This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15852.


This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sonos One Speaker prior to 3.4.1 (S2 systems) and 11.2.13 build 57923290 (S1 systems). Authentication is not required to exploit this vulnerability. The specific flaw exists within the anacapd daemon. The issue results from the lack of proper validation of user-supplied data which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15828.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPEG2000 images. The issue results from the lack of proper validation of user-supplied data which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15811.


A vulnerability has been identified in SINEC NMS (All versions). The affected system allows to upload JSON objects that are deserialized to Java objects. Due to insecure deserialization of user-supplied content by the affected software a privileged attacker could exploit this vulnerability by sending a maliciously crafted serialized Java object. This could allow the attacker to execute arbitrary code on the device with root privileges.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 images. Crafted data in a JP2 image can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16087.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 11.8.7.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of J2K files. Crafted data in a J2K file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15076.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. By performing actions in JavaScript an attacker can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15703.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 13.2.0.21165. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15104.


On Windows if Git LFS operates on a malicious repository with a `..exe` file as well as a file named `git.exe` and `git.exe` is not found in `PATH` the `..exe` program will be executed permitting the attacker to execute arbitrary code. This does not affect Unix systems. Similarly if the malicious repository contains files named `..exe` and `cygpath.exe` and `cygpath.exe` is not found in `PATH` the `..exe` program will be executed when certain Git LFS commands are run. More generally if the current working directory contains any file with a base name of `.` and a file extension from `PATHEXT` (except `.bat` and `.cmd`) and also contains another file with the same base name as a program Git LFS intends to execute (such as `git` `cygpath` or `uname`) and any file extension from `PATHEXT` (including `.bat` and `.cmd`) then on Windows when Git LFS attempts to execute the intended program the `..exe` `..com` etc. file will be executed instead but only if the intended program is not found in any directory listed in `PATH`. The vulnerability occurs because when Git LFS detects that the program it intends to run does not exist in any directory listed in `PATH` then Git LFS passes an empty string as the executable file path to the Go `os/exec` package which contains a bug such that on Windows it prepends the name of the current working directory (i.e. `.`) to the empty string without adding a path separator and as a result searches in that directory for a file with the base name `.` combined with any file extension from `PATHEXT` executing the first one it finds. (The reason `..bat` and `..cmd` files are not executed in the same manner is that although the Go `os/exec` package tries to execute them just as it does a `..exe` file the Microsoft Win32 API `CreateProcess()` family of functions have an undocumented feature in that they apparently recognize when a caller is attempting to execute a batch script file and instead run the `cmd.exe` command interpreter passing the full set of command line arguments as parameters. These are unchanged from the command line arguments set by Git LFS and as such the intended program's name is the first resulting in a command line like `cmd.exe /c git` which then fails.) Git LFS has resolved this vulnerability by always reporting an error when a program is not found in any directory listed in `PATH` rather than passing an empty string to the Go `os/exec` package in this case. The bug in the Go `os/exec` package has been reported to the Go project and is expected to be patched after this security advisory is published. The problem was introduced in version 2.12.1 and is patched in version 3.1.3. Users of affected versions should upgrade to version 3.1.3. There are currently no known workarounds at this time.


This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-16115.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 11.8.7.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of J2K files. Crafted data in a J2K file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15077.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15702.


This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader Foxit reader 11.0.1.0719 macOS. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of XFA forms. The issue results from the lack of proper validation of user-supplied data which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-14819.


This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR940N 3.20.1 Build 200316 Rel.34392n (5553) routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of file name extensions. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-13910.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15851.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15744.


Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0 users of the iTop user portal can send TWIG code to the server by forging specific http queries and execute arbitrary code on the server using http server user privileges. This issue is fixed in versions 2.7.6 and 3.0.0. There are currently no known workarounds.


A Double Free vulnerability allows remote malicious actors to execute arbitrary code on DWF file in Autodesk Navisworks 2022 within affected installations. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.


The installer of WPS Office Version 10.8.0.6186 insecurely load VERSION.DLL (or some other DLLs) allowing an attacker to execute arbitrary code with the privilege of the user invoking the installer.


Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the names of Pipeline libraries to create cache directories without any sanitization allowing attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM using specially crafted library names if a global Pipeline library configured to use caching already exists.


The

component

of

CuppaCMS

allows

attackers

to

upload

arbitrary

files

and

execute

arbitrary

code

via

a

crafted

PHP

file.


A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller JVM using specially crafted library names if a global Pipeline library is already configured.


TL-WR841Nv14_US_0.9.1_4.18 routers were discovered to contain a stack overflow in the function dm_fillObjByStr(). This vulnerability allows unauthenticated attackers to execute arbitrary code.


A maliciously crafted PDF file can be used to dereference for a write beyond the allocated buffer while parsing PDFTron files. The vulnerability exists because the application fails to handle a crafted PDFTron file which causes an unhandled exception. An attacker can leverage this vulnerability to execute arbitrary code.


Pluxml v5.8.7 was discovered to allow attackers to execute arbitrary code via crafted PHP code inserted into static pages.


NTT Resonant Incorporated goo blog App Web Application 1.0 is vulnerable to CLRF injection. This vulnerability allows attackers to execute arbitrary code via a crafted HTTP request.


A maliciously crafted JT file in Autodesk AutoCAD 2022 may be used to write beyond the allocated buffer while parsing JT files. This vulnerability can be exploited to execute arbitrary code.


Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Group Functionality of Profelis IT Consultancy SambaBox allows AUTHENTICATED user to cause execute arbitrary codes on the vulnerable server. This issue affects: Profelis IT Consultancy SambaBox 4.0 version 4.0 and prior versions on x86.


TP-Link Archer A54 Archer A54(US)_V1_210111 routers were discovered to contain a stack overflow in the function DM_ Fillobjbystr(). This vulnerability allows unauthenticated attackers to execute arbitrary code.


A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM through crafted SCM contents if a global Pipeline library already exists.


Musical World v1 was discovered to contain an arbitrary file upload vulnerability via uploaded_songs.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.


Xlpd v7.0.0094 and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file.


Ecommerce-Website v1 was discovered to contain an arbitrary file upload vulnerability via /customer_register.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.


Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security with antivirus databases released before 12 March 2022 had a bug in a data parsing module that potentially allowed an attacker to execute arbitrary code. The fix was delivered automatically. Credits: Georgy Zaytsev (Positive Technologies).


