordPress and before 2.0.1 for Joomla! allows remote attackers to execute arbitrary code by uploading a PHP file with an PHP extension then accessing it via a direct request to the file in files/ as exploited in the wild in October 2014.


The xpc_data_get_bytes function in libxpc in Apple OS X before 10.10.2 does not verify that a dictionary's Attributes key has the xpc_data data type which allows attackers to execute arbitrary code by providing a crafted dictionary to sysmond related to an \XPC type confusion\ issue.


A .desktop file in the Debian openjdk-7 package 7u79-2.5.5-1~deb8u1 includes a MIME type registration that is added to /etc/mailcap by mime-support which allows remote attackers to execute arbitrary code via a JAR file.


The browsing feature in the server in CUPS does not filter ANSI escape sequences from shared printer names which might allow remote attackers to execute arbitrary code via a crafted printer name.


cloner.functions.php

in

the

XCloner

plugin

for

WordPress

and

for

Joomla!

allows

remote

administrators

to

execute

arbitrary

code

via

shell

metacharacters

in

the

file

name

when

creating

a

backup

or

vectors

related

to

the

$exclude

or

$sqlfile

variable.


BMC Track-It! 11.3 allows remote attackers to gain privileges and execute arbitrary code by creating an account whose name matches that of a local system account then performing a password reset.


The NcrCtl4.NcrNet.1 control in Panasonic Network Camera Recorder before 4.04R03 allows remote attackers to execute arbitrary code via a crafted GetVOLHeader method call which writes null bytes to an arbitrary address.


AVM FRITZ!OS before 6.30 extracts the contents of firmware updates before verifying their cryptographic signature which allows remote attackers to create symlinks or overwrite critical files and consequently execute arbitrary code via a crafted firmware image.


The UberFire Framework 0.3.x does not properly restrict paths which allows remote attackers to (1) execute arbitrary code by uploading crafted content to FileUploadServlet or (2) read arbitrary files via vectors involving FileDownloadServlet.


The SAP Promotion Guidelines (CRM-MKT-MPL-TPM-PPG) module for SAP CRM allows remote attackers to execute arbitrary code via unspecified vectors.


Use-after-free vulnerability in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux Adobe AIR before 15.0.0.356 Adobe AIR SDK before 15.0.0.356 and Adobe AIR SDK & Compiler before 15.0.0.356 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2014-0573 and CVE-2014-0588.


coresymbolicationd in CoreSymbolication in Apple OS X before 10.10.2 does not verify that expected data types are present in XPC messages which allows attackers to execute arbitrary code in a privileged context via a crafted app as demonstrated by lack of verification of xpc_dictionary_get_value API return values during handling of a (1) match_mmap_archives (2) delete_mmap_archives (3) write_mmap_archive or (4) read_mmap_archive command.


The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2 SonicWALL Analyzer before 7.2 SP2 and SonicWALL UMA before 7.2 SP2 allows remote authenticated users to execute arbitrary code via unspecified vectors.


Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute arbitrary code via a crafted HTML document in conjunction with a Cascading Style Sheets (CSS) token sequence specifying the run-in value for the display property leading to improper CElement reference counting.


eDeploy makes it easier for remote attackers to execute arbitrary code by leveraging use of HTTP to download files.


Unrestricted

file

upload

vulnerability

in

in

HelpDEZk

and

earlier

allows

remote

attackers

to

execute

arbitrary

code

by

uploading

a

file

with

an

executable

extension

then

accessing

it

via

a

direct

request

to

the

file

in

the

directory

specified

by

the

folder

parameter.


The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request.


Unrestricted file upload vulnerability in the Photo functionality in DigitalVidhya Digi Online Examination System 2.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in assets/uploads/images/.


Unspecified vulnerability in the Java Virtual Machine (JVM) in IBM SDK Java Technology Edition 5.0 before SR16-FP9 6 before SR16-FP3 6R1 before SR8-FP3 7 before SR8-FP10 and 7R1 before SR2-FP10 allows remote attackers to escape the Java sandbox and execute arbitrary code via unspecified vectors related to the security manager.


