An unspecified integrated graphics driver routine in the Intel Graphics Driver subsystem in Apple OS X before 10.9.5 does not properly validate calls which allows attackers to execute arbitrary code in a privileged context via a crafted application a different vulnerability than CVE-2014-4394 CVE-2014-4395 CVE-2014-4396 CVE-2014-4397 CVE-2014-4398 CVE-2014-4399 CVE-2014-4401 and CVE-2014-4416.


IOKit in Apple iOS before 8 and Apple TV before 7 does not properly validate IODataQueue object metadata which allows attackers to execute arbitrary code in a privileged context via an application that provides crafted values in unspecified metadata fields a different vulnerability than CVE-2014-4388.


Ansible before 1.6.7 does not prevent inventory data with \{{\ and \lookup\ substrings and does not prevent remote data with \{{\ substrings which allows remote attackers to execute arbitrary code via (1) crafted lookup('pipe') calls or (2) crafted Jinja2 data.


IOKit in Apple iOS before 8 and Apple TV before 7 does not properly validate IODataQueue object metadata which allows attackers to execute arbitrary code in a privileged context via an application that provides crafted values in unspecified metadata fields a different vulnerability than CVE-2014-4418.


Unrestricted file upload vulnerability in the Gravity Upload Ajax plugin 1.1 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file under wp-content/uploads/gravity_forms.


The IOHIDFamily kernel extension in Apple iOS before 8 and Apple TV before 7 lacks proper bounds checking on write operations which allows attackers to execute arbitrary code in the kernel's context via a crafted application.


The safe_eval function in Ansible before 1.5.4 does not properly restrict the code subset which allows remote attackers to execute arbitrary code via crafted instructions.


An unspecified integrated graphics driver routine in the Intel Graphics Driver subsystem in Apple OS X before 10.9.5 does not properly validate calls which allows attackers to execute arbitrary code in a privileged context via a crafted application a different vulnerability than CVE-2014-4394 CVE-2014-4395 CVE-2014-4396 CVE-2014-4397 CVE-2014-4399 CVE-2014-4400 CVE-2014-4401 and CVE-2014-4416.


Microsoft .NET Framework 1.1 SP1 2.0 SP2 3.5 3.5.1 4 4.5 4.5.1 and 4.5.2 does not properly perform TypeFilterLevel checks which allows remote attackers to execute arbitrary code via crafted data to a .NET Remoting endpoint aka \TypeFilterLevel Vulnerability.\


An unspecified integrated graphics driver routine in the Intel Graphics Driver subsystem in Apple OS X before 10.9.5 does not properly validate calls which allows attackers to execute arbitrary code in a privileged context via a crafted application a different vulnerability than CVE-2014-4394 CVE-2014-4395 CVE-2014-4396 CVE-2014-4397 CVE-2014-4398 CVE-2014-4400 CVE-2014-4401 and CVE-2014-4416.


An unspecified integrated graphics driver routine in the Intel Graphics Driver subsystem in Apple OS X before 10.9.5 does not properly validate calls which allows attackers to execute arbitrary code in a privileged context via a crafted application a different vulnerability than CVE-2014-4394 CVE-2014-4395 CVE-2014-4396 CVE-2014-4397 CVE-2014-4398 CVE-2014-4399 CVE-2014-4400 and CVE-2014-4416.


An unspecified integrated graphics driver routine in the Intel Graphics Driver subsystem in Apple OS X before 10.9.5 does not properly validate calls which allows attackers to execute arbitrary code in a privileged context via a crafted application a different vulnerability than CVE-2014-4394 CVE-2014-4396 CVE-2014-4397 CVE-2014-4398 CVE-2014-4399 CVE-2014-4400 CVE-2014-4401 and CVE-2014-4416.


libnetcore in Apple iOS before 8.1.3 Apple OS X before 10.10.2 and Apple TV before 7.0.3 does not verify that certain values have the expected data type which allows attackers to execute arbitrary code in an _networkd context via a crafted XPC message from a sandboxed app as demonstrated by lack of verification of the XPC dictionary data type.


Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access to an Ansible managed host and providing a crafted fact as demonstrated by a fact with (1) a trailing \ src=\ clause (2) a trailing \ temp=\ clause or (3) a trailing \ validate=\ clause accompanied by a shell command.


Use-after-free vulnerability in MCPlayer.dll in Microsoft Windows Media Center TV Pack for Windows Vista Windows 7 SP1 and Windows Media Center for Windows 8 and 8.1 allows remote attackers to execute arbitrary code via a crafted Office document that triggers deletion of a CSyncBasePlayer object aka \CSyncBasePlayer Use After Free Vulnerability.\


Absolute path traversal vulnerability in GNU Wget before 1.16 when recursion is enabled allows remote FTP servers to write to arbitrary files and consequently execute arbitrary code via a LIST response that references the same filename within two entries one of which indicates that the filename is for a symlink.


An unspecified integrated graphics driver routine in the Intel Graphics Driver subsystem in Apple OS X before 10.9.5 does not properly validate calls which allows attackers to execute arbitrary code in a privileged context via a crafted application a different vulnerability than CVE-2014-4394 CVE-2014-4395 CVE-2014-4396 CVE-2014-4398 CVE-2014-4399 CVE-2014-4400 CVE-2014-4401 and CVE-2014-4416.


An unspecified IOAcceleratorFamily function in Apple OS X before 10.9.5 lacks proper bounds checking on read operations which allows attackers to execute arbitrary code in a privileged context via a crafted application.


An unspecified integrated graphics driver routine in the Intel Graphics Driver subsystem in Apple OS X before 10.9.5 does not properly validate calls which allows attackers to execute arbitrary code in a privileged context via a crafted application a different vulnerability than CVE-2014-4394 CVE-2014-4395 CVE-2014-4397 CVE-2014-4398 CVE-2014-4399 CVE-2014-4400 CVE-2014-4401 and CVE-2014-4416.


The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset which allows remote attackers to execute arbitrary code via crafted instructions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4657.


The WebView class and use of the WebView.addJavascriptInterface method in the Boat Browser application 8.0 and 8.0.1 for Android allow remote attackers to execute arbitrary code via a crafted web site a related issue to CVE-2012-6636.


An unspecified integrated graphics driver routine in the Intel Graphics Driver subsystem in Apple OS X before 10.9.5 does not properly validate calls which allows attackers to execute arbitrary code in a privileged context via a crafted application a different vulnerability than CVE-2014-4394 CVE-2014-4395 CVE-2014-4396 CVE-2014-4397 CVE-2014-4398 CVE-2014-4399 CVE-2014-4400 and CVE-2014-4401.


Unspecified

vulnerability

in

IBM

WebSphere

Portal

through

through

through

through

and

before

allows

remote

authenticated

users

to

execute

arbitrary

code

via

unknown

vectors.


BMC Track-It! 11.3.0.355 does not require authentication on TCP port 9010 which allows remote attackers to upload arbitrary files execute arbitrary code or obtain sensitive credential and configuration information via a .NET Remoting request to (1) FileStorageService or (2) ConfigurationService.


The Ploticus module in PhpWiki 1.5.0 allows remote attackers to execute arbitrary code via shell metacharacters in a device option in the editcontent parameter to index.php/HeIp. NOTE: some of these details are obtained from third party information.


A Command Execution vulnerability exists in Sphider Plus 3.2 due to insufficient sanitization of fwrite to conf.php which could let a remote malicious user execute arbitrary code. CVE-2014-5085 pertains to instances of fwrite in Sphider Plus but do not exist in either Sphider or Sphider Pro.


wp-includes/class-wp-customize-widgets.php

in

the

widget

implementation

in

WordPress

before

might

allow

remote

attackers

to

execute

arbitrary

code

via

crafted

serialized

data.


The Docker daemon managed by boot2docker 1.2 and earlier improperly enables unauthenticated TCP connections by default which makes it easier for remote attackers to gain privileges or execute arbitrary code from children containers.


Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remote authenticated users to execute arbitrary code by uploading a PHP file then accessing it via a direct request to the file in wp-content/uploads/slideshow-gallery/.


SolarWinds Log and Event Manager before 6.0 uses \static\ credentials which makes it easier for remote attackers to obtain access to the database and execute arbitrary code via unspecified vectors related to HyperSQL.


A Command Execution vulnerability exists in Sphider Pro 3.2 due to insufficient sanitization of fwrite which could let a remote malicious user execute arbitrary code. CVE-2014-5084 pertains to instances of fwrite in Sphider Pro only but do not exist in either Sphider or Sphider Plus.


A File Inclusion vulnerability exists in Railo 4.2.1 and earlier via a specially-crafted URL request to the thumbnail.cfm to specify a malicious PNG file which could let a remote malicious user obtain sensitive information or execute arbitrary code.


plugins/useradmin/fingeruser.php in XRMS CRM possibly 1.99.2 allows remote authenticated users to execute arbitrary code via shell metacharacters in the username parameter.


The wato component in Check_MK before 1.2.4p4 and 1.2.5 before 1.2.5i4 uses the pickle Python module unsafely which allows remote attackers to execute arbitrary code via a crafted serialized object related to an automation URL.


Hospira MedNet software version 5.8 and prior uses vulnerable versions of the JBoss Enterprise Application Platform software that may allow unauthenticated users to execute arbitrary code on the target system. Hospira has developed a new version of the MedNet software MedNet 6.1. Existing versions of MedNet can be upgraded to MedNet 6.1.


A Command Execution vulnerability exists in Sphider before 1.3.6 due to insufficient sanitization of fwrite to conf.php which could let a remote malicious user execute arbitrary code. CVE-2014-5083 pertains to instances of fwrite in Sphider.


Unrestricted file upload vulnerability in unspecified web services in Johnson Controls Metasys 4.1 through 6.5 as used in Application and Data Server (ADS) Extended Application and Data Server (aka ADX) LonWorks Control Server 85 LCS8520 Network Automation Engine (NAE) 55xx-x Network Integration Engine (NIE) 5xxx-x and NxE8500 allows remote attackers to execute arbitrary code by uploading a shell script.