Simple House Rental System v1 was discovered to contain an arbitrary file upload vulnerability via /app/register.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.


A maliciously crafted PICT BMP PSD or TIF file in Autodesk AutoCAD 2022 2021 2020 2019 may be used to write beyond the allocated buffer while parsing PICT BMP PSD or TIF file. This vulnerability may be exploited to execute arbitrary code.


Xmanager v7.0.0096 and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file.


Ecommece-Website v1.1.0 was discovered to contain an arbitrary file upload vulnerability via /admin/index.php?slides. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.


Monstaftp v2.10.3 was discovered to contain an arbitrary file upload which allows attackers to execute arbitrary code via a crafted file uploaded to the web server.


AeroCMS v0.0.1 was discovered to contain an arbitrary file upload vulnerability via the Post Image function under the Admin panel. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.


Xshell v7.0.0099 and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file.


In the vote (aka \Polls Votes\) module before 21.0.100 of Bitrix Site Manager a remote unauthenticated attacker can execute arbitrary code.


Social Codia SMS v1 was discovered to contain an arbitrary file upload vulnerability via addteacher.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.


Xftp 7.0.0088p and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file.


Notable v1.8.4 does not filter text editing allowing attackers to execute arbitrary code via a crafted payload injected into the Title text field.


SharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14 7.7.0 and later prior to 7.17.6 7.18.0 and later prior to 7.18.4 7.19.0 and later prior to 7.19.4 and 7.20.0 allow a remote unauthenticated attacker to execute arbitrary code via Java deserialization.


MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file because the Uploadable File Types setting can be changed by an administrator.


On WatchGuard Firebox and XTM appliances an unauthenticated user can execute arbitrary code aka FBX-22786. This vulnerability impacts Fireware OS before 12.7.2_U2 12.x before 12.1.3_U8 and 12.2.x through 12.5.x before 12.5.9_U2.


The installer of WPS Office Version 10.8.0.5745 insecurely load shcore.dll allowing an attacker to execute arbitrary code with the privilege of the user invoking the installer.


Survey King v0.3.0 does not filter data properly when exporting excel files allowing attackers to execute arbitrary code or access sensitive information via a CSV injection attack.


The HTTP interface of Synaman v5.1 and below was discovered to allow authenticated attackers to execute arbitrary code and escalate privileges.


Omron CX-Position (versions 2.5.3 and prior) is vulnerable to a use after free memory condition while processing a specific project file which may allow an attacker to execute arbitrary code.


SPIP before 3.2.14 and 4.x before 4.0.5 allows remote authenticated editors to execute arbitrary code.


Abantecart through 1.3.2 allows remote authenticated administrators to execute arbitrary code by uploading an executable file because the Catalog>Media Manager>Images settings can be changed by an administrator (e.g. by configuring .php to be a valid image file type).


Improper limitation of path names in Veeam Backup & Replication 9.5U3 9.5U4 10.x and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.


Online Project Time Management System v1.0 was discovered to contain an arbitrary file write vulnerability which allows attackers to execute arbitrary code via a crafted HTML file.


Omron CX-Position (versions 2.5.3 and prior) is vulnerable to an out-of-bounds write while processing a specific project file which may allow an attacker to execute arbitrary code.


Improper authentication in Veeam Backup & Replication 9.5U3 9.5U4 10.x and 11.x component used for Microsoft System Center Virtual Machine Manager (SCVMM) allows attackers execute arbitrary code via Veeam.Backup.PSManager.exe


The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives an attacker can execute arbitrary code.


Select Dell Client Commercial and Consumer platforms contain a pre-boot direct memory access (DMA) vulnerability. An authenticated attacker with physical access to the system may potentially exploit this vulnerability in order to execute arbitrary code on the device.


A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1) SIMATIC Energy Manager PRO (All versions < V7.3 Update 1). The affected system allows remote users to send maliciously crafted objects. Due to insecure deserialization of user-supplied content by the affected software an unauthenticated attacker could exploit this vulnerability by sending a maliciously crafted serialized object. This could allow the attacker to execute arbitrary code on the device with SYSTEM privileges.


Dell Wyse Management Suite versions 2.0 through 3.5.2 contain an unrestricted file upload vulnerability. A malicious user with admin privileges can exploit this vulnerability in order to execute arbitrary code on the system.


Console

before

allows

remote

attackers

to

execute

arbitrary

code

via

a

JDBC

URL

containing

the

IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT

substring

a

different

vulnerability

than


USBView 2.1 before 2.2 allows some local users (e.g. ones logged in via SSH) to execute arbitrary code as root because certain Polkit settings (e.g. allow_any=yes) for pkexec disable the authentication requirement. Code execution can for example use the --gtk-module option. This affects Ubuntu Debian and Gentoo.


Octobercms

is

a

self-hosted

CMS

platform

based

on

the

Laravel

PHP

Framework.

In

affected

versions

user

input

was

not

properly

sanitized

before

rendering.

An

authenticated

user

with

the

permissions

to

create

modify

and

delete

website

pages

can

exploit

this

vulnerability

to

bypass

`cms.enableSafeMode`

in

order

to

execute

arbitrary

code.

This

issue

only

affects

admin

panels

that

rely

on

safe

mode

and

restricted

permissions.

To

exploit

this

vulnerability

an

attacker

must

first

have

access

to

the

backend

area.

The

issue

has

been

patched

in

Build

and

Users

unable

to

upgrade

should

apply

to

your

installation

manually.


Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated remote attacker with read/write privileges to the application to write files or execute arbitrary code on the underlying operating system of an affected device as the root user. For more information about these vulnerabilities see the Details section of this advisory.


A vulnerability in web-based management interface of Cisco Small Business RV340 and RV345 Routers could allow an authenticated remote attacker to execute arbitrary code on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending malicious input to an affected device. A successful exploit could allow the attacker to execute remote code on the affected device. To exploit this vulnerability an attacker would need to have valid Administrator credentials on the affected device.


Microsoft Windows Vista Gold SP1 and SP2 Windows Server 2008 Gold and SP2 and Windows 7 RC do not properly process the command value in an SMB Multi-Protocol Negotiate Request packet which allows remote attackers to execute arbitrary code via a crafted SMBv2 packet to the Server service aka \SMBv2 Command Value Vulnerability.\


js/src/jstracer.cpp in the Just-in-time (JIT) JavaScript compiler (aka TraceMonkey) in Mozilla Firefox 3.5 before 3.5.1 allows remote attackers to execute arbitrary code via certain use of the escape function that triggers access to uninitialized memory locations as originally demonstrated by a document containing P and FONT elements.