Seagate Business NAS devices with firmware before 2015.00322 allow remote attackers to execute arbitrary code with root privileges by leveraging use of a static encryption key to create session tokens.


The WinCC server in Siemens SIMATIC WinCC 7.0 through SP3 7.2 before Update 9 and 7.3 before Update 2; SIMATIC PCS 7 7.1 through SP4 8.0 through SP2 and 8.1; and TIA Portal 13 before Update 6 allows remote attackers to execute arbitrary code via crafted packets.


Unrestricted file upload vulnerability in magmi/web/magmi.php in the MAGMI (aka Magento Mass Importer) plugin 0.7.17a and earlier for Magento Community Edition (CE) allows remote authenticated users to execute arbitrary code by uploading a ZIP file that contains a PHP file then accessing the PHP file via a direct request to it in magmi/plugins/.


The scheduler in HTCondor before 8.2.6 allows remote authenticated users to execute arbitrary code.


Multiple untrusted search path vulnerabilities in Corel CAD 2014 allow local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) FxManagedCommands_3.08_9.tx or (2) TD_Mgd_3.08_9.dll file in the current working directory.


Multiple untrusted search path vulnerabilities in Corel FastFlick allow local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) igfxcmrt32.dll (2) ipl.dll (3) MSPStyleLib.dll (4) uFioUtil.dll (5) uhDSPlay.dll (6) uipl.dll (7) uvipl.dll (8) VC1DecDll.dll or (9) VC1DecDll_SSE3.dll file that is located in the same folder as the file being processed.


The default D-Bus access control rule in Midgard2 10.05.7.1 allows local users to send arbitrary method calls or signals to any process on the system bus and possibly execute arbitrary code with root privileges.


GleamTech FileVista before 6.1 allows remote authenticated users to create arbitrary files and possibly execute arbitrary code via a crafted path in a zip archive which is not properly handled during extraction.


scripts/amsvis/powerpcAMS/amsnet.py in powerpc-utils-python uses the pickle Python module unsafely which allows remote attackers to execute arbitrary code via a crafted serialized object.


Panasonic Network Camera View 3 and 4 allows remote attackers to execute arbitrary code via a crafted page which triggers an invalid pointer dereference related to \the ability to nullify an arbitrary address in memory.\


The XStream extension in HP Fortify SCA before 2.2 RC3 allows remote attackers to execute arbitrary code via unsafe deserialization of XML messages.


Unrestricted file upload vulnerability in the Manage Project functionality in Livetecs Timelive before 6.5.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in a predictable directory in Uploads/.


The dmarc_process function in dmarc.c in Exim before 4.82.1 when EXPERIMENTAL_DMARC is enabled allows remote attackers to execute arbitrary code via the From header in an email which is passed to the expand_string function.


The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtained by unserializing Lucene search data which allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via vectors involving a Zend_Pdf_ElementFactory_Proxy object and a pathname with a trailing \\0 character.


fish (aka fish-shell) 2.0.0 before 2.1.1 does not restrict access to the configuration service (aka fish_config) which allows remote attackers to execute arbitrary code via unspecified vectors as demonstrated by set_prompt.


Unspecified

vulnerability

in

Spotfire

Web

Player

Engine

Spotfire

Desktop

and

Spotfire

Server

Authentication

Module

in

TIBCO

Spotfire

Server

before

before

before

before

and

before

Spotfire

Professional

before

before

before

before

and

before

Spotfire

Web

Player

before

before

before

before

and

before

Spotfire

Automation

Services

before

before

before

before

and

before

Spotfire

Deployment

Kit

before

before

before

before

and

before

Spotfire

Desktop

before

and

Spotfire

Analyst

before

allows

remote

attackers

to

execute

arbitrary

code

via

unknown

vectors.


EMC Documentum Content Server before 6.7 SP1 P28 6.7 SP2 before P15 7.0 before P15 and 7.1 before P06 does not properly check authorization after creation of an object which allows remote authenticated users to execute arbitrary code with super-user privileges via a custom script.


The Java Glassfish Admin Console in HP Executive Scorecard 9.40 and 9.41 does not require authentication which allows remote attackers to execute arbitrary code via a session on TCP port 10001 aka ZDI-CAN-2116.