The Storage API module 7.x before 7.x-1.6 for Drupal might allow remote attackers to execute arbitrary code by leveraging failure to update .htaccess file contents after SA-CORE-2013-003.


The OLE Point of Sale (OPOS) drivers before 1.13.003 on HP Point of Sale Windows PCs allow remote attackers to execute arbitrary code via vectors involving OPOSPOSPrinter.ocx for PUSB Thermal Receipt printers SerialUSB Thermal Receipt printers Hybrid POS printers with MICR Value PUSB Receipt printers and Value Serial/USB Receipt printers aka ZDI-CAN-2506.


The backup mechanism in the adb tool in Android might allow attackers to inject additional applications (APKs) and execute arbitrary code by leveraging failure to filter application data streams.


htdocs_ari/includes/login.php in the ARI Framework module/Asterisk Recording Interface (ARI) in FreePBX before 2.9.0.9 2.10.x and 2.11 before 2.11.1.5 allows remote attackers to execute arbitrary code via the ari_auth cookie related to the PHP unserialize function as exploited in the wild in September 2014.


The OLE Point of Sale (OPOS) drivers before 1.13.003 on HP Point of Sale Windows PCs allow remote attackers to execute arbitrary code via vectors involving OPOSMICR.ocx for PUSB Thermal Receipt printers SerialUSB Thermal Receipt printers Hybrid POS printers with MICR Value PUSB Receipt printers and Value Serial/USB Receipt printers aka ZDI-CAN-2512.


The OLE Point of Sale (OPOS) drivers before 1.13.003 on HP Point of Sale Windows PCs allow remote attackers to execute arbitrary code via vectors involving OPOSToneIndicator.ocx for POS keyboards and POS keyboards with MSR aka ZDI-CAN-2510.


in

the

java.io.ObjectInputStream

implementation

in

Android

before

does

not

verify

that

deserialization

will

result

in

an

object

that

met

the

requirements

for

serialization

which

allows

attackers

to

execute

arbitrary

code

via

a

crafted

finalize

method

for

a

serialized

object

in

an

ArrayMap

Parcel

within

an

intent

sent

to

as

demonstrated

by

the

finalize

method

of

android.os.BinderProxy

aka

Bug


The host_from_stream_offset function in arch_init.c in QEMU when loading RAM during migration allows remote attackers to execute arbitrary code via a crafted (1) offset or (2) length value in savevm data.


The OLE Point of Sale (OPOS) drivers before 1.13.003 on HP Point of Sale Windows PCs allow remote attackers to execute arbitrary code via unspecified vectors.


Unspecified vulnerability in JustSystems Ichitaro 2008 through 2011; Ichitaro Government 6 7 2008 2009 and 2010; Ichitaro Pro; Ichitaro Pro 2; Ichitaro 2011 Sou; Ichitaro 2012 Shou; Ichitaro 2013 Gen; and Ichitaro 2014 Tetsu allows remote attackers to execute arbitrary code via a crafted file.


The OLE Point of Sale (OPOS) drivers before 1.13.003 on HP Point of Sale Windows PCs allow remote attackers to execute arbitrary code via vectors involving OPOSCashDrawer.ocx for PUSB Thermal Receipt printers SerialUSB Thermal Receipt printers Hybrid POS printers with MICR Value PUSB Receipt printers Value Serial/USB Receipt printers and USB Standard Duty cash drawers aka ZDI-CAN-2505.


Multiple unspecified vulnerabilities in the Syslink driver for Texas Instruments OMAP mobile processor as used on NTT DOCOMO ARROWS Tab LTE F-01D ARROWS X LTE F-05D Disney Mobile on docomo F-08D REGZA Phone T-01D and PRADA phone by LG L-02D; and SoftBank SHARP handsets 102SH allow local users to execute arbitrary code or read kernel memory via unknown vectors related to userland data and \improper data validation.\


Akeeba Restore (restore.php) as used in Joomla! 2.5.4 through 2.5.25 3.x through 3.2.5 and 3.3.0 through 3.3.4; Akeeba Backup for Joomla! Professional 3.0.0 through 4.0.2; Backup Professional for WordPress 1.0.b1 through 1.1.3; Solo 1.0.b1 through 1.1.2; Admin Tools Core and Professional 2.0.0 through 2.4.4; and CMS Update 1.0.a1 through 1.0.1 when performing a backup or update for an archive does not delete parameters from $_GET and $_POST when it is cleansing $_REQUEST but later accesses $_GET and $_POST using the getQueryParam function which allows remote attackers to bypass encryption and execute arbitrary code via a command message that extracts a crafted archive.


The OLE Point of Sale (OPOS) drivers before 1.13.003 on HP Point of Sale Windows PCs allow remote attackers to execute arbitrary code via vectors involving OPOSLineDisplay.ocx for Retail RP7 VFD Customer Display monitors Retail Integrated 2x20 Display monitors Retail Integrated 2x20 Complex monitors POS Pole Display monitors Graphical POS Pole Display monitors and LCD Pole Display monitors aka ZDI-CAN-2511.


The OLE Point of Sale (OPOS) drivers before 1.13.003 on HP Point of Sale Windows PCs allow remote attackers to execute arbitrary code via vectors involving OPOSPOSKeyboard.ocx for POS keyboards and POS keyboards with MSR aka ZDI-CAN-2509.


The Application Lifecycle Service (ALS) in HP Helion Cloud Development Platform 1.0 when a virtual machine is derived from the Seed Node image uses the same security keys across different customers' installations which allows remote attackers to execute arbitrary code by leveraging these keys for a connection.


The file comment feature in Rejetto HTTP File Server (hfs) 2.3c and earlier allows remote attackers to execute arbitrary code by uploading a file with certain invalid UTF-8 byte sequences that are interpreted as executable macro symbols.


The OLE Point of Sale (OPOS) drivers before 1.13.003 on HP Point of Sale Windows PCs allow remote attackers to execute arbitrary code via vectors involving OPOSScanner.ocx for Imaging Barcode scanners Linear Barcode scanners Presentation Barcode scanners Retail Integrated Barcode scanners Wireless Barcode scanners and 2D Value Wireless scanners.


The OLE Point of Sale (OPOS) drivers before 1.13.003 on HP Point of Sale Windows PCs allow remote attackers to execute arbitrary code via vectors involving OPOSCheckScanner.ocx for PUSB Thermal Receipt printers SerialUSB Thermal Receipt printers Hybrid POS printers with MICR Value PUSB Receipt printers and Value Serial/USB Receipt printers aka ZDI-CAN-2507.


lib/TWiki/Sandbox.pm in TWiki 6.0.0 and earlier when running on Windows allows remote attackers to bypass intended access restrictions and upload files with restricted names via a null byte (%00) in a filename to bin/upload.cgi as demonstrated using .htaccess to execute arbitrary code.


The OLE Point of Sale (OPOS) drivers before 1.13.003 on HP Point of Sale Windows PCs allow remote attackers to execute arbitrary code via vectors involving OPOSMSR.ocx for Mini MSR magnetic stripe readers Retail Integrated Dual-Head MSR magnetic stripe readers Integrated Single Head MSR w/o SRED magnetic stripe readers Integrated Single Head w/o MSR SRED magnetic stripe readers RP7 Single Head MSR w/o SRED magnetic stripe readers POS keyboards and POS keyboards with MSR aka ZDI-CAN-2508.


Use-after-free vulnerability in Microsoft Office 2007 SP3; 2010 SP2; 2013 Gold SP1 and SP2; and 2013 RT Gold and SP1 allows remote attackers to execute arbitrary code via a crafted Office document aka \Microsoft Office Component Use After Free Vulnerability.\


IBM Tivoli Endpoint Manager Mobile Device Management (MDM) before 9.0.60100 uses the same secret HMAC token across different customers' installations which allows remote attackers to execute arbitrary code via crafted marshalled Ruby objects in cookies to (1) Enrollment and Apple iOS Management Extender (2) Self-service portal (3) Trusted Services provider or (4) Admin Portal.


Internet Explorer 6 Internet Explorer 7 Internet Explorer 8 Internet Explorer 9 Internet Explorer 10 and Internet Explorer 11 allows remote attackers to execute arbitrary code.


IBM

Security

AppScan

Enterprise

before

IFix

before

IFix

before

IFix

before

iFix

before

iFix

and

before

iFix

allows

remote

attackers

to

execute

arbitrary

code

via

a

crafted

executable

file

in

an

archive.


GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables which allows remote attackers to execute arbitrary code via a crafted environment as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd the mod_cgi and mod_cgid modules in the Apache HTTP Server scripts executed by unspecified DHCP clients and other situations in which setting the environment occurs across a privilege boundary from Bash execution aka \ShellShock.\ NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.


Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object as exploited in the wild in October 2014 with a crafted PowerPoint document.


Zenoss Core through 5 Beta 3 does not properly implement the Check For Updates feature which allows remote attackers to execute arbitrary code by (1) spoofing the callhome server or (2) deploying a crafted web site that is visited during a login session aka ZEN-12657.


Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation.


The network-play implementation in Mednafen before 0.8.D might allow remote servers to execute arbitrary code via unspecified vectors related to \stack manipulation\ issues.


Untrusted search path vulnerability in Microsoft Windows Contacts allows local users and possibly remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse wab32res.dll that is located in the same folder as a .contact .group .p7c .vcf or .wab file. NOTE: the codebase for this product may overlap the codebase for the product referenced in CVE-2010-3147.


Untrusted search path vulnerability in Microsoft Windows Progman Group Converter (grpconv.exe) allows local users and possibly remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse imm.dll that is located in the same folder as a .grp file.