Unrestricted

file

upload

vulnerability

in

in

DMXReady

Registration

Manager

allows

remote

attackers

to

execute

arbitrary

code

by

uploading

a

file

with

an

executable

extension

then

accessing

it

via

a

direct

request

to

the

file

in

assets/webblogmanager.


Launch Services in Apple Mac OS X 10.5.8 does not properly recognize an unsafe Uniform Type Identifier (UTI) in an exported document type in a downloaded application which allows remote attackers to trigger the automatic opening of a file and execute arbitrary code via a crafted web site.


The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1 Visual Studio 2005 SP1 and 2008 Gold and SP1 and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4 XP SP2 and SP3 Server 2003 SP2 Vista Gold SP1 and SP2 and Server 2008 Gold and SP2; does not properly restrict use of OleLoadFromStream in instantiating objects from data streams which allows remote attackers to execute arbitrary code via a crafted HTML document with an ATL (1) component or (2) control related to ATL headers and bypassing security policies aka \ATL COM Initialization Vulnerability.\


The JavaScript for Acrobat API in Adobe Reader and Acrobat 7.x before 7.1.4 8.x before 8.1.7 and 9.x before 9.2 does not properly implement the (1) Privileged Context and (2) Safe Path restrictions for unspecified JavaScript methods which allows remote attackers to create arbitrary files and possibly execute arbitrary code via the cPath parameter in a crafted PDF file. NOTE: some of these details are obtained from third party information.


The Common Language Runtime (CLR) in Microsoft .NET Framework 2.0 2.0 SP1 2.0 SP2 3.5 and 3.5 SP1 and Silverlight 2 does not properly handle interfaces which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) (2) a crafted Silverlight application (3) a crafted ASP.NET application or (4) a crafted .NET Framework application aka \Microsoft Silverlight and Microsoft .NET Framework CLR Vulnerability.\


win32k.sys in the kernel in Microsoft Windows 2000 SP4 XP SP2 and SP3 and Server 2003 SP2 does not correctly parse font code during construction of a directory-entry table which allows remote attackers to execute arbitrary code via a crafted Embedded OpenType (EOT) font aka \Win32k EOT Parsing Vulnerability.\


Microsoft Windows Media Runtime as used in DirectShow WMA Voice Codec Windows Media Audio Voice Decoder and Audio Compression Manager (ACM) does not properly initialize unspecified functions within compressed audio files which allows remote attackers to execute arbitrary code via (1) a crafted media file or (2) crafted streaming content aka \Windows Media Runtime Heap Corruption Vulnerability.\


Launch Services in Apple Mac OS X 10.6.x before 10.6.2 recursively clears quarantine information upon opening a quarantined folder which allows user-assisted remote attackers to execute arbitrary code via a quarantined application that does not trigger a \potentially unsafe\ warning message.


Java for Mac OS X 10.5 before Update 6 and 10.6 before Update 1 accepts expired certificates for applets which makes it easier for remote attackers to execute arbitrary code via an applet.


Unspecified vulnerability in Adobe Shockwave Player before 11.0.0.465 allows remote attackers to execute arbitrary code via unknown vectors a different vulnerability than CVE-2009-1860 related to an older issue that \was previously resolved in Shockwave Player 11.0.0.465.\


Unrestricted file upload vulnerability in the Compose Email feature in the Emails module in Sugar Community Edition (aka SugarCRM) before 5.2f allows remote authenticated users to execute arbitrary code by uploading a file with only an extension in its name then accessing the file via a direct request to a modified filename under cache/modules/Emails/ as demonstrated using .php as the entire original name.


Microsoft Internet Explorer 5.01 SP4 6 6 SP1 7 and 8 does not properly handle argument validation for unspecified variables which allows remote attackers to execute arbitrary code via a crafted HTML document aka \HTML Component Handling Vulnerability.\


Zen Cart 1.3.8a 1.3.8 and earlier does not require administrative authentication for admin/record_company.php which allows remote attackers to execute arbitrary code by uploading a .php file via the record_company_image parameter in conjunction with a PATH_INFO of password_forgotten.php then accessing this file via a direct request to the file in images/.


The Active Template Library (ATL) in Microsoft Windows 2000 SP4 XP SP2 and SP3 Server 2003 SP2 Vista Gold SP1 and SP2 and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via vectors related to erroneous free operations after reading a variant from a stream and deleting this variant aka \ATL Object Type Mismatch Vulnerability.\


The DHTML Editing Component ActiveX control in Microsoft Windows 2000 SP4 XP SP2 and SP3 and Server 2003 SP2 does not properly format HTML markup which allows remote attackers to execute arbitrary code via a crafted web site that triggers \system state\ corruption aka \DHTML Editing Component ActiveX Control Vulnerability.\


encoder.php in eAccelerator allows remote attackers to execute arbitrary code by copying a local executable file to a location under the web root via the -o option and then making a direct request to this file related to upload of image files.


Unrestricted file upload vulnerability in member/uploads_edit.php in dedecms 5.3 allows remote attackers to execute arbitrary code by uploading a file with a double extension in the filename then accessing this file via unspecified vectors as demonstrated by a .jpg.php filename.


Microsoft Windows Media Format Runtime 9.0 9.5 and 11 and Windows Media Services 9.1 and 2008 do not properly parse malformed headers in Advanced Systems Format (ASF) files which allows remote attackers to execute arbitrary code via a crafted (1) .asf (2) .wmv or (3) .wma file aka \Windows Media Header Parsing Invalid Free Vulnerability.\


Unspecified vulnerability in SAP Crystal Reports Server 2008 allows remote attackers to execute arbitrary code via unknown vectors as demonstrated by a certain module in VulnDisco Pack Professional 8.3 through 8.11. NOTE: as of 20090917 this disclosure has no actionable information. However because the VulnDisco Pack author is a reliable researcher the issue is being assigned a CVE identifier for tracking purposes.


The ActiveScan Installer ActiveX control in as2stubie.dll before 1.3.3.0 in PandaActiveScan Installer 2.0 in Panda ActiveScan downloads software in an as2guiie.cab archive located at an arbitrary URL and does not verify the archive's digital signature before installation which allows remote attackers to execute arbitrary code via a URL argument to an unspecified method.