Autodesk VRED Professional 2014 before SR1 SP8 allows remote attackers to execute arbitrary code via Python os library calls in Python API commands to the integrated web server.


Sensys Networks VSN240-F and VSN240-T sensors VDS before 2.10.1 and TrafficDOT before 2.10.3 do not verify the integrity of downloaded updates which allows remote attackers to execute arbitrary code via a Trojan horse update.


OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules allow remote attackers to execute arbitrary code via packets that report a high battery voltage.


Unrestricted file upload vulnerability in an unspecified third party tool in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via unknown vectors.


NETGEAR GS108PE Prosafe Plus switches with firmware 1.2.0.5 have a hardcoded password of debugpassword for the ntgruser account which allows remote attackers to upload firmware or read or modify memory contents and consequently execute arbitrary code via a request to (1) produce_burn.cgi (2) register_debug.cgi or (3) bootcode_update.cgi.


Unrestricted file upload vulnerability in plog-admin/plog-upload.php in Plogger 1.0 RC1 and earlier allows remote authenticated users to execute arbitrary code by uploading a ZIP file that contains a PHP file and a non-zero length PNG file then accessing the PHP file via a direct request to it in plog-content/uploads/archive/.


Unrestricted file upload vulnerability in op/op.AddFile2.php in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allows remote attackers to execute arbitrary code by uploading a file with an executable extension specified by the partitionIndex parameter and leveraging CVE-2014-2279.2 to access it via the directory specified by the fileId parameter.


eGroupware

before

allows

remote

attackers

to

conduct

PHP

object

injection

attacks

delete

arbitrary

files

and

possibly

execute

arbitrary

code

via

the

or

trans

parameter

to

or

trans

parameter

to

or

trans

parameter

to

in

(a)

projectmanager/

or

(b)

infolog/

or

processed

parameter

to


Incomplete blacklist vulnerability in ajax/upload.php in ownCloud before 5.0 when running on Windows allows remote authenticated users to bypass intended access restrictions upload files with arbitrary names and execute arbitrary code via an Alternate Data Stream (ADS) syntax in the filename parameter as demonstrated using .htaccess::$DATA to upload a PHP program.


Cisco Wide Area Application Services (WAAS) 5.1.1 before 5.1.1e when SharePoint prefetch optimization is enabled allows remote SharePoint servers to execute arbitrary code via a malformed response aka Bug ID CSCue18479.


EMC Documentum Content Server before 6.7 SP1 P28 6.7 SP2 before P15 7.0 before P15 and 7.1 before P06 does not properly check authorization and does not properly restrict object types which allows remote authenticated users to run save RPC commands with super-user privileges and consequently execute arbitrary code via unspecified vectors.


JustSystems JUST Online Update as used in Ichitaro through 2014 and other products does not properly validate signatures of update modules which allows remote attackers to spoof modules and execute arbitrary code via a crafted signature.


Cisco Secure Access Control Server (ACS) provides an unintentional administration web interface based on Apache Tomcat which allows remote authenticated users to modify application files and configuration files and consequently execute arbitrary code by leveraging administrative privileges aka Bug ID CSCuj83189.


Absolute path traversal vulnerability in the RadAsyncUpload control in the RadControls in Telerik UI for ASP.NET AJAX before Q3 2012 SP2 allows remote attackers to write to arbitrary files and consequently execute arbitrary code via a full pathname in the UploadID metadata value.


Unrestricted

file

upload

vulnerability

in

the

ProfileController::actionUploadPhoto

method

in

in

before

allows

remote

attackers

to

execute

arbitrary

code

by

uploading

a

file

with

an

executable

extension

then

accessing

it

via

a

direct

request

to

the

file

in

an

unspecified

directory.


The End User Safelist/Blocklist (aka SLBL) service in Cisco AsyncOS Software for Email Security Appliance (ESA) before 7.6.3-023 and 8.x before 8.0.1-023 and Cisco Content Security Management Appliance (SMA) before 7.9.1-110 and 8.x before 8.1.1-013 allows remote authenticated users to execute arbitrary code with root privileges via an FTP session that uploads a modified SLBL database file aka Bug IDs CSCug79377 and CSCug80118.