Microsoft Excel 2002 SP3 and Office 2004 for Mac do not properly validate record information which allows remote attackers to execute arbitrary code via a crafted Excel document aka \Merge Cell Record Pointer Vulnerability.\


Microsoft Excel 2002 SP3 and 2003 SP3 does not properly validate record information which allows remote attackers to execute arbitrary code via a crafted .wk3 (aka Lotus 1-2-3 workbook) file aka \Lotus 1-2-3 Workbook Parsing Vulnerability.\


Untrusted search path vulnerability in TeamMate Audit Management Software Suite 8.0 patch 2 allows local users and possibly remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse mfc71enu.dll that is located in the same folder as a .tmx file.


Untrusted search path vulnerability in Qualcomm eXtensible Diagnostic Monitor (QXDM) 03.09.19 allows local users and possibly remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse mfc71enu.dll that is located in the same folder as a .isf file.


Untrusted search path vulnerability in PGP Desktop 9.9.0 Build 397 9.10.x 10.0.0 Build 2732 and probably other versions allows local users and possibly remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse tsp.dll or tvttsp.dll that is located in the same folder as a .p12 .pem .pgp .prk .prvkr .pubkr .rnd or .skr file.


Untrusted search path vulnerability in Adobe InDesign CS4 6.0 InDesign CS5 7.0.2 and earlier Adobe InDesign Server CS5 7.0.2 and earlier and Adobe InCopy CS5 7.0.2 and earlier allows local users and possibly remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse ibfs32.dll that is located in the same folder as an .indl .indp .indt or .inx file.


Untrusted search path vulnerability in uTorrent 2.0.3 and earlier allows local users and possibly remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse plugin_dll.dll userenv.dll shfolder.dll dnsapi.dll dwmapi.dll iphlpapi.dll dhcpcsvc.dll dhcpcsvc6.dll or rpcrtremote.dll that is located in the same folder as a .torrent or .btsearch file.


Untrusted search path vulnerability in Adobe Flash Player 9 allows local users and possibly remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse schannel.dll that is located in the same folder as a file that is processed by Flash.


Untrusted search path vulnerability in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9 Thunderbird before 3.0.7 and 3.1.x before 3.1.3 and SeaMonkey before 2.0.7 on Windows XP allows local users and possibly remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a .htm .html .jtx .mfp or .eml file.


AVG Anti-Virus does not properly interact with the processing of hcp:// URLs by the Microsoft Help and Support Center which makes it easier for remote attackers to execute arbitrary code via malware that is correctly detected by this product but with a detection approach that occurs too late to stop the code execution.


The x86 JIT compiler in Microsoft .NET Framework 2.0 SP2 3.5 SP1 3.5.1 and 4.0 does not properly compile function calls which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP) (2) a crafted ASP.NET application or (3) a crafted .NET Framework application aka \.NET Framework Stack Corruption Vulnerability.\


Untrusted search path vulnerability in Cisco Packet Tracer 5.2 allows local users and possibly remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse wintab32.dll that is located in the same folder as a .pkt or .pkz file.


Microsoft Excel 2002 SP3 Office 2004 and 2008 for Mac and Open XML File Format Converter for Mac do not properly validate binary file-format information which allows remote attackers to execute arbitrary code via a crafted Excel document aka \Out-of-Bounds Memory Write in Parsing Vulnerability.\


Unspecified vulnerability in JustSystems Ichitaro and Ichitaro Government allows remote attackers to execute arbitrary code via a crafted document a different vulnerability than CVE-2010-3915.


Untrusted search path vulnerability in Adobe Illustrator CS4 14.0.0 CS5 15.0.1 and earlier and possibly other versions allows local users and possibly remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll or aires.dll that is located in the same folder as an .ait or .eps file.


Untrusted search path vulnerability in TeamViewer 5.0.8703 and earlier allows local users and possibly remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a .tvs or .tvc file.


Untrusted search path vulnerability in TechSmith Snagit all versions 10.x and 11.x allows local users and possibly remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a snag snagcc or snagprof file.


The SPDY protocol implementation in Google Chrome before 6.0.472.62 does not properly manage buffers which might allow remote attackers to execute arbitrary code via unspecified vectors.


libdirectx_plugin.dll in VideoLAN VLC Media Player before 1.1.8 allows remote attackers to execute arbitrary code via a crafted width in an AMV file related to a \dangling pointer vulnerability.\


F-Secure Anti-Virus does not properly interact with the processing of hcp:// URLs by the Microsoft Help and Support Center which makes it easier for remote attackers to execute arbitrary code via malware that is correctly detected by this product but with a detection approach that occurs too late to stop the code execution. NOTE: the researcher indicates that a vendor response was received stating that \the inability to catch these files are caused by lacking functionality rather than programming errors.\


The nsTreeContentView function in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9 Thunderbird before 3.0.7 and 3.1.x before 3.1.3 and SeaMonkey before 2.0.7 does not properly handle node removal in XUL trees which allows remote attackers to execute arbitrary code via vectors involving access to deleted memory related to a \dangling pointer vulnerability.\


Untrusted search path vulnerability in Google Earth 5.1.3535.3218 allows local users and possibly remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse quserex.dll that is located in the same folder as a .kmz file.


Format string vulnerability in the _Eventlog function in FastBackServer.exe in the Server in IBM Tivoli Storage Manager (TSM) FastBack 5.5.0.0 through 5.5.6.0 and 6.1.0.0 through 6.1.0.1 allows remote attackers to execute arbitrary code via format string specifiers located after a | (pipe) character in a string. NOTE: this might overlap CVE-2010-3059.


Microsoft Excel 2002 SP3 and 2007 SP2; Excel Viewer SP2; and Office Compatibility Pack for Word Excel and PowerPoint 2007 File Formats SP2 do not properly validate record information which allows remote attackers to execute arbitrary code via a crafted Excel document aka \Real Time Data Array Record Vulnerability.\


The PluginGetDriverFile function in Novell iPrint Client before 5.44 interprets an uninitialized memory location as a pointer value which allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Untrusted search path vulnerability in Microsoft Office PowerPoint 2007 allows local users and possibly remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse rpawinet.dll that is located in the same folder as a .odp .pothtml .potm .potx .ppa .ppam .pps .ppt .ppthtml .pptm .pptxml .pwz .sldm .sldx and .thmx file.


Microsoft Excel 2002 SP3 and 2003 SP3 Office 2004 and 2008 for Mac and Open XML File Format Converter for Mac do not properly validate record information which allows remote attackers to execute arbitrary code via a crafted Excel document aka \Out Of Bounds Array Vulnerability.\


The serialization implementation in JBoss Drools in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 before 4.3.0.CP09 and JBoss Enterprise SOA Platform 4.2 and 4.3 supports the embedding of class files which allows remote attackers to execute arbitrary code via a crafted static initializer.


Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13 and SeaMonkey before 2.0.11 does not properly calculate index values for certain child content in a XUL tree which allows remote attackers to execute arbitrary code via vectors involving a DIV element within a treechildren element.


Unrestricted file upload vulnerability in the Document Conversions Launcher Service in Microsoft Office SharePoint Server 2007 SP2 when the Document Conversions Load Balancer Service is enabled allows remote attackers to execute arbitrary code via a crafted SOAP request to TCP port 8082 aka \Malformed Request Code Execution Vulnerability.\


Microsoft Excel 2003 SP3 and 2007 SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Excel Viewer SP2; and Office Compatibility Pack for Word Excel and PowerPoint 2007 File Formats SP2 do not properly validate record information which allows remote attackers to execute arbitrary code via a crafted Excel document aka \Excel File Format Parsing Vulnerability.\


Untrusted search path vulnerability in bin/winvlc.c in VLC Media Player 1.1.3 and earlier allows local users and possibly remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse wintab32.dll that is located in the same folder as a .mp3 file.


Untrusted search path vulnerability in IDM Computer Solutions UltraEdit 16.20.0.1009 16.10.0.1036 and probably other versions allows local users and possibly remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a bin cpp css c dat hpp html h ini java log mak php prj txt or xml file.


Untrusted search path vulnerability in Adobe Premier Pro CS4 4.0.0 (314 (MC: 160820)) allows local users and possibly remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse ibfs32.dll that is located in the same folder as a .pproj .prfpset .prexport .prm .prmp .prpreset .prproj .prsl .prtl or .vpr file.


Untrusted search path vulnerability in VIM Development Group GVim before 7.3.034 and possibly other versions before 7.3.46 allows local users and possibly remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse User32.dll or other DLL that is located in the same folder as a .TXT file. NOTE: some of these details are obtained from third party information.


Unspecified vulnerability in the Oracle Document Capture component in Oracle Fusion Middleware 10.1.3.4 and 10.1.3.5 allows remote attackers to affect integrity and availability via unknown vectors related to Import Server. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from the original researcher that remote attackers can overwrite arbitrary files and execute arbitrary code via a full pathname in the first argument to the WriteJPG method in the NCSECWLib ActiveX control.


Untrusted search path vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows allows local users and possibly remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a file that is processed by Flash Player.


Untrusted search path vulnerability in Adobe Dreamweaver CS5 11.0 build 4916 build 4909 and probably other versions allows local users and possibly remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) mfc90loc.dll or (2) dwmapi.dll that is located in the same folder as a CSS PHP ASP or other file that automatically launches Dreamweaver.


Untrusted search path vulnerability in Adobe Extension Manager CS5 5.0.298 allows local users and possibly remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a .mxi or .mxp file.


Microsoft Excel 2002 SP3 and 2003 SP3 and Office 2004 for Mac does not properly validate binary file-format information which allows remote attackers to execute arbitrary code via a crafted Excel document aka \Negative Future Function Vulnerability.\


Untrusted search path vulnerability in Skype 4.2.0.169 and earlier allows local users and possibly remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse wab32.dll that is located in the same folder as a .skype file.