Microsoft Office Excel 2002 SP3 2003 SP3 and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word Excel and PowerPoint 2007 File Formats SP1 and SP2 do not properly parse the Excel file format which allows remote attackers to execute arbitrary code via a spreadsheet with a malformed record object aka \Excel Field Sanitization Vulnerability.\


HP

Operations

Manager

on

Windows

contains

a

\hidden

account\

in

the

XML

file

that

specifies

Tomcat

users

which

allows

remote

attackers

to

conduct

unrestricted

file

upload

attacks

and

thereby

execute

arbitrary

code

by

using

the

org.apache.catalina.manager.HTMLManagerServlet

class

to

make

requests

to

manager/html/upload.


Multiple format string vulnerabilities in lib/silcclient/command.c in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.10 and SILC Client 1.1.8 and earlier allow remote attackers to execute arbitrary code via format string specifiers in a channel name related to (1) silc_client_command_topic (2) silc_client_command_kick (3) silc_client_command_leave and (4) silc_client_command_users.


The Java Web Start Installer in Sun Java SE in JDK and JRE 6 before Update 17 does not properly use security model permissions when removing installer extensions which allows remote attackers to execute arbitrary code by modifying a certain JNLP file to have a URL field that points to an unintended trusted application aka Bug Id 6872824.


The saveForwardAttachments procedure in the Compose Mail functionality in vtiger CRM 5.0.4 allows remote authenticated users to execute arbitrary code by composing an e-mail message with an attachment filename ending in (1) .php in installations based on certain Apache HTTP Server configurations (2) .php. on Windows or (3) .php/ on Linux and then making a direct request to a certain pathname under storage/.


Adobe Shockwave Player before 11.5.2.602 allows remote attackers to execute arbitrary code via crafted Shockwave content on a web site related to an \invalid pointer vulnerability \ a different issue than CVE-2009-3465. NOTE: some of these details are obtained from third party information.


Multiple use-after-free vulnerabilities in vnc.c in the VNC server in QEMU 0.10.6 and earlier might allow guest OS users to execute arbitrary code on the host OS by establishing a connection from a VNC client and then (1) disconnecting during data transfer (2) sending a message using incorrect integer data types or (3) using the Fuzzy Screen Mode protocol related to double free vulnerabilities.


Unrestricted file upload vulnerability in admin/editor/filemanager/browser.html in Anantasoft Gazelle CMS 1.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in user/File/.


Unrestricted file upload vulnerability in the RoboHelpServer Servlet (robohelp/server) in Adobe RoboHelp Server 8 allows remote attackers to execute arbitrary code by uploading a Java Archive (.jsp) file during a PUBLISH action then accessing it via a direct request to the file in the robohelp/robo/reserved/web directory under its sessionid subdirectory as demonstrated by the vd_adobe module in VulnDisco Pack Professional 8.7 through 8.11.


Adobe Shockwave Player before 11.5.2.602 allows remote attackers to execute arbitrary code via crafted Shockwave content on a web site related to an \invalid pointer vulnerability \ a different issue than CVE-2009-3464. NOTE: some of these details are obtained from third party information.


VRTSweb.exe in VRTSweb in Symantec Backup Exec Continuous Protection Server (CPS) 11d 12.0 and 12.5; Veritas NetBackup Operations Manager (NOM) 6.0 GA through 6.5.5; Veritas Backup Reporter (VBR) 6.0 GA through 6.6; Veritas Storage Foundation (SF) 3.5; Veritas Storage Foundation for Windows High Availability (SFWHA) 4.3MP2 5.0 5.0RP1a 5.0RP2 5.1 and 5.1AP1; Veritas Storage Foundation for High Availability (SFHA) 3.5; Veritas Storage Foundation for Oracle (SFO) 4.1 5.0 and 5.0.1; Veritas Storage Foundation for DB2 4.1 and 5.0; Veritas Storage Foundation for Sybase 4.1 and 5.0; Veritas Storage Foundation for Oracle Real Application Cluster (SFRAC) 3.5 4.0 4.1 and 5.0; Veritas Storage Foundation Manager (SFM) 1.0 1.0 MP1 1.1 1.1.1Ux 1.1.1Win and 2.0; Veritas Cluster Server (VCS) 3.5 4.0 4.1 and 5.0; Veritas Cluster Server One (VCSOne) 2.0 2.0.1 and 2.0.2; Veritas Application Director (VAD) 1.1 and 1.1 Platform Expansion; Veritas Cluster Server Management Console (VCSMC) 5.1 5.5 and 5.5.1; Veritas Storage Foundation Cluster File System (SFCFS) 3.5 4.0 4.1 and 5.0; Veritas Storage Foundation Cluster File System for Oracle RAC (SFCFS RAC) 5.0; Veritas Command Central Storage (CCS) 4.x 5.0 and 5.1; Veritas Command Central Enterprise Reporter (CC-ER) 5.0 GA 5.0 MP1 5.0 MP1RP1 and 5.1; Veritas Command Central Storage Change Manager (CC-SCM) 5.0 and 5.1; and Veritas MicroMeasure 5.0 does not properly validate authentication requests which allows remote attackers to trigger the unpacking of a WAR archive and execute arbitrary code in the contained files via crafted data to TCP port 14300.


The 3D implementation in Adobe Reader and Acrobat 9.x before 9.3 and 8.x before 8.2 on Windows and Mac OS X might allow attackers to execute arbitrary code via unspecified vectors related to a \DLL-loading vulnerability.\


Multiple format string vulnerabilities in lib/silcclient/client_entry.c in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.10 and SILC Client before 1.1.8 allow remote attackers to execute arbitrary code via format string specifiers in a nickname field related to the (1) silc_client_add_client (2) silc_client_update_client and (3) silc_client_nickname_format functions.


Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4 and SeaMonkey before 2.0 allows remote attackers to execute arbitrary code via a crafted regular expression in a Proxy Auto-configuration (PAC) file.


Blender 2.34 2.35a 2.40 and 2.49b allows remote attackers to execute arbitrary code via a .blend file that contains Python statements in the onLoad action of a ScriptLink SDNA.


Unrestricted file upload vulnerability in the wp_check_filetype function in wp-includes/functions.php in WordPress before 2.8.6 when a certain configuration of the mod_mime module in the Apache HTTP Server is enabled allows remote authenticated users to execute arbitrary code by posting an attachment with a multiple-extension filename and then accessing this attachment via a direct request to a wp-content/uploads/ pathname as demonstrated by a .php.jpg filename.