Bottle 0.10.x before 0.10.12 0.11.x before 0.11.7 and 0.12.x before 0.12.6 does not properly limit content types which allows remote attackers to bypass intended access restrictions via an accepted Content-Type followed by a ; (semi-colon) and a Content-Type that would not be accepted as demonstrated in YouCompleteMe to execute arbitrary code.


Samsung

iPOLiS

Device

Manager

before

allow

remote

attackers

to

execute

arbitrary

code

via

unspecified

values

to

the

Start

ChangeControlLocalName

DeleteDeviceProfile

FrameAdvanceReader

or

other

unknown

method

in

the

XNSSDKDEVICE.XnsSdkDeviceCtrlForIpInstaller.1

ActiveX

control.


IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.


NetBIOS name services daemon (nmbd) in Samba 4.0.x before 4.0.21 and 4.1.x before 4.1.11 allows remote attackers to execute arbitrary code via unspecified vectors that modify heap memory involving a sizeof operation on an incorrect variable in the unstrcpy macro in string_wrappers.h.


Moodle through 2.3.11 2.4.x before 2.4.11 2.5.x before 2.5.7 2.6.x before 2.6.4 and 2.7.x before 2.7.1 allows remote authenticated users to execute arbitrary code via a calculated question in a quiz.


The Repositories component in Moodle through 2.3.11 2.4.x before 2.4.11 2.5.x before 2.5.7 2.6.x before 2.6.4 and 2.7.x before 2.7.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via serialized data associated with an add-on.


XML external entity (XXE) vulnerability in Zabbix 1.8.x before 1.8.21rc1 2.0.x before 2.0.13rc1 2.2.x before 2.2.5rc1 and 2.3.x before 2.3.2 allows remote attackers to read arbitrary files or potentially execute arbitrary code via a crafted DTD in an XML request.


Google Chrome before 38.0.2125.101 and Chrome OS before 38.0.2125.101 do not properly handle the interaction of IPC and Google V8 which allows remote attackers to execute arbitrary code via vectors involving JSON data related to improper parsing of an escaped index by ParseJsonObject in json-parser.h.


Google Chrome before 37.0.2062.94 does not properly handle the interaction of extensions IPC the sync API and Google V8 which allows remote attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2014-3176.


jmx-remoting.sar in JBoss Remoting as used in Red Hat JBoss Enterprise Application Platform (JEAP) 5.2.0 Red Hat JBoss BRMS 5.3.1 Red Hat JBoss Portal Platform 5.2.2 and Red Hat JBoss SOA Platform 5.3.1 does not properly implement the JSR 160 specification which allows remote attackers to execute arbitrary code via unspecified vectors.


base/oi/doa.py in the Rope library in CPython (aka Python) allows remote attackers to execute arbitrary code by leveraging an unsafe call to pickle.load.


Unspecified

vulnerability

in

IBM

Java

Runtime

Environment

(JRE)

before

before

before

before

and

before

allows

local

users

to

execute

arbitrary

code

via

vectors

related

to

the

shared

classes

cache.


The SPL component in PHP before 5.4.30 and 5.5.x before 5.5.14 incorrectly anticipates that certain data structures will have the array data type after unserialization which allows remote attackers to execute arbitrary code via a crafted string that triggers use of a Hashtable destructor related to \type confusion\ issues in (1) ArrayObject and (2) SPLObjectStorage.


The MiniIcpt.sys driver in G Data TotalProtection 2014 24.0.2.1 and earlier allows local users with administrator rights to execute arbitrary code with SYSTEM privileges via a crafted 0x83170180 call.


Jenkins before 1.587 and LTS before 1.580.1 do not properly ensure trust separation between a master and slaves which might allow remote attackers to execute arbitrary code on the master by leveraging access to the slave.


Google Chrome before 37.0.2062.94 does not properly handle the interaction of extensions IPC the sync API and Google V8 which allows remote attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2014-3177.


The Cart::getProducts method in system/library/cart.php in OpenCart 1.5.6.4 and earlier allows remote attackers to conduct server-side request forgery (SSRF) attacks or possibly conduct XML External Entity (XXE) attacks and execute arbitrary code via a crafted serialized PHP object related to the quantity parameter in an update request.