Microsoft Excel 2002 SP3 Office 2004 and 2008 for Mac and Open XML File Format Converter for Mac do not properly validate record information which allows remote attackers to execute arbitrary code via a crafted Excel document aka \Ghost Record Type Parsing Vulnerability.\


Untrusted search path vulnerability in Microsoft Windows Internet Communication Settings on Windows XP SP3 allows local users and possibly remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse schannel.dll that is located in the same folder as an ISP file.


FastBackMount.exe in the Mount service in IBM Tivoli Storage Manager (TSM) FastBack 5.5.0.0 through 5.5.6.0 and 6.1.0.0 through 6.1.0.1 writes a certain value to a memory location specified by a UDP packet field which allows remote attackers to execute arbitrary code via multiple requests. NOTE: this might overlap CVE-2010-3058.


Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13 Thunderbird before 3.0.11 and 3.1.x before 3.1.7 and SeaMonkey before 2.0.11 do not properly validate downloadable fonts before use within an operating system's font implementation which allows remote attackers to execute arbitrary code via vectors related to @font-face Cascading Style Sheets (CSS) rules.


Use-after-free vulnerability in the nsBarProp function in Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11 Thunderbird before 3.0.9 and 3.1.x before 3.1.5 and SeaMonkey before 2.0.9 allows remote attackers to execute arbitrary code by accessing the locationbar property of a closed window.


Symantec Norton AntiVirus 2011 does not properly interact with the processing of hcp:// URLs by the Microsoft Help and Support Center which makes it easier for remote attackers to execute arbitrary code via malware that is correctly detected by this product but with a detection approach that occurs too late to stop the code execution. NOTE: the researcher indicates that a vendor response was received stating that this issue \falls into the work of our Firewall and not our AV (per our methodology of layers of defense).\


flicvideo.c in libavcodec 0.6 and earlier in FFmpeg as used in MPlayer and other products allows remote attackers to execute arbitrary code via a crafted flic file related to an \arbitrary offset dereference vulnerability.\


Unspecified vulnerability in the Deployment component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality integrity and availability via unknown vectors. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from a reliable third party coordinator that the ActiveX Plugin does not properly initialize an object field that is used as a window handle which allows attackers to execute arbitrary code.


Untrusted search path vulnerability in avast! Free Antivirus version 5.0.594 and earlier allows local users and possibly remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse mfc90loc.dll that is located in the same folder as an avast license (.avastlic) file.


Untrusted search path vulnerability in Microsoft PowerPoint 2010 allows local users and possibly remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse pptimpconv.dll that is located in the same folder as a .odp .pot .potm .potx .ppa .pps .ppsm .ppsx .ppt .pptm .pptx .pwz .sldm or .sldx file.


Microsoft Excel 2002 SP3 does not properly validate formula information which allows remote attackers to execute arbitrary code via a crafted Excel document aka \Formula Biff Record Vulnerability.\


Untrusted search path vulnerability in TortoiseSVN 1.6.10 Build 19898 and earlier allows local users and possibly remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a file that is processed by Tortoise. NOTE: this is only a vulnerability when a file extension is associated with TortoiseProc or TortoiseMerge which is not the default.


McAfee VirusScan Enterprise 8.5i and 8.7i does not properly interact with the processing of hcp:// URLs by the Microsoft Help and Support Center which makes it easier for remote attackers to execute arbitrary code via malware that is correctly detected by this product but with a detection approach that occurs too late to stop the code execution.


Untrusted search path vulnerability in Adobe PhotoShop CS2 through CS5 allows local users and possibly remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll or Wintab32.dll that is located in the same folder as a PSD or other file that is processed by PhotoShop. NOTE: some of these details are obtained from third party information.


Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 21 5.0 Update 25 and 1.4.2_27 allows remote attackers to affect confidentiality integrity and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this allows remote attackers to execute arbitrary code by causing the defaultReadObject method in the Serialization API to set a volatile field multiple times.


Unspecified vulnerability in JustSystems Ichitaro and Ichitaro Government allows remote attackers to execute arbitrary code via a crafted document a different vulnerability than CVE-2010-3916.


Untrusted search path vulnerability in Adobe On Location CS4 Build 315 allows local users and possibly remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse ibfs32.dll that is located in the same folder as an OLPROJ file.


Unspecified vulnerability on HP ProCurve Access Points Access Controllers and Mobility Controllers with software 5.1.x through 5.1.9 5.2.x through 5.2.7 5.3.x through 5.3.5 and 5.4.x through 5.4.0 allows remote attackers to execute arbitrary code via unknown vectors.


The extSetOwner function in the UfProxyBrowserCtrl ActiveX control (UfPBCtrl.dll) in Trend Micro Internet Security Pro 2010 allows remote attackers to execute arbitrary code via an invalid address that is dereferenced as a pointer.


Use-after-free vulnerability in the Media Player Network Sharing Service in Microsoft Windows Vista SP1 and SP2 and Windows 7 allows remote attackers to execute arbitrary code via a crafted Real Time Streaming Protocol (RTSP) packet aka \RTSP Use After Free Vulnerability.\


Untrusted search path vulnerability in Adobe Device Central CS5 3.0.0(376) 3.0.1.0 (3027) and probably other versions allows local users and possibly remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse qtcf.dll that is located in the same folder as an ADCP file.


rjrmrpln.dll in RealNetworks RealPlayer 11.0 through 11.1 RealPlayer SP 1.0 through 1.1.4 and RealPlayer Enterprise 2.1.2 does not properly validate file contents that are used during interaction with a heap buffer which allows remote attackers to execute arbitrary code via crafted Name Value Property (NVP) elements in logical streams in a media file.


Unspecified vulnerability in IBM Tivoli Storage Manager (TSM) FastBack 5.5.0.0 through 5.5.6.0 and 6.1.0.0 through 6.1.0.1 allows remote attackers to execute arbitrary code via unknown vectors aka ZDI-CAN-700. NOTE: this might overlap CVE-2010-3058 or CVE-2010-3059.


libdirectx_plugin.dll in VideoLAN VLC Media Player before 1.1.8 allows remote attackers to execute arbitrary code via a crafted width in an NSV file.


Untrusted search path vulnerability in Adobe Captivate 5.0.0.596 and possibly other versions allows local users and possibly remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a .cptx file. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Untrusted search path vulnerability in Wireshark 0.8.4 through 1.0.15 and 1.2.0 through 1.2.10 allows local users and possibly remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse airpcap.dll and possibly other DLLs that is located in the same folder as a file that automatically launches Wireshark.


Untrusted search path vulnerability in Adobe ExtendScript Toolkit (ESTK) CS5 3.5.0.52 allows local users and possibly remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a .jsx file.


Microsoft Excel 2002 SP3 does not properly validate record information which allows remote attackers to execute arbitrary code via a crafted Excel document aka \Extra Out of Boundary Record Parsing Vulnerability.\


Untrusted search path vulnerability in Nullsoft Winamp 5.581 and probably other versions allows local users and possibly remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse wnaspi32.dll that is located in the same folder as a .669 .aac .aiff .amf .au .avr .b4s .caf or .cda file.


The WMITools ActiveX control in WBEMSingleView.ocx 1.50.1131.0 in Microsoft WMI Administrative Tools 1.1 and earlier in Microsoft Windows XP SP2 and SP3 allows remote attackers to execute arbitrary code via a crafted argument to the AddContextRef method possibly an untrusted pointer dereference aka \Microsoft WMITools ActiveX Control Vulnerability.\


Incomplete blacklist vulnerability in config.template.php in vtiger CRM before 5.2.1 allows remote authenticated users to execute arbitrary code by using the draft save feature in the Compose Mail component to upload a file with a .phtml extension and then accessing this file via a direct request to the file in the storage/ directory tree.


The FXCLI_OraBR_Exec_Command function in FastBackServer.exe in the Server in IBM Tivoli Storage Manager (TSM) FastBack 5.5.0.0 through 5.5.6.0 and 6.1.0.0 through 6.1.0.1 uses values of packet fields to determine the content and length of data copied to memory which allows remote attackers to execute arbitrary code via a crafted packet. NOTE: this might overlap CVE-2010-3059.


The Clipboard::DispatchObject function in app/clipboard/clipboard.cc in Google Chrome before 5.0.375.70 does not properly handle CBF_SMBITMAP objects in a ViewHostMsg_ClipboardWriteObjectsAsync message which might allow remote attackers to execute arbitrary code via vectors involving crafted data from the renderer process related to a \Type Confusion\ issue.


Integer underflow in Microsoft PowerPoint 2002 SP3 and 2003 SP3 PowerPoint Viewer SP2 and Office 2004 for Mac allows remote attackers to execute arbitrary code via a crafted PowerPoint document aka \PowerPoint Integer Underflow Causes Heap Corruption Vulnerability.\


Unrestricted

file

upload

vulnerability

in

in

TCExam

and

allows

remote

attackers

to

execute

arbitrary

code

by

uploading

a

file

with

an

executable

extension

then

accessing

it

via

a

direct

request

to

the

file

in

cache/.


Format string vulnerability in stream.c in the phar extension in PHP 5.3.x through 5.3.3 allows context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI that is not properly handled by the phar_stream_flush function leading to errors in the php_stream_wrapper_log_error function. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-2094.


The get1 command as used by lftpget in LFTP before 4.0.6 does not properly validate a server-provided filename before determining the destination filename of a download which allows remote servers to create or overwrite arbitrary files via a Content-Disposition header that suggests a crafted filename and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.


Citrix Online Plug-in for Windows for XenApp & XenDesktop before 11.2 Citrix Online Plug-in for Mac for XenApp & XenDesktop before 11.0 Citrix ICA Client for Linux before 11.100 Citrix ICA Client for Solaris before 8.63 and Citrix Receiver for Windows Mobile before 11.5 allow remote attackers to execute arbitrary code via (1) a crafted HTML document (2) a crafted .ICA file or (3) a crafted type field in an ICA graphics packet related to a \heap offset overflow\ issue.