The web console in Symantec Altiris Notification Server 6.0.x before 6.0 SP3 R12 uses a hardcoded key that can decrypt SQL Server credentials and certain discovery credentials and stores this key on the Notification Server machine which allows local users to obtain sensitive information and possibly execute arbitrary code by decrypting and using these credentials.


The Oracle Siebel Option Pack for IE ActiveX control does not properly initialize memory that is used by the NewBusObj method which allows remote attackers to execute arbitrary code via a crafted HTML document.


The Altiris eXpress NS SC Download ActiveX control in AeXNSPkgDLLib.dll as used in Symantec Altiris Deployment Solution 6.9.x Notification Server 6.0.x and Symantec Management Platform 7.0.x exposes an unsafe method which allows remote attackers to force the download of arbitrary files and possibly execute arbitrary code via the DownloadAndInstall method.


Unrestricted file upload vulnerability in RADactive I-Load before 2008.2.5.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension and then sending a request for a predictable filename during a short time window.


Multiple unspecified vulnerabilities in Symantec Altiris Deployment Solution 6.9 might allow remote attackers to execute arbitrary code via unknown client-side attack vectors as demonstrated by a certain module in VulnDisco Pack Professional 7.17 as identified by (1) \Symantec Altiris Deployment Solution 6.9 exploit (2) \Symantec Altiris Deployment Solution 6.9 exploit (II) \ and (3) \Symantec Altiris Deployment Solution 6.9 exploit (III).\ NOTE: as of 20090909 this disclosure has no actionable information. However because the VulnDisco Pack author is a reliable researcher the issue is being assigned a CVE identifier for tracking purposes.


Microsoft Office Excel 2002 SP3 2003 SP3 and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word Excel and PowerPoint 2007 File Formats SP1 and SP2 allow remote attackers to execute arbitrary code via a spreadsheet containing a malformed formula related to a \pointer corruption\ issue aka \Excel Index Parsing Vulnerability.\


The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3 8.x before 8.2 on Windows and Mac OS X and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document related to a CLODProgressiveMeshDeclaration \array boundary issue \ a different vulnerability than CVE-2009-2994.


Autodesk Maya 8.0 8.5 2008 2009 and 2010 and Alias Wavefront Maya 6.5 and 7.0 allow remote attackers to execute arbitrary code via a (1) .ma or (2) .mb file that uses the Maya Embedded Language (MEL) python command or unspecified other MEL commands related to \Script Nodes.\


Mozilla Firefox before 3.0.14 and 3.5.x before 3.5.3 does not properly manage pointers for the columns (aka TreeColumns) of a XUL tree element which allows remote attackers to execute arbitrary code via a crafted HTML document related to a \dangling pointer vulnerability.\


Unrestricted file upload vulnerability in upload-file.php in Adam Patterson Studio Lounge Address Book 2.5 as reachable from index2.php allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in profiles/.


Unspecified vulnerability in Avifil32.dll in the Windows Media file handling functionality in Microsoft Windows 2000 SP4 XP SP2 and SP3 Server 2003 SP2 Vista Gold SP1 and SP2 and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via a malformed header in a crafted AVI file aka \Malformed AVI Header Vulnerability.\


The Microsoft Office Web Components Spreadsheet ActiveX control (aka OWC10 or OWC11) as distributed in Office XP SP3 and Office 2003 SP3 Office XP Web Components SP3 Office 2003 Web Components SP3 Office 2003 Web Components SP1 for the 2007 Microsoft Office System Internet Security and Acceleration (ISA) Server 2004 SP3 and 2006 Gold and SP1 and Office Small Business Accounting 2006 when used in Internet Explorer allows remote attackers to execute arbitrary code via a crafted call to the msDataSourceObject method as exploited in the wild in July and August 2009 aka \Office Web Components HTML Script Vulnerability.\


Unspecified vulnerability in the Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; 1.4.2_19 and earlier; and 1.3.1_24 and earlier allows remote attackers to access files and execute arbitrary code via unknown vectors related to \deserializing applets \ aka CR 6646860.


Multiple unspecified vulnerabilities in CycloMedia CycloScopeLite 2.50.3.0 allow remote attackers to execute arbitrary code via the ReturnConnection method in (1) CM_ADOConnection.dll (2) CM_AddressInfoDBC.dll and (3) CM_RecordingLocationDBC.dll related to improper dereferencing. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Unrestricted file upload vulnerability in admin/editor/image.php in e-cart.biz Free Shopping Cart allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in images/.


The TCP/IP implementation in Microsoft Windows Vista Gold SP1 and SP2 and Server 2008 Gold and SP2 does not properly manage state information which allows remote attackers to execute arbitrary code by sending packets to a listening service and thereby triggering misinterpretation of an unspecified field as a function pointer aka \TCP/IP Timestamps Code Execution Vulnerability.\


XFR.EXE in the Intel File Transfer service in the console in Symantec Alert Management System 2 (AMS2) as used in Symantec System Center (SSS); Symantec AntiVirus Server; Symantec AntiVirus Central Quarantine Server; Symantec AntiVirus (SAV) Corporate Edition 9 before 9.0 MR7 10.0 and 10.1 before 10.1 MR8 and 10.2 before 10.2 MR2; Symantec Client Security (SCS) 2 before 2.0 MR7 and 3 before 3.1 MR8; and Symantec Endpoint Protection (SEP) before 11.0 MR3 allows remote attackers to execute arbitrary code by placing the code on a (1) share or (2) WebDAV server and then sending the UNC share pathname to this service.


Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4 Windows XP SP2 and SP3 and Windows Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted QuickTime media file as exploited in the wild in May 2009 aka \DirectX NULL Byte Overwrite Vulnerability.\


The Deployment Toolkit ActiveX control in deploytk.dll 6.0.130.3 in Sun Java SE Runtime Environment (aka JRE) 6 Update 13 allows remote attackers to (1) execute arbitrary code via a .jnlp URL in the argument to the launch method and might allow remote attackers to launch JRE installation processes via the (2) installLatestJRE or (3) installJRE method.


The JBIG2 decoder in Xpdf 3.02pl2 and earlier CUPS 1.3.9 and earlier Poppler before 0.10.6 and other products allows remote attackers to execute arbitrary code via a crafted PDF file that triggers a free of invalid data.