Seagate

BlackArmor

NAS

allows

remote

attackers

to

execute

arbitrary

code

via

the

session

parameter

to

or

the

parameter

to


The ConvolveHorizontally function in Skia as used in Mozilla Firefox before 31.0 Firefox ESR 24.x before 24.7 and Thunderbird before 24.7 does not properly handle the discarding of image data during function execution which allows remote attackers to execute arbitrary code by triggering prolonged image scaling as demonstrated by scaling of a high-quality image.


GDI+ in Microsoft Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT Gold and 8.1 Office 2007 SP3 and 2010 SP1 and SP2 Live Meeting 2007 Console Lync 2010 and 2013 Lync 2010 Attendee and Lync Basic 2013 allows remote attackers to execute arbitrary code via a crafted EMF+ record in an image file aka \GDI+ Image Parsing Vulnerability.\


The boot implementation in Google Chrome OS before 33.0.1750.152 does not properly consider file persistence which allows remote attackers to execute arbitrary code via unspecified vectors.


Microsoft Word 2007 SP3 and 2010 SP1 and SP2 and Office Compatibility Pack SP3 allocates memory incorrectly for file conversions from a binary (aka .doc) format to a newer format which allows remote attackers to execute arbitrary code via a crafted document aka \Microsoft Office File Format Converter Vulnerability.\


The auto-format feature in the Request_Curl class in FuelPHP 1.1 through 1.7.1 allows remote attackers to execute arbitrary code via a crafted response.


The shell_quote function in python-gnupg 0.3.5 does not properly quote strings which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors as demonstrated using \$(\ command-substitution sequences a different vulnerability than CVE-2014-1928. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.


Unspecified vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code with medium-integrity privileges and bypass a sandbox protection mechanism via unknown vectors as demonstrated by ZDI during a Pwn4Fun competition at CanSecWest 2014.


Intel Compute in Apple OS X before 10.9.4 does not properly restrict an unspecified OpenCL API call which allows attackers to execute arbitrary code via a crafted application.


Use-after-free vulnerability in Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism via unspecified vectors as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014.


The Web workers implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allows remote attackers to execute arbitrary code via vectors involving termination of a worker process that has performed a cross-thread object-passing operation in conjunction with use of asm.js.


Use-after-free vulnerability in DirectionalityUtils.cpp in Mozilla Firefox before 32.0 Firefox ESR 24.x before 24.8 and 31.x before 31.1 and Thunderbird 24.x before 24.8 and 31.x before 31.1 allows remote attackers to execute arbitrary code via text that is improperly handled during the interaction between directionality resolution and layout.


Use-after-free vulnerability in the nsHtml5TreeOperation function in xul.dll in Mozilla Firefox before 34.0 Firefox ESR 31.x before 31.3 Thunderbird before 31.3 and SeaMonkey before 2.31 allows remote attackers to execute arbitrary code by adding a second root element to an HTML5 document during parsing.


Multiple use-after-free vulnerabilities in Microsoft Internet Explorer 6 through 11 allow remote attackers to execute arbitrary code via unspecified vectors as demonstrated by Sebastian Apelt and Andreas Schmidt during a Pwn2Own competition at CanSecWest 2014.


Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network Security Services (NSS) 3.x as used in Firefox before 31.0 Firefox ESR 24.x before 24.7 and Thunderbird before 24.7 allows remote attackers to execute arbitrary code via vectors that trigger certain improper removal of an NSSCertificate structure from a trust domain.


Integer underflow in launchd in Apple iOS before 7.1.2 Apple OS X before 10.9.4 and Apple TV before 6.1.2 allows attackers to execute arbitrary code via a crafted application.


Use-after-free vulnerability in the imgRequestProxy function in Mozilla Firefox before 27.0 Firefox ESR 24.x before 24.3 Thunderbird before 24.3 and SeaMonkey before 2.24 allows remote attackers to execute arbitrary code via vectors involving unspecified Content-Type values for image data.