The Cinepak codec in Microsoft Windows XP SP2 and SP3 Windows Vista SP1 and SP2 and Windows 7 does not properly decompress media files which allows remote attackers to execute arbitrary code via a crafted file aka \Cinepak Codec Decompression Vulnerability.\


Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64 and Adobe AIR before 2.0.2.12610 might allow attackers to execute arbitrary code via unspecified vectors related to an \invalid pointer vulnerability\ and the newclass (0x58) operator a different vulnerability than CVE-2010-2174.


The monitoring probe display in spacewalk-java before 2.1.148-1 and Red Hat Network (RHN) Satellite 4.0.0 through 4.2.0 and 5.1.0 through 5.3.0 and Proxy 5.3.0 allows remote authenticated users with permissions to administer monitoring probes to execute arbitrary code via unspecified vectors related to backticks.


The do_anonymous_page function in mm/memory.c in the Linux kernel before 2.6.27.52 2.6.32.x before 2.6.32.19 2.6.34.x before 2.6.34.4 and 2.6.35.x before 2.6.35.2 does not properly separate the stack and the heap which allows context-dependent attackers to execute arbitrary code by writing to the bottom page of a shared memory segment as demonstrated by a memory-exhaustion attack against the X.Org X server.


Opera before 10.61 does not properly suppress clicks on download dialogs that became visible after a recent tab change which allows remote attackers to conduct clickjacking attacks and consequently execute arbitrary code via vectors involving (1) closing a tab or (2) hiding a tab a related issue to CVE-2005-2407.


The normalizeDocument function in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9 Thunderbird before 3.0.7 and 3.1.x before 3.1.3 and SeaMonkey before 2.0.7 does not properly handle the removal of DOM nodes during normalization which might allow remote attackers to execute arbitrary code via vectors involving access to a deleted object.


The Print Spooler service in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP1 and SP2 Windows Server 2008 Gold SP2 and R2 and Windows 7 when printer sharing is enabled does not properly validate spooler access permissions which allows remote attackers to create files in a system directory and consequently execute arbitrary code by sending a crafted print request over RPC as exploited in the wild in September 2010 aka \Print Spooler Service Impersonation Vulnerability.\


Unspecified vulnerability in JustSystems Ichitaro 2004 through 2009 Ichitaro Government 2006 through 2009 and Just School 2008 and 2009 allows remote attackers to execute arbitrary code via unknown vectors related to \product character attribute processing\ for a document.


Multiple format string vulnerabilities in the phar extension in PHP 5.3 before 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI that is not properly handled by the (1) phar_stream_flush (2) phar_wrapper_unlink (3) phar_parse_url or (4) phar_wrapper_open_url functions in ext/phar/stream.c; and the (5) phar_wrapper_open_dir function in ext/phar/dirstream.c which triggers errors in the php_stream_wrapper_log_error function.


GNU Wget 1.12 and earlier uses a server-provided filename instead of the original URL to determine the destination filename of a download which allows remote servers to create or overwrite arbitrary files via a 3xx redirect to a URL with a .wgetrc filename followed by a 3xx redirect to a URL with a crafted filename and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.


Untrusted search path vulnerability in BlackBerry Desktop Software before 6.0.0.47 allows local users and possibly remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse DLL that is located in the same folder as a file that is processed by Blackberry.


Use-after-free vulnerability in the nsTreeSelection function in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9 Thunderbird before 3.0.7 and 3.1.x before 3.1.3 and SeaMonkey before 2.0.7 might allow remote attackers to execute arbitrary code via vectors involving a XUL tree selection related to a \dangling pointer vulnerability.\ NOTE: this issue exists because of an incomplete fix for CVE-2010-2753.


Opera before 10.60 on Windows and Mac OS X does not properly prevent certain double-click operations from running a program located on a web site which allows user-assisted remote attackers to execute arbitrary code via a crafted web page that bypasses a dialog.


Opera before 10.54 on Windows and Mac OS X does not properly enforce permission requirements for widget filesystem access and directory selection which allows user-assisted remote attackers to create or modify arbitrary files and consequently execute arbitrary code via widget File I/O operations.


Windows Shell in Microsoft Windows XP SP3 Server 2003 SP2 Vista SP1 and SP2 Server 2008 SP2 and R2 and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file which is not properly handled during icon display in Windows Explorer as demonstrated in the wild in July 2010 and originally reported for malware that leverages CVE-2010-2772 in Siemens WinCC SCADA systems.


Integer underflow in the real_get_rdt_chunk function in real.c as used in modules/access/rtsp/real.c in VideoLAN VLC media player before 1.0.1 and stream/realrtsp/real.c in MPlayer before r29447 allows remote attackers to execute arbitrary code via a crafted length value in an RDT chunk header.


Use-after-free vulnerability in Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64 and Adobe AIR before 2.0.2.12610 might allow attackers to execute arbitrary code via unspecified vectors related to an unspecified \image type within a certain function.\


lwp-download in libwww-perl before 5.835 does not reject downloads to filenames that begin with a . (dot) character which allows remote servers to create or overwrite files via (1) a 3xx redirect to a URL with a crafted filename or (2) a Content-Disposition header that suggests a crafted filename and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.


Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64 and Adobe AIR before 2.0.2.12610 might allow attackers to execute arbitrary code via unspecified vectors related to an \invalid pointer vulnerability\ and the newfunction (0x44) operator a different vulnerability than CVE-2010-2173.


The SMB Server in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP1 and SP2 Windows Server 2008 Gold SP2 and R2 and Windows 7 does not properly validate fields in an SMB request which allows remote attackers to execute arbitrary code via a crafted SMB packet aka \SMB Pool Overflow Vulnerability.\


solid.exe in IBM solidDB before 6.5 FP2 allows remote attackers to execute arbitrary code via a long username field in the first handshake packet.


template_api.py in Cobbler before 2.0.7 as used in Red Hat Network Satellite Server and other products does not disable the ability of the Cheetah template engine to execute Python statements contained in templates which allows remote authenticated administrators to execute arbitrary code via a crafted kickstart template file a different vulnerability than CVE-2008-6954.


Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 18 5.0 Update 23 1.4.2_25 and 1.3.1_27 allows remote attackers to affect confidentiality integrity and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to XNewPtr and improper handling of an integer parameter when allocating heap memory in the com.sun.media.sound libraries which allows remote attackers to execute arbitrary code.


The Windows kernel-mode drivers in win32k.sys in Microsoft Windows 2000 SP4 XP SP2 and SP3 Server 2003 SP2 Vista SP1 and SP2 Server 2008 Gold and SP2 Windows 7 and Server 2008 R2 \do not properly validate all callback parameters when creating a new window \ which allows local users to execute arbitrary code aka \Win32k Window Creation Vulnerability.\


Microsoft Office Excel 2002 SP3 2003 SP3 and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word Excel and PowerPoint 2007 File Formats SP1 and SP2 do not properly parse the Excel file format which allows remote attackers to execute arbitrary code via a crafted spreadsheet that causes memory to be interpreted as a different object type than intended aka \Microsoft Office Excel Sheet Object Type Confusion Vulnerability.\


The Microsoft Access Wizard Controls in ACCWIZ.dll in Microsoft Office Access 2003 SP3 and 2007 SP1 and SP2 do not properly interact with the memory-allocation approach used by Internet Explorer during instantiation which allows remote attackers to execute arbitrary code via a web site that references multiple ActiveX controls as demonstrated by the ImexGrid and FieldList controls aka \Access ActiveX Control Vulnerability.\


The TCP/IP implementation in Microsoft Windows Vista Gold SP1 and SP2 and Server 2008 Gold and SP2 when a custom network driver is used does not properly handle local fragmentation of Encapsulating Security Payload (ESP) over UDP packets which allows remote attackers to execute arbitrary code via crafted packets aka \Header MDL Fragmentation Vulnerability.\


Unrestricted file upload vulnerability in index.php/Attach in WikyBlog 1.7.3rc2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension using the uploadform action then accessing it via a direct request to the file in userfiles/username/uploaded/.


The MPEG-4 codec in the Windows Media codecs in Microsoft Windows XP SP2 and SP3 Server 2003 SP2 Vista SP1 and SP2 and Server 2008 Gold and SP2 does not properly handle crafted media content with MPEG-4 video encoding which allows remote attackers to execute arbitrary code via a file in an unspecified \supported format \ aka \MPEG-4 Codec Vulnerability.\


Unrestricted file upload vulnerability in upload.php in BTS-GI Read excel 1.1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in an unspecified directory. NOTE: some of these details are obtained from third party information.


The image decoder in WebKit before r52833 as used in Google Chrome before 4.0.249.78 does not properly handle a failure of memory allocation which allows remote attackers to execute arbitrary code in the Chrome sandbox via a malformed GIF file that specifies a large size.


Integer signedness error in the elf_get_dynamic_info function in elf/dynamic-link.h in ld.so in the GNU C Library (aka glibc or libc6) 2.0.1 through 2.11.1 when the --verify option is used allows user-assisted remote attackers to execute arbitrary code via a crafted ELF program with a negative value for a certain d_tag structure member in the ELF header.


The Cryptographic Message Syntax (CMS) implementation in crypto/cms/cms_asn1.c in OpenSSL before 0.9.8o and 1.x before 1.0.0a does not properly handle structures that contain OriginatorInfo which allows context-dependent attackers to modify invalid memory locations or conduct double-free attacks and possibly execute arbitrary code via unspecified vectors.


Microsoft Office Excel 2002 SP3 Office 2004 and 2008 for Mac and Open XML File Format Converter for Mac do not properly parse the Excel file format which allows remote attackers to execute arbitrary code via a crafted spreadsheet aka \Microsoft Office Excel DbOrParamQry Record Parsing Vulnerability.\


Use-after-free vulnerability in the nsCycleCollector::MarkRoots function in Mozilla Firefox 3.5.x before 3.5.10 and SeaMonkey before 2.0.5 allows remote attackers to execute arbitrary code via a crafted HTML document related to an improper frame construction process for menus.