Unspecified vulnerability in xtagent.exe in Novell NetIdentity Client before 1.2.4 allows remote attackers to execute arbitrary code by establishing an IPC$ connection to the XTIERRPCPIPE named pipe and sending RPC messages that trigger a dereference of an arbitrary pointer.


Unspecified vulnerability in Config.dll in Baofeng products 3.09.04.17 and earlier allows remote attackers to execute arbitrary code by calling the SetAttributeValue method as exploited in the wild in April and May 2009.


The Telnet service in Microsoft Windows 2000 SP4 XP SP2 and SP3 Server 2003 SP2 Vista Gold SP1 and SP2 and Server 2008 Gold and SP2 allows remote Telnet servers to execute arbitrary code on a client machine by replaying the NTLM credentials of a client user aka \Telnet Credential Reflection Vulnerability \ a related issue to CVE-2000-0834.


Unrestricted file upload vulnerability in Leap CMS 0.1.4 allows remote attackers to execute arbitrary code by uploading a file with an executable extension via an admin.system.files (aka Manage Files) request to the default URI then accessing the file via a direct request.


Multiple argument injection vulnerabilities in PPLive.exe in PPLive 1.9.21 and earlier allow remote attackers to execute arbitrary code via a UNC share pathname in the LoadModule argument to the (1) synacast (2) Play (3) pplsv or (4) ppvod URI handler. NOTE: some of these details are obtained from third party information.


Format string vulnerability in the PROFINET/DCP (PN-DCP) dissector in Wireshark 1.0.6 and earlier allows remote attackers to execute arbitrary code via a PN-DCP packet with format string specifiers in the station name. NOTE: some of these details are obtained from third party information.


Unrestricted file upload vulnerability in myaccount.php in Easy Scripts Answer and Question Script allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in the uploads/username directory.


Unspecified vulnerability in the Virtual Machine in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier allows remote attackers to access files and execute arbitrary code via unknown vectors related to \code generation.\


Use-after-free vulnerability in the HTML parser in Mozilla Firefox 3.0.x before 3.0.18 and 3.5.x before 3.5.8 Thunderbird before 3.0.2 and SeaMonkey before 2.0.3 allows remote attackers to execute arbitrary code via unspecified method calls that attempt to access freed objects in low-memory situations.


Unrestricted file upload vulnerability in upload.php in Elkagroup Image Gallery 1.0 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in gallery/pictures/. NOTE: some of these details are obtained from third party information.


The Java Web Start framework in IcedTea in OpenJDK before 1.6.0.0-20.b16.fc10 on Fedora 10 and before 1.6.0.0-27.b16.fc11 on Fedora 11 trusts an entire application when at least one of the listed jar files is trusted which allows context-dependent attackers to execute arbitrary code without the untrusted-code restrictions via a crafted application related to NetX.


body.asp in Web File Explorer 3.1 allows remote attackers to create arbitrary files and execute arbitrary code via the savefile action with a file parameter containing a filename that has an executable extension.


The Aqua Look and Feel for Java implementation in Java 1.5 on Mac OS X 10.5 allows remote attackers to execute arbitrary code via a call to the undocumented apple.laf.CColourUIResource constructor with a crafted value in the first argument which is dereferenced as a pointer.


The QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4 Windows XP SP2 and SP3 and Windows Server 2003 SP2 performs updates to pointers without properly validating unspecified data values which allows remote attackers to execute arbitrary code via a crafted QuickTime media file aka \DirectX Pointer Validation Vulnerability.\


Multiple unspecified vulnerabilities in (1) unlzh.c and (2) unpack.c in the gzip libraries in Microsoft Windows Server 2008 Windows Services for UNIX 3.0 and 3.5 and the Subsystem for UNIX-based Applications (SUA); as used in gunzip gzip pack pcat and unpack 7.x before 7.0.1701.48 8.x before 8.0.1969.62 and 9.x before 9.0.3790.2076; allow remote attackers to execute arbitrary code via unknown vectors.


Excel in 2007 Microsoft Office System SP1 and SP2; Microsoft Office Excel Viewer; and Microsoft Office Compatibility Pack for Word Excel and PowerPoint 2007 File Formats SP1 and SP2 allow remote attackers to execute arbitrary code via a BIFF file with a malformed Qsir (0x806) record object aka \Record Pointer Corruption Vulnerability.\


Unspecified vulnerability in Adobe Acrobat Reader 9 before 9.1 8 before 8.1.4 and 7 before 7.1.1 might allow remote attackers to execute arbitrary code via unknown attack vectors related to JBIG2 and \input validation \ a different vulnerability than CVE-2009-0193 and CVE-2009-1062.


Unspecified vulnerability in the virtual machine display function in VMware Workstation 6.5.1 and earlier; VMware Player 2.5.1 and earlier; VMware ACE 2.5.1 and earlier; VMware Server 1.x before 1.0.9 build 156507 and 2.x before 2.0.1 build 156745; VMware Fusion before 2.0.4 build 159196; VMware ESXi 3.5; and VMware ESX 3.0.2 3.0.3 and 3.5 allows guest OS users to execute arbitrary code on the host OS via unknown vectors a different vulnerability than CVE-2008-4916.


The QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4 Windows XP SP2 and SP3 and Windows Server 2003 SP2 does not properly validate unspecified size fields in QuickTime media files which allows remote attackers to execute arbitrary code via a crafted file aka \DirectX Size Validation Vulnerability.\


Unspecified vulnerability in JustSystems Ichitaro 13 2004 through 2008 Lite2 and Ichitaro viewer 5.1.5.0 and earlier allows remote attackers to execute arbitrary code via a crafted file as exploited in the wild by Trojan.Tarodrop.H in March 2009.


Unspecified vulnerability in the LDAP implementation in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; SDK and JRE 1.3.1_24 and earlier; and 1.4.2_19 and earlier allows remote LDAP servers to execute arbitrary code via unknown vectors related to serialized data.


Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.3 allows remote attackers to affect confidentiality integrity and availability via unknown vectors. NOTE: the previous information was obtained from the July 2009 Oracle CPU. Oracle has not commented on claims from an independent researcher that this vulnerability allows remote authenticated users to execute arbitrary code with SYSTEM privileges via vectors involving property_box.php.