Microsoft Web Applications 2010 SP1 and SP2 allows remote authenticated users to execute arbitrary code via crafted page content aka \Web Applications Page Content Vulnerability.\


Mozilla Firefox before 34.0 Firefox ESR 31.x before 31.3 Thunderbird before 31.3 and SeaMonkey before 2.31 might allow remote attackers to execute arbitrary code by leveraging an incorrect cast from the BasicThebesLayer data type to the BasicContainerLayer data type.


The shell_quote function in python-gnupg 0.3.5 does not properly escape characters which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors as demonstrated using \\\\ (backslash) characters to form multi-command sequences a different vulnerability than CVE-2014-1927. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.


The .NET Remoting implementation in Microsoft .NET Framework 1.1 SP1 2.0 SP2 3.5 3.5.1 4 4.5 and 4.5.1 does not properly restrict memory access which allows remote attackers to execute arbitrary code via vectors involving malformed objects aka \TypeFilterLevel Vulnerability.\


Use-after-free vulnerability in the nsDocLoader::OnProgress function in Mozilla Firefox before 31.0 Firefox ESR 24.x before 24.7 and Thunderbird before 24.7 allows remote attackers to execute arbitrary code via vectors that trigger a FireOnStateChange event.


Use-after-free vulnerability in the FontTableRec destructor in Mozilla Firefox before 31.0 Firefox ESR 24.x before 24.7 and Thunderbird before 24.7 on Windows allows remote attackers to execute arbitrary code via crafted use of fonts in MathML content leading to improper handling of a DirectWrite font-face object.


Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaScript code that interacts improperly with a CollectGarbage function call on a CMarkup object allocated by the CMarkup::CreateInitialMarkup function.


Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism by leveraging \object confusion\ in a broker process as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014.


Use-after-free vulnerability in the TypeObject class in the JavaScript engine in Mozilla Firefox before 28.0 Firefox ESR 24.x before 24.4 Thunderbird before 24.4 and SeaMonkey before 2.25 allows remote attackers to execute arbitrary code by triggering extensive memory consumption while garbage collection is occurring as demonstrated by improper handling of BumpChunk objects.


Use-after-free vulnerability in DirectionalityUtils.cpp in Mozilla Firefox before 33.0 Firefox ESR 31.x before 31.2 and Thunderbird 31.x before 31.2 allows remote attackers to execute arbitrary code via text that is improperly handled during the interaction between directionality resolution and layout.


The integrated web server in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to execute arbitrary code via crafted packets to TCP port 4999.


S3QL 1.18.1 and earlier uses the pickle Python module unsafely which allows remote attackers to execute arbitrary code via a crafted serialized object in (1) common.py or (2) local.py in backends/.


Unspecified vulnerability in JustSystems Sanshiro 2007 before update 3 2008 before update 5 2009 before update 6 and 2010 before update 6 and Sanshiro Viewer before 2.0.2.0 allows remote attackers to execute arbitrary code via a crafted document.


The GUI in EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 does not properly validate session-timeout values which might make it easier for remote attackers to execute arbitrary code by leveraging an unattended workstation.


The SPDY implementation in the ngx_http_spdy_module module in nginx 1.5.10 before 1.5.11 when running on a 32-bit platform allows remote attackers to execute arbitrary code via a crafted request.


The API in Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X does not prevent access to unmapped memory which allows attackers to execute arbitrary code via unspecified API calls.


The Adobe Reader Mobile application before 11.2 for Android does not properly restrict use of JavaScript which allows remote attackers to execute arbitrary code via a crafted PDF document a related issue to CVE-2012-6636.


Use-after-free vulnerability in Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux Adobe AIR before 15.0.0.249 on Windows and OS X and before 15.0.0.252 on Android Adobe AIR SDK before 15.0.0.249 and Adobe AIR SDK & Compiler before 15.0.0.249 allows attackers to execute arbitrary code via unspecified vectors.


Microsoft Forefront Protection 2010 for Exchange Server does not properly parse e-mail content which might allow remote attackers to execute arbitrary code via a crafted message aka \RCE Vulnerability.\


Unspecified vulnerability in Jazz Team Server in IBM Rational Collaborative Lifecycle Management (CLM) 3.x before 3.0.1.6 iFix 2 and 4.x before 4.0.6 allows remote attackers to execute arbitrary code via unknown vectors.