Apple Safari before 4.0.5 on Windows does not properly validate external URL schemes which allows remote attackers to open local files and execute arbitrary code via a crafted HTML document.


Mozilla Firefox before 3.0.19 3.5.x before 3.5.9 and 3.6.x before 3.6.2; Thunderbird before 3.0.4; and SeaMonkey before 2.0.4 do not properly manage reference counts for option elements in a XUL tree optgroup which might allow remote attackers to execute arbitrary code via unspecified vectors that trigger access to deleted elements related to a \dangling pointer vulnerability.\


Multiple unrestricted file upload vulnerabilities in (1) register.php and (2) addvideo.php in BitScripts Bits Video Script 2.04 and 2.05 Gold Beta allow remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in an unspecified directory.


fw_charts.php in the reporting module in the Manager (aka SEPM) component in Symantec Endpoint Protection (SEP) 11.x before 11 RU6 MP2 allows remote attackers to bypass intended restrictions on report generation overwrite arbitrary PHP scripts and execute arbitrary code via a crafted request.


Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 18 5.0 Update 23 1.4.2_25 and 1.3.1_27 allows remote attackers to affect confidentiality integrity and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is an uncontrolled array index that allows remote attackers to execute arbitrary code via a MIDI file with a crafted MixerSequencer object related to the GM_Song structure.


Multiple unspecified vulnerabilities in the Microsoft Internet Explorer 8 Developer Tools ActiveX control in Microsoft Windows 2000 SP4 Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP1 and SP2 Windows Server 2008 Gold SP2 R2 and R2 SP1 and Windows 7 Gold and SP1 allow remote attackers to execute arbitrary code via unknown vectors that \corrupt the system state \ aka \Microsoft Internet Explorer 8 Developer Tools Vulnerability.\


The Windows kernel-mode drivers in win32k.sys in Microsoft Windows 2000 SP4 XP SP2 and SP3 Server 2003 SP2 Vista SP1 and SP2 and Server 2008 Gold and SP2 \do not properly validate changes in certain kernel objects \ which allows local users to execute arbitrary code via vectors related to Device Contexts (DC) and the GetDCEx function aka \Win32k Improper Data Validation Vulnerability.\


The TCP/IP implementation in Microsoft Windows Vista Gold SP1 and SP2 and Server 2008 Gold and SP2 when IPv6 is enabled does not properly perform bounds checking on ICMPv6 Route Information packets which allows remote attackers to execute arbitrary code via crafted packets aka \ICMPv6 Route Information Vulnerability.\


Unrestricted file upload vulnerability in e107 before 0.7.20 allows remote authenticated users to execute arbitrary code by uploading a .php.filetypesphp file. NOTE: the vendor disputes the significance of this issue noting that \an odd set of preferences and a missing file\ are required.


Microsoft Office Outlook 2002 SP3 2003 SP3 and 2007 SP1 and SP2 does not properly verify e-mail attachments with a PR_ATTACH_METHOD property value of ATTACH_BY_REFERENCE which allows user-assisted remote attackers to execute arbitrary code via a crafted message aka \Microsoft Outlook SMB Attachment Vulnerability.\


Unspecified vulnerability in the embedded HTTPS server on the Cisco IronPort Encryption Appliance 6.2.x before 6.2.9.1 and 6.5.x before 6.5.2 and the IronPort PostX MAP before 6.2.9.1 allows remote attackers to execute arbitrary code via unknown vectors aka IronPort Bug 65923.


Microsoft Office Excel 2007 SP1 and SP2 and Office 2004 for Mac do not properly parse the Excel file format which allows remote attackers to execute arbitrary code via a crafted spreadsheet that triggers access of an uninitialized stack variable aka \Microsoft Office Excel FNGROUPNAME Record Uninitialized Memory Vulnerability.\


The WinVerifyTrust function in Authenticode Signature Verification 5.1 6.0 and 6.1 in Microsoft Windows 2000 SP4 Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista Gold SP1 and SP2 Windows Server 2008 Gold SP2 and R2 and Windows 7 does not properly use unspecified fields in a file digest which allows user-assisted remote attackers to execute arbitrary code via a modified (1) Portable Executable (PE) or (2) cabinet (aka .CAB) file that incorrectly appears to have a valid signature aka \WinVerifyTrust Signature Validation Vulnerability.\


Array index error in Microsoft Office PowerPoint 2002 SP3 and 2003 SP3 and PowerPoint in Office 2004 for Mac allows remote attackers to execute arbitrary code via a crafted PowerPoint document aka \PowerPoint OEPlaceholderAtom 'placementId' Invalid Array Indexing Vulnerability.\


The TCP/IP implementation in Microsoft Windows Vista Gold SP1 and SP2 and Server 2008 Gold and SP2 when IPv6 is enabled does not properly perform bounds checking on ICMPv6 Router Advertisement packets which allows remote attackers to execute arbitrary code via crafted packets aka \ICMPv6 Router Advertisement Vulnerability.\


Cisco Digital Media Manager (DMM) 5.0.x and 5.1.x has a default password for the Tomcat administration account which makes it easier for remote attackers to execute arbitrary code via a crafted web application aka Bug ID CSCta03378.


The Authenticode Signature verification functionality in cabview.dll in Cabinet File Viewer Shell Extension 5.1 6.0 and 6.1 in Microsoft Windows 2000 SP4 Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista Gold SP1 and SP2 Windows Server 2008 Gold SP2 and R2 and Windows 7 does not properly use unspecified fields in a file digest which allows remote attackers to execute arbitrary code via a modified cabinet (aka .CAB) file that incorrectly appears to have a valid signature aka \Cabview Corruption Validation Vulnerability.\


modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 through 2.0.63 2.2.0 through 2.2.14 and 2.3.x before 2.3.7 when running on Windows does not ensure that request processing is complete before calling isapi_unload for an ISAPI .dll module which allows remote attackers to execute arbitrary code via unspecified vectors related to a crafted request a reset packet and \orphaned callback pointers.\


vbscript.dll in VBScript 5.1 5.6 5.7 and 5.8 in Microsoft Windows 2000 SP4 XP SP2 and SP3 and Server 2003 SP2 when Internet Explorer is used allows user-assisted remote attackers to execute arbitrary code by referencing a (1) local pathname (2) UNC share pathname or (3) WebDAV server with a crafted .hlp file in the fourth argument (aka helpfile argument) to the MsgBox function leading to code execution involving winhlp32.exe when the F1 key is pressed aka \VBScript Help Keypress Vulnerability.\


Unspecified vulnerability in Sun Java System Web Server 7.0 Update 6 on Linux allows remote attackers to execute arbitrary code by sending a process memory address and crafted data to TCP port 80 as demonstrated by the vd_sjws2 module in VulnDisco. NOTE: as of 20100106 this disclosure has no actionable information. However because the VulnDisco author is a reliable researcher the issue is being assigned a CVE identifier for tracking purposes.


Multiple unspecified vulnerabilities in the Macromedia Flash ActiveX control in Adobe Flash Player 6 as distributed in Microsoft Windows XP SP2 and SP3 might allow remote attackers to execute arbitrary code via unspecified vectors that are not related to the use-after-free \Movie Unloading Vulnerability\ (CVE-2010-0378). NOTE: due to lack of details it is not clear whether this overlaps any other CVE item.


Unrestricted file upload vulnerability in maxImageUpload/index.php in PHP F1 Max's Image Uploader 1.0 when Apache is not configured to handle the mime-type for files with pjpeg or jpeg extensions allows remote attackers to execute arbitrary code by uploading a file with a pjpeg or jpeg extension then accessing it via a direct request to the file in original/. NOTE: some of these details are obtained from third party information.


Disk Images in Apple Mac OS X before 10.6.3 does not provide the expected warning for an unsafe file type in an internet enabled disk image which makes it easier for user-assisted remote attackers to execute arbitrary code via a package file type.


Unrestricted file upload vulnerability in Pulse CMS Basic 1.2.2 and 1.2.3 and possibly Pulse Pro before 1.3.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in an unspecified directory.


The SMB implementation in the Server service in Microsoft Windows 2000 SP4 Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista Gold SP1 and SP2 Windows Server 2008 Gold SP2 and R2 and Windows 7 does not properly validate request fields which allows remote authenticated users to execute arbitrary code via a malformed request aka \SMB Pathname Overflow Vulnerability.\


Microsoft Office Excel 2007 SP1 and SP2; Office 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer SP1 and SP2; Office Compatibility Pack for Word Excel and PowerPoint 2007 File Formats SP1 and SP2; and Office SharePoint Server 2007 SP1 and SP2 do not validate ZIP headers during decompression of Open XML (.XLSX) documents which allows remote attackers to execute arbitrary code via a crafted document that triggers access to uninitialized memory locations aka \Microsoft Office Excel XLSX File Parsing Code Execution Vulnerability.\


Apache Axis2 as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2 CA ARCserve D2D r15 and other products has a default password of axis2 for the admin account which makes it easier for remote attackers to execute arbitrary code by uploading a crafted web service.


The Microsoft Data Analyzer ActiveX control (aka the Office Excel ActiveX control for Data Analysis) in max3activex.dll in Microsoft Windows 2000 SP4 Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista Gold SP1 and SP2 Windows Server 2008 Gold SP2 and R2 and Windows 7 allows remote attackers to execute arbitrary code via a crafted web page that corrupts the \system state \ aka \Microsoft Data Analyzer ActiveX Control Vulnerability.\


RealNetworks RealPlayer 11.0 through 11.1 and RealPlayer SP 1.0 through 1.1.4 on Windows do not properly handle dimensions during YUV420 transformations which might allow remote attackers to execute arbitrary code via crafted MP4 content.