Apple Safari before 4.0 does not prevent calls to the open-help-anchor URL handler by web sites which allows remote attackers to open arbitrary local help files and execute arbitrary code or obtain sensitive information via a crafted call.


Mozilla Firefox 3.0.7 on Windows 7 allows remote attackers to execute arbitrary code via unknown vectors related to the _moveToEdgeShift XUL tree method which triggers garbage collection on objects that are still in use as demonstrated by Nils during a PWN2OWN competition at CanSecWest 2009.


The LDAP service in Active Directory on Microsoft Windows 2000 SP4 does not properly free memory for LDAP and LDAPS requests which allows remote attackers to execute arbitrary code via a request that uses hexadecimal encoding whose associated memory is not released related to a \DN AttributeValue \ aka \Active Directory Invalid Free Vulnerability.\ NOTE: this issue is probably a memory leak.


The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1 Visual Studio 2005 SP1 and 2008 Gold and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4 XP SP2 and SP3 Server 2003 SP2 Vista Gold SP1 and SP2 and Server 2008 Gold and SP2; does not prevent VariantClear calls on an uninitialized VARIANT which allows remote attackers to execute arbitrary code via a malformed stream to an ATL (1) component or (2) control related to ATL headers and error handling aka \ATL Uninitialized Object Vulnerability.\


Double free vulnerability in Mozilla Firefox before 3.0.7 Thunderbird before 2.0.0.21 and SeaMonkey before 1.1.15 allows remote attackers to execute arbitrary code via \cloned XUL DOM elements which were linked as a parent and child \ which are not properly handled during garbage collection.


Multiple insecure method vulnerabilities in the Web On Windows (WOW) ActiveX control in WOW ActiveX 2 allow remote attackers to (1) create and overwrite arbitrary files via the WriteIniFileString method (2) execute arbitrary programs via the ShellExecute method (3) read from the registry via unspecified vectors and (4) write to the registry via unspecified vectors. NOTE: vectors 1 and 2 can be used together to execute arbitrary code.


avatarlist.php in the Your Account module reached through modules.php in Raven Web Services RavenNuke 2.30 allows remote authenticated users to execute arbitrary code via PHP sequences in an element of the replacements array which is processed by the preg_replace function with the eval switch as specified in an element of the patterns array.


Windows HTTP Services (aka WinHTTP) in Microsoft Windows 2000 SP4 XP SP2 and SP3 Server 2003 SP1 and SP2 Vista Gold and SP1 and Server 2008; and WinINet in Microsoft Internet Explorer 5.01 SP4 6 SP1 6 and 7 on Windows XP SP2 and SP3 6 and 7 on Windows Server 2003 SP1 and SP2 7 on Windows Vista Gold and SP1 and 7 on Windows Server 2008; allows remote web servers to capture and replay NTLM credentials and execute arbitrary code via vectors related to absence of a \credential-reflection protections\ opt-in step aka \Windows HTTP Services Credential Reflection Vulnerability\ and \WinINet Credential Reflection Vulnerability.\


Help Viewer in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7 does not verify that certain Cascading Style Sheets (CSS) are located in a registered help book which allows remote attackers to execute arbitrary code via a help: URL that triggers invocation of AppleScript files.


Microsoft Windows does not properly enforce the Autorun and NoDriveTypeAutoRun registry values which allows physically proximate attackers to execute arbitrary code by (1) inserting CD-ROM media (2) inserting DVD media (3) connecting a USB device and (4) connecting a Firewire device; (5) allows user-assisted remote attackers to execute arbitrary code by mapping a network drive; and allows user-assisted attackers to execute arbitrary code by clicking on (6) an icon under My Computer\\Devices with Removable Storage and (7) an option in an AutoPlay dialog related to the Autorun.inf file. NOTE: vectors 1 and 3 on Vista are already covered by CVE-2008-0951.


Untrusted search path vulnerability in src/if_python.c in the Python interface in Vim before 7.2.045 allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983) as demonstrated by an erroneous search path for plugin/bike.vim in bicyclerepair.


The shell32 module in Microsoft Internet Explorer 7.0 on Windows XP SP3 might allow remote attackers to execute arbitrary code via a long VALUE attribute in an INPUT element possibly related to a stack consumption vulnerability.


Foxit Reader 2.3 before Build 3902 and 3.0 before Build 1506 including 3.0.2009.1301 does not properly handle a JBIG2 symbol dictionary segment with zero new symbols which allows remote attackers to execute arbitrary code via a crafted PDF file that triggers a dereference of an uninitialized memory location.


Microsoft Project 2000 SR1 and 2002 SP1 and Office Project 2003 SP3 does not properly handle memory allocation for Project files which allows remote attackers to execute arbitrary code via a malformed file aka \Project Memory Validation Vulnerability.\


Help Viewer in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7 does not verify that HTML pathnames are located in a registered help book which allows remote attackers to execute arbitrary code via a help: URL that triggers invocation of AppleScript files.


Untrusted search path vulnerability in the Python language bindings for Nautilus (nautilus-python) allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).


Microsoft Office Excel 2000 SP3 2002 SP3 2003 SP3 and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word Excel and PowerPoint 2007 File Formats SP1; and Excel in Microsoft Office 2004 and 2008 for Mac allow remote attackers to execute arbitrary code via a crafted Excel document that triggers an access attempt on an invalid object as exploited in the wild in February 2009 by Trojan.Mdropper.AC.


Unspecified vulnerability in the OPMN component in Oracle Application Server 10.1.2.3 allows remote attackers to affect confidentiality integrity and availability via unknown vectors. NOTE: the previous information was obtained from the April 2009 CPU. Oracle has not commented on reliable researcher claims that this issue is a format string vulnerability that allows remote attackers to execute arbitrary code via format string specifiers in an HTTP POST URI which are not properly handled when logging to opmn/logs/opmn.log.


The PDF distiller in the Attachment Service in Research in Motion (RIM) BlackBerry Enterprise Server (BES) 4.1.3 through 4.1.6 BlackBerry Professional Software 4.1.4 and BlackBerry Unite! before 1.0.3 bundle 28 performs delete operations on uninitialized pointers which allows user-assisted remote attackers to execute arbitrary code via a crafted data stream in a .pdf file.