The thraneLINK protocol implementation on Cobham devices does not verify firmware signatures which allows attackers to execute arbitrary code by leveraging physical access or terminal access to send an SNMP request and a TFTP response.


org.jboss.seam.web.AuthenticationFilter in Red Hat JBoss Web Framework Kit 2.5.0 JBoss Enterprise Application Platform (JBEAP) 5.2.0 and JBoss Enterprise Web Platform (JBEWP) 5.2.0 allows remote attackers to execute arbitrary code via a crafted authentication header related to Seam logging.


The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allows remote attackers to execute arbitrary code via shell metacharacters in input to the (1) detectWeather (2) set_language (3) SystemCommand or (4) NTPSyncWithHost function in management.c or a (5) SET COUNTRY (6) SET WLAN SSID (7) SET WLAN CHANNEL (8) SET WLAN STATUS or (9) SET WLAN COUNTRY udps command.


IBM Notes and Domino 8.5.x before 8.5.3 FP6 IF3 and 9.x before 9.0.1 FP1 on 32-bit Linux platforms use incorrect gcc options which makes it easier for remote attackers to execute arbitrary code by leveraging the absence of the NX protection mechanism and placing crafted x86 code on the stack aka SPR KLYH9GGS9W.


VsaVb7rt.dll in Microsoft .NET Framework 2.0 SP2 and 3.5.1 does not implement the ASLR protection mechanism which makes it easier for remote attackers to execute arbitrary code via a crafted web site as exploited in the wild in February 2014 aka \VSAVB7RT ASLR Vulnerability.\


Microsoft

Windows

SharePoint

Services

SharePoint

Server

and

and

Gold

and

SharePoint

Foundation

and

and

Gold

and

Project

Server

and

and

Gold

and

Web

Applications

and

Office

Web

Apps

Server

Gold

and

SharePoint

Server

Client

Components

SDK;

and

SharePoint

Designer

and

and

Gold

and

allow

remote

authenticated

users

to

execute

arbitrary

code

via

crafted

page

content

aka

\SharePoint

Page

Content

Vulnerability.\


Apache Commons BeanUtils as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2 does not suppress the class property which allows remote attackers to \manipulate\ the ClassLoader and execute arbitrary code via the class parameter as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.


The apt-get download command in APT before 1.0.9 does not properly validate signatures for packages which allows remote attackers to execute arbitrary code via a crafted package.


Use-after-free vulnerability in Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android Adobe AIR SDK before 14.0.0.178 and Adobe AIR SDK & Compiler before 14.0.0.178 allows attackers to execute arbitrary code via unspecified vectors.


Use-after-free vulnerability in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux Adobe AIR before 15.0.0.356 Adobe AIR SDK before 15.0.0.356 and Adobe AIR SDK & Compiler before 15.0.0.356 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2014-0588 and CVE-2014-8438.


Sonatype Nexus 1.x and 2.x before 2.7.1 allows remote attackers to create arbitrary objects and execute arbitrary code via unspecified vectors related to unmarshalling of unintended Object types.


Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux Adobe AIR before 15.0.0.356 Adobe AIR SDK before 15.0.0.356 and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code by leveraging an unspecified \type confusion \ a different vulnerability than CVE-2014-0584 CVE-2014-0585 CVE-2014-0586 and CVE-2014-0590.


Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux Adobe AIR before 15.0.0.356 Adobe AIR SDK before 15.0.0.356 and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code by leveraging an unspecified \type confusion \ a different vulnerability than CVE-2014-0577 CVE-2014-0584 CVE-2014-0585 and CVE-2014-0590.


ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method which allows remote attackers to \manipulate\ the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.


Use-after-free vulnerability in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux Adobe AIR before 15.0.0.356 Adobe AIR SDK before 15.0.0.356 and Adobe AIR SDK & Compiler before 15.0.0.356 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2014-0573 and CVE-2014-8438.