Unspecified vulnerability in TIBRepoServer5.jar in TIBCO Administrator 5.4.0 through 5.6.0 when JMS transport is used allows remote authenticated users to execute arbitrary code on all domain nodes via vectors related to leveraging administrative credentials.


Mozilla Firefox 3.6.x before 3.6.3 does not properly manage the scopes of DOM nodes that are moved from one document to another which allows remote attackers to conduct use-after-free attacks and execute arbitrary code via unspecified vectors involving improper interaction with garbage collection as demonstrated by Nils during a Pwn2Own competition at CanSecWest 2010.


The Windows kernel-mode drivers in win32k.sys in Microsoft Windows 2000 SP4 XP SP2 and SP3 Server 2003 SP2 Vista SP1 and SP2 Server 2008 Gold and SP2 Windows 7 and Server 2008 R2 allows local users to execute arbitrary code via vectors related to \glyph outline information\ and TrueType fonts aka \Win32k TrueType Font Parsing Vulnerability.\


Untrusted search path vulnerability in the Picture Viewer in Apple QuickTime before 7.6.8 allows local users and possibly remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) CoreVideo.dll (2) CoreGraphics.dll or (3) CoreAudioToolbox.dll that is located in the same folder as a .pic image file.


SpringSource Spring Framework 2.5.x before 2.5.6.SEC02 2.5.7 before 2.5.7.SR01 and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs0=jar: followed by a URL of a crafted .jar file.


Unspecified vulnerability in Internet Explorer 8 on Microsoft Windows 7 allows remote attackers to execute arbitrary code via unknown vectors possibly related to a use-after-free issue as demonstrated by Peter Vreugdenhil during a Pwn2Own competition at CanSecWest 2010.


Argument injection vulnerability in the URI handler in (a) Java NPAPI plugin and (b) Java Deployment Toolkit in Java 6 Update 10 19 and other versions when running on Windows and possibly on Linux allows remote attackers to execute arbitrary code via the (1) -J or (2) -XXaltjvm argument to javaws.exe which is processed by the launch method. NOTE: some of these details are obtained from third party information.


Unspecified vulnerability in Safari 4 on Apple Mac OS X 10.6 allows remote attackers to execute arbitrary code via unknown vectors as demonstrated by Charlie Miller during a Pwn2Own competition at CanSecWest 2010.


The installation for Microsoft Open XML File Format Converter for Mac sets insecure ACLs for the /Applications folder which allows local users to execute arbitrary code by replacing the executable with a Trojan Horse aka \Mac Office Open XML Permissions Vulnerability.\


The IPersistPropertyBag2::Read function in QTPlugin.ocx in Apple QuickTime 6.x 7.x before 7.6.8 and other versions allows remote attackers to execute arbitrary code via the _Marshaled_pUnk attribute which triggers unmarshalling of an untrusted pointer.


tgsrv.exe

in

the

Repair

Service

in

Consona

Dynamic

Agent

Repair

Manager

Subscriber

Activation

and

Subscriber

Agent

relies

on

a

predictable

timestamp

field

to

validate

input

to

the

named

pipe

which

allows

remote

authenticated

users

to

execute

arbitrary

code

by

obtaining

the

current

time

from

tcpip.sys

or

an

service.


Unrestricted file upload vulnerability in Pulse CMS Basic 1.2.4 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension followed by a safe extension then accessing it via a direct request to the file in an unspecified directory a different vulnerability than CVE-2010-0993.


The (1) sqlite_single_query and (2) sqlite_array_query functions in ext/sqlite/sqlite.c in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to execute arbitrary code by calling these functions with an empty SQL query which triggers access of uninitialized memory.


The Safe (aka Safe.pm) module 2.26 and certain earlier versions for Perl as used in PostgreSQL 7.4 before 7.4.29 8.0 before 8.0.25 8.1 before 8.1.21 8.2 before 8.2.17 8.3 before 8.3.11 8.4 before 8.4.4 and 9.0 Beta before 9.0 Beta 2 allows context-dependent attackers to bypass intended (1) Safe::reval and (2) Safe::rdo access restrictions and inject and execute arbitrary code via vectors involving subroutine references and delayed execution.


Use-after-free vulnerability in the NodeIterator implementation in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7 and SeaMonkey before 2.0.6 allows remote attackers to execute arbitrary code via a crafted NodeFilter that detaches DOM nodes related to the NodeIterator interface and a javascript callback.


perms.cpp in March Hare Software CVSNT 2.0.58 2.5.01 2.5.02 2.5.03 before build 3736 2.5.04 before build 2862; CVS Suite 2.5.03 2008 before build 3736 and 2009 before 3729 allows remote attackers to bypass the permissions check modify arbitrary modules and directories within CVSROOT and execute arbitrary code via a crafted branch name ACL possibly related to incorrect inheritance.


Use-after-free vulnerability in Apple Safari 4.0.5 on Windows allows remote attackers to execute arbitrary code by using window.open to create a popup window for a crafted HTML document and then calling the parent window's close method which triggers improper handling of a deleted window object.


Atlassian JIRA 3.12 through 4.1 allows remote authenticated administrators to execute arbitrary code by modifying the (1) attachment (aka attachments) (2) index (aka indexing) or (3) backup path and then uploading a file as exploited in the wild in April 2010.


Windows Shell and WordPad in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP1 and SP2 Windows Server 2008 Gold SP2 and R2 and Windows 7; Microsoft Office XP SP3; Office 2003 SP3; and Office System 2007 SP1 and SP2 do not properly validate COM objects during instantiation which allows remote attackers to execute arbitrary code via a crafted file aka \COM Validation Vulnerability.\


The Safe (aka Safe.pm) module before 2.25 for Perl allows context-dependent attackers to bypass intended (1) Safe::reval and (2) Safe::rdo access restrictions and inject and execute arbitrary code via vectors involving implicitly called methods and implicitly blessed objects as demonstrated by the (a) DESTROY and (b) AUTOLOAD methods related to \automagic methods.\


Unspecified vulnerability in Quartz.dll for DirectShow; Windows Media Format Runtime 9 9.5 and 11; Media Encoder 9; and the Asycfilt.dll COM component allows remote attackers to execute arbitrary code via a media file with crafted compression data aka \Media Decompression Vulnerability.\


VMware Tools in VMware Workstation 6.5.x before 6.5.4 build 246459; VMware Player 2.5.x before 2.5.4 build 246459; VMware ACE 2.5.x before 2.5.4 build 246459; VMware Server 2.x before 2.0.2 build 203138; VMware Fusion 2.x before 2.0.6 build 246742; VMware ESXi 3.5 and 4.0; and VMware ESX 2.5.5 3.0.3 3.5 and 4.0 does not properly access libraries which allows user-assisted remote attackers to execute arbitrary code by tricking a Windows guest OS user into clicking on a file that is stored on a network share.


Microsoft Office Excel 2002 SP3 2007 SP1 and SP2; Office 2004 for mac; Office 2008 for Mac; Open XML File Format Converter for Mac; and Office Compatibility Pack for Word Excel and PowerPoint 2007 File Formats SP1 and SP2; allows remote attackers to execute arbitrary code via an Excel file with crafted DBQueryExt records that allow a function call to a \user-controlled pointer \ aka \Excel ADO Object Vulnerability.\


Format string vulnerability in the _msgout function in rpc.pcnfsd in IBM AIX 6.1 5.3 and earlier; IBM VIOS 2.1 1.5 and earlier; NFS/ONCplus B.11.31_09 and earlier on HP HP-UX B.11.11 B.11.23 and B.11.31; and SGI IRIX 6.5 allows remote attackers to execute arbitrary code via an RPC request containing format string specifiers in an invalid directory name.


Unspecified vulnerability in JustSystems Ichitaro and Ichitaro Government 2006 through 2010 allows user-assisted remote attackers to execute arbitrary code via a crafted font file.


Unspecified vulnerability in Quartz.dll for DirectShow on Microsoft Windows 2000 SP4 XP SP2 and SP3 Server 2003 SP2 Vista SP1 and Server 2008 allows remote attackers to execute arbitrary code via a media file with crafted compression data aka \MJPEG Media Decompression Vulnerability.\


The Common Language Runtime (CLR) in Microsoft .NET Framework 2.0 SP1 2.0 SP2 3.5 3.5 SP1 and 3.5.1 and Microsoft Silverlight 2 and 3 before 3.0.50611.0 on Windows and before 3.0.41130.0 on Mac OS X does not properly handle interfaces and delegations to virtual methods which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP) (2) a crafted ASP.NET application or (3) a crafted .NET Framework application aka \Microsoft Silverlight and Microsoft .NET Framework CLR Virtual Method Delegate Vulnerability.\


JBoss Seam 2 (jboss-seam2) as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux does not properly sanitize inputs for JBoss Expression Language (EL) expressions which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.


Use-after-free vulnerability in the attribute-cloning functionality in the DOM implementation in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7 and SeaMonkey before 2.0.6 allows remote attackers to execute arbitrary code via vectors related to deletion of an event attribute node with a nonzero reference count.


The Invoker Servlet on SAP NetWeaver Application Server Java platforms possibly before 7.3 does not require authentication which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request as exploited in the wild in 2013 through 2016 aka a \Detour\ attack.


The TextXtra module in Adobe Shockwave Player before 11.5.9.620 does not properly validate unspecified input data which allows attackers to execute arbitrary code via unknown vectors.


cgi-bin/read.cgi in WebSCADA WS100 and WS200 Easy Connect EC150 Modbus RTU - TCP Gateway MB100 and Serial Ethernet Server SS100 on the IntelliCom NetBiter NB100 and NB200 platforms allows remote authenticated administrators to execute arbitrary code by using a config.html 2.conf action to replace the logo page's GIF image file with a file containing this code a different vulnerability than CVE-2009-4463.


The WBEMSingleView.ocx ActiveX control 1.50.1131.0 in Microsoft WMI Administrative Tools 1.1 and earlier allows remote attackers to execute arbitrary code via a crafted argument to the ReleaseContext method a different vector than CVE-2010-3973 possibly an untrusted pointer dereference.


Unspecified vulnerability in Doc Viewer in HP Palm webOS 1.4.1 allows remote attackers to execute arbitrary code via a crafted document as demonstrated by a Word document.


Array index error in RealNetworks RealPlayer 11.0 through 11.1 RealPlayer Enterprise 2.1.2 Mac RealPlayer 11.0 through 11.1 Linux RealPlayer 11.0.2.1744 and possibly HelixPlayer 1.0.6 and other versions allows remote attackers to execute arbitrary code via a malformed Media Properties Header (aka MDPR) in a RealMedia file.


The dirapi.dll module in Adobe Shockwave Player before 11.5.9.620 does not properly validate unspecified input data which allows attackers to execute arbitrary code via unknown vectors.


Use-after-free vulnerability in an unspecified compatibility component in Adobe Shockwave Player before 11.5.9.620 allows user-assisted remote attackers to execute arbitrary code via a crafted web site related to the Shockwave Settings window and an unloaded library. NOTE: some of these details are obtained from third party information.


share/ma/keys_for_user in Monkeysphere 0.31 and 0.32 allows local users to execute arbitrary code via unknown manipulations related to the \monkeysphere-authentication keys-for-user\ command.


Unspecified vulnerability in the ActiveMatrix Runtime component in TIBCO ActiveMatrix Service Grid 3.0.0 3.0.1 and 3.1.0; ActiveMatrix Service Bus 3.0.0 and 3.0.1; ActiveMatrix BusinessWorks Service Engine 5.9.0; ActiveMatrix BPM 1.0.1 and 1.0.2; Silver BPM Service 1.0.1; and Silver CAP Service 1.0.0 allows remote authenticated users to execute arbitrary code via vectors related to JMX connections.


Untrusted search path vulnerability in the Data Access Objects (DAO) library (dao360.dll) in Microsoft Windows XP Professional SP3 Windows Server 2003 R2 Enterprise Edition SP3 Windows Vista Business SP1 and Windows 7 Professional allows local users and possibly remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse msjet49.dll that is located in the same folder as a file that is processed by dao360.dll. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Mono when Moonlight before 2.3.0.1 or 2.99.x before 2.99.0.10 is used does not properly validate arguments to generic methods which allows remote attackers to bypass generic constraints and possibly execute arbitrary code via a crafted method call.


The Shockwave 3d Asset module in Adobe Shockwave Player before 11.5.9.620 does not properly validate unspecified input data which allows attackers to execute arbitrary code via unknown vectors.


The Tomcat server in IBM Rational Quality Manager and Rational Test Lab Manager has a default password for the ADMIN account which makes it easier for remote attackers to execute arbitrary code by leveraging access to the manager role. NOTE: this might overlap CVE-2009-3548.


The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal Cake cache and execute arbitrary code via a crafted data_Tokenfields value that is processed by the unserialize function as demonstrated by modifying the file_map cache to execute arbitrary local files.


Unspecified vulnerability in Hitachi EUR Form Client before 05-10 -/D 2010.11.15 and 05-10-CA (* 2) 2010.11.15; Hitachi EUR Form Service before 05-10 -/D 2010.11.15; and uCosminexus EUR Form Service before 07-60 -/D 2010.11.15 on Windows before 05-10 -/D 2010.11.15 and 07-50 -/D 2010.11.15 on Linux and before 07-50 -/C 2010.11.15 on AIX; allows remote attackers to execute arbitrary code via unknown attack vectors.


Unrestricted file upload vulnerability in modules/gallery/models/item.php in Menalto Gallery before 3.0 and beta allows remote authenticated users with upload permissions to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in an unspecified directory.


On various RAD-ISM-900-EN-* devices by PHOENIX CONTACT an admin user could use the configuration file uploader in the WebUI to execute arbitrary code with root privileges on the OS due to an improper validation of an integrity check value in all versions of the firmware.


An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Redshift ODBC Driver (1.4.14 through 1.4.21.1001 and 1.4.22 through 1.4.x before 1.4.52) may allow a local user to execute arbitrary code.


On various RAD-ISM-900-EN-* devices by PHOENIX CONTACT an admin user could use the traceroute utility integrated in the WebUI to execute arbitrary code with root privileges on the OS due to an improper input validation in all versions of the firmware.


An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Athena ODBC Driver 1.1.1 through 1.1.x before 1.1.17 may allow a local user to execute arbitrary code.


A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated network-based PAN-OS administrator to upload a specifically created configuration that disrupts system processes and potentially execute arbitrary code with root privileges when the configuration is committed on both hardware and virtual firewalls. This issue does not impact Panorama appliances or Prisma Access customers. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.23; PAN-OS 9.0 versions earlier than PAN-OS 9.0.16; PAN-OS 9.1 versions earlier than PAN-OS 9.1.13; PAN-OS 10.0 versions earlier than PAN-OS 10.0.10; PAN-OS 10.1 versions earlier than PAN-OS 10.1.5.


An improper link resolution before file access ('link following') vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows that enables a local attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges under certain circumstances. This issue impacts: GlobalProtect app 5.1 versions earlier than GlobalProtect app 5.1.10 on Windows. GlobalProtect app 5.2 versions earlier than GlobalProtect app 5.2.5 on Windows. This issue does not affect GlobalProtect app on other platforms.


A potential vulnerability due to improper buffer validation in the SMI handler LenovoFlashDeviceInterface in Thinkpad X1 Fold Gen 1 could be exploited by an attacker with local access and elevated privileges to execute arbitrary code.


The affected On-Premise cnMaestro allows an unauthenticated attacker to access the cnMaestro server and execute arbitrary code in the privileges of the web server. This lack of validation could allow an attacker to append arbitrary data to the logger command.


Sed Injection Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.12. An authenticated remote attacker with low privileges can execute arbitrary code under root context.


SiteServer CMS v7.x allows attackers to execute arbitrary code via a crafted plug-in.


Missing authentication for critical function in AssetView prior to Ver.13.2.0 allows a remote unauthenticated attacker with some knowledge on the system configuration to upload a crafted configuration file to the managing server which may result in the managed clients to execute arbitrary code with the administrative privilege.


Selenium Selenium Grid (formerly Selenium Standalone Server) Fixed in 4.0.0-alpha-7 is affected by: DNS rebinding. The impact is: execute arbitrary code (remote). The component is: WebDriver endpoint of Selenium Grid / Selenium Standalone Server. The attack vector is: Triggered by browsing to to a malicious remote web server. The WebDriver endpoint of Selenium Server (Grid) is vulnerable to DNS rebinding. This can be used to execute arbitrary code on the machine.


Improper sanitization of trigger action scripts in VanDyke Software VShell for Windows v4.6.2 allows attackers to execute arbitrary code via a crafted value.


An issue was discovered on certain Fujitsu LIEFBOOK devices (A3510 U9310 U7511/U7411/U7311 U9311 E5510/E5410 U7510/U7410/U7310 E459/E449) with BIOS versions before v1.09 (A3510) v2.17 (U9310) v2.30 (U7511/U7411/U7311) v2.33 (U9311) v2.23 (E5510) v2.19 (U7510/U7410) v2.13 (U7310) and v1.09 (E459/E449). The FjGabiFlashCoreAbstractionSmm driver registers a Software System Management Interrupt (SWSMI) handler that is not sufficiently validated to ensure that the CommBuffer (or any other communication buffer's nested contents) are not pointing to SMRAM contents. A potential attacker can therefore write fixed data to SMRAM which could lead to data corruption inside this memory (e.g. change the SMI handler's code or modify SMRAM map structures to break input pointer validation for other SMI handlers). Thus the attacker could elevate privileges from ring 0 to ring -2 and execute arbitrary code in SMM.


SCBS Online Sports Venue Reservation System v1.0 was discovered to contain a local file inclusion vulnerability which allow attackers to execute arbitrary code via a crafted PHP file.


Car Rental System v1.0 contains an arbitrary file upload vulnerability via the Add Car component which allows attackers to upload a webshell and execute arbitrary code.


Typemill v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the upload function. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.


BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively the attacker could choose to change the terminal's colors.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPEG2000 images. The issue results from the lack of proper validation of user-supplied data which can result in a read past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15812.


MariaDB CONNECT Storage Engine Format String Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of a user-supplied string before using it as a format specifier. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16193.


This vulnerability allows remote attackers to disclose sensitive information on affected installations of Sante DICOM Viewer Pro 11.8.7.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DCM files. Crafted data in a DCM file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-15099.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sonos One Speaker prior to 3.4.1 (S2 systems) and 11.2.13 build 57923290 (S1 systems). Authentication is not required to exploit this vulnerability. The specific flaw exists within the ALAC audio codec. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15798.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 11.8.8.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of J2K images. Crafted data in a J2K file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15161.


This vulnerability allows remote attackers to disclose sensitive information on affected installations of Sante DICOM Viewer Pro 11.8.7.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of GIF files. The issue results from the lack of proper validation of user-supplied data which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-14972.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15743.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 11.8.7.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DCM files. Crafted data in a DCM file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process Was ZDI-CAN-15098.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15853.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15987.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader Foxit reader 11.0.1.0719 macOS. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the OnMouseExit method. The issue results from the lack of proper validation of user-supplied data which can result in a read past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14848.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 11.8.7.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of J2K files. Crafted data in a J2K file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15095.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15877.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15861.


MariaDB CONNECT Storage Engine Use-After-Free Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16207.


This vulnerability allows remote attackers to disclose sensitive information on affected installations of Sante DICOM Viewer Pro 11.8.7.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DCM files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-15100.