Microsoft .NET Framework 1.0 SP3 1.1 SP1 2.0 SP2 3.5 3.5.1 4 4.5 and 4.5.1 does not properly determine whether it is safe to execute a method which allows remote attackers to execute arbitrary code via (1) a crafted web site or (2) a crafted .NET Framework application that exposes a COM server endpoint aka \Type Traversal Vulnerability.\


Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux Adobe AIR before 15.0.0.356 Adobe AIR SDK before 15.0.0.356 and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code by leveraging an unspecified \type confusion \ a different vulnerability than CVE-2014-0577 CVE-2014-0584 CVE-2014-0585 and CVE-2014-0586.


The Terminal Upgrade Tool in the Pilot Below Deck Equipment (BDE) and OpenPort implementations on Iridium satellite terminals allows remote attackers to execute arbitrary code by uploading new firmware to TCP port 54321.


Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux Adobe AIR before 15.0.0.356 Adobe AIR SDK before 15.0.0.356 and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code by leveraging an unspecified \type confusion \ a different vulnerability than CVE-2014-0577 CVE-2014-0585 CVE-2014-0586 and CVE-2014-0590.


Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code CMarkup and the onpropertychange attribute of a script element as exploited in the wild in January and February 2014.


The slapper function in chkrootkit before 0.50 does not properly quote file paths which allows local users to execute arbitrary code via a Trojan horse executable. NOTE: this is only a vulnerability when /tmp is not mounted with the noexec option.


Double free vulnerability in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux Adobe AIR before 15.0.0.356 Adobe AIR SDK before 15.0.0.356 and Adobe AIR SDK & Compiler before 15.0.0.356 allows attackers to execute arbitrary code via unspecified vectors.


Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux Adobe AIR before 15.0.0.356 Adobe AIR SDK before 15.0.0.356 and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code by leveraging an unspecified \type confusion \ a different vulnerability than CVE-2014-0577 CVE-2014-0584 CVE-2014-0586 and CVE-2014-0590.


Multiple

array

index

errors

in

programs

that

are

automatically

generated

by

in

Oracle

VirtualBox

through

and

before

when

using

Acceleration

allow

local

guest

OS

users

to

execute

arbitrary

code

on

the

Chromium

server

via

certain

messages

with

a

crafted

index

which

are

not

properly

handled

by

the

to

the

function

to

the

function

to

the

function

to

the

function

to

the

function

to

the

function

to

the

function

to

the

function

to

the

function

to

the

function

to

the

function

to

the

function

and

to

the

function.


Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X and before 11.2.202.336 on Linux allows remote attackers to execute arbitrary code via unspecified vectors.


CookieInterceptor in Apache Struts before 2.3.20 when a wildcard cookiesName value is used does not properly restrict access to the getClass method which allows remote attackers to \manipulate\ the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.


Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux Adobe AIR before 4.0.0.1628 on Android Adobe AIR SDK before 4.0.0.1628 and Adobe AIR SDK & Compiler before 4.0.0.1628 allows remote attackers to execute arbitrary code via unspecified vectors as exploited in the wild in February 2014.


The update process in IBM Security AppScan Standard 7.9 through 8.8 does not require integrity checks of downloaded files which allows remote attackers to execute arbitrary code via a crafted file.


Use-after-free vulnerability in Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux Adobe AIR before 13.0.0.83 on Android Adobe AIR SDK before 13.0.0.83 and Adobe AIR SDK & Compiler before 13.0.0.83 allows remote attackers to execute arbitrary code and possibly bypass an Internet Explorer sandbox protection mechanism via unspecified vectors as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014.


An unspecified integrated graphics driver routine in the Intel Graphics Driver subsystem in Apple OS X before 10.9.5 does not properly validate calls which allows attackers to execute arbitrary code in a privileged context via a crafted application a different vulnerability than CVE-2014-4395 CVE-2014-4396 CVE-2014-4397 CVE-2014-4398 CVE-2014-4399 CVE-2014-4400 CVE-2014-4401 and CVE-2014-4416.


Microsoft Office 2007 SP3 Word 2007 SP3 Office 2010 SP1 and SP2 Word 2010 SP1 and SP2 Office for Mac 2011 Office Compatibility Pack SP3 Word Automation Services on SharePoint Server 2010 SP1 and SP2 and Word Web Apps 2010 Gold SP1 and SP2 allow remote attackers to execute arbitrary code via crafted properties in a Word document aka \Microsoft Word File Format Vulnerability.\