Microsoft Windows Media Runtime as used in DirectShow WMA Voice Codec Windows Media Audio Voice Decoder and Audio Compression Manager (ACM) does not properly process Advanced Systems Format (ASF) files which allows remote attackers to execute arbitrary code via a crafted audio file that uses the Windows Media Speech codec aka \Windows Media Runtime Voice Sample Rate Vulnerability.\


Excel in Microsoft Office 2000 SP3 Office XP SP3 Office 2003 SP3 and Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; and Microsoft Office Excel Viewer 2003 SP3 allow remote attackers to execute arbitrary code via a crafted Excel file with a malformed record object aka \Record Pointer Corruption Vulnerability.\


Integer underflow in Windows HTTP Services (aka WinHTTP) in Microsoft Windows 2000 SP4 XP SP2 and SP3 Server 2003 SP1 and SP2 Vista Gold and SP1 and Server 2008 allows remote HTTP servers to execute arbitrary code via crafted parameter values in a response related to error handling aka \Windows HTTP Services Integer Underflow Vulnerability.\


Microsoft .NET Framework 1.0 SP3 1.1 SP1 and 2.0 SP1 does not properly validate .NET verifiable code which allows remote attackers to obtain unintended access to stack memory and execute arbitrary code via (1) a crafted XAML browser application (XBAP) (2) a crafted ASP.NET application or (3) a crafted .NET Framework application aka \Microsoft .NET Framework Pointer Verification Vulnerability.\


Unspecified vulnerability in the Veritas network daemon (aka vnetd) in Symantec Veritas NetBackup Server / Enterprise Server 5.x 6.0 before MP7 SP1 and 6.5 before 6.5.3.1 allows remote attackers to execute arbitrary code via unknown vectors related to \initial communications setup.\


The WordPerfect 6.x Converter (WPFT632.CNV 1998.1.27.0) in Microsoft Office Word 2000 SP3 and Microsoft Office Converter Pack does not properly validate the length of an unspecified string which allows remote attackers to execute arbitrary code via a crafted WordPerfect 6.x file related to an unspecified counter and control structures on the stack aka \Word 2000 WordPerfect 6.x Converter Stack Corruption Vulnerability.\


The Backbone service (ftbackbone.exe) in EMC AutoStart before 5.3 SP2 allows remote attackers to execute arbitrary code via a packet with a crafted value that is dereferenced as a function pointer.


The Python AI module in Wesnoth 1.4.x and 1.5 before 1.5.11 allows remote attackers to escape the sandbox and execute arbitrary code by using a whitelisted module that imports an unsafe module then using a hierarchical module name to access the unsafe module through the whitelisted module.


sys_term.c in telnetd in FreeBSD 7.0-RELEASE and other 7.x versions deletes dangerous environment variables with a method that was valid only in older FreeBSD distributions which might allow remote attackers to execute arbitrary code by passing a crafted environment variable from a telnet client as demonstrated by an LD_PRELOAD value that references a malicious library.


Mozilla Firefox before 3.0.6 and SeaMonkey do not block links to the (1) about:plugins and (2) about:config URIs from .desktop files which allows user-assisted remote attackers to bypass the Same Origin Policy and execute arbitrary code with chrome privileges via vectors involving the URL field in a Desktop Entry section of a .desktop file related to representation of about: URIs as jar:file:// URIs. NOTE: this issue exists because of an incomplete fix for CVE-2008-4582.


Excel in Microsoft Office 2000 SP3 Office XP SP3 Office 2003 SP3 and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System SP1 and SP2; Open XML File Format Converter for Mac; Microsoft Office Excel Viewer 2003 SP3; Microsoft Office Excel Viewer; and Microsoft Office Compatibility Pack for Word Excel and PowerPoint 2007 File Formats SP1 and SP2 allow remote attackers to execute arbitrary code via a crafted Excel file with a malformed record object aka \Object Record Corruption Vulnerability.\


Unspecified vulnerability in Easy Login in the Sender module in HP Remote Graphics Software (RGS) 4.0.0 through 5.2.4 allows remote attackers to execute arbitrary code via unknown vectors.


Use-after-free vulnerability in DirectShow in Microsoft DirectX 8.1 and 9.0 allows remote attackers to execute arbitrary code via an MJPEG file or video stream with a malformed Huffman table which triggers an exception that frees heap memory that is later accessed aka \MJPEG Decompression Vulnerability.\


Multiple \input validation flaws\ in the JBIG2 decoder in Xpdf 3.02pl2 and earlier CUPS 1.3.9 and earlier Poppler before 0.10.6 and other products allow remote attackers to execute arbitrary code via a crafted PDF file.


The Office Web Components ActiveX Control in Microsoft Office XP SP3 Office 2003 SP3 Office XP Web Components SP3 Office 2003 Web Components SP3 Office 2003 Web Components SP1 for the 2007 Microsoft Office System Internet Security and Acceleration (ISA) Server 2004 SP3 and 2006 SP1 and Office Small Business Accounting 2006 does not properly allocate memory which allows remote attackers to execute arbitrary code via unspecified vectors that trigger \system state\ corruption aka \Office Web Components Memory Allocation Vulnerability.\


The graphics device interface (GDI) implementation in the kernel in Microsoft Windows 2000 SP4 XP SP2 and SP3 Server 2003 SP1 and SP2 Vista Gold and SP1 and Server 2008 does not properly validate input received from user mode which allows remote attackers to execute arbitrary code via a crafted (1) Windows Metafile (aka WMF) or (2) Enhanced Metafile (aka EMF) image file aka \Windows Kernel Input Validation Vulnerability.\


Interaction error in xdg-open allows remote attackers to execute arbitrary code by sending a file with a dangerous MIME type but using a safe type that Firefox sends to xdg-open which causes xdg-open to process the dangerous file type through automatic type detection as demonstrated by overwriting the .desktop file.


Untrusted search path vulnerability in the GObject Python interpreter wrapper in Gnumeric allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).


Microsoft .NET Framework 2.0 2.0 SP1 and 3.5 does not properly enforce a certain type-equality constraint in .NET verifiable code which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) (2) a crafted ASP.NET application or (3) a crafted .NET Framework application aka \Microsoft .NET Framework Type Verification Vulnerability.\


Unrestricted file upload vulnerability in index.php in Miltenovik Manojlo MemHT Portal 4.0.1 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension and an image content type via a users editProfile action then accessing this file via a direct request to the file in images/avatar/uploaded/.


Microsoft Office Visio 2002 SP2 2003 SP3 and 2007 SP1 does not properly validate object data in Visio files which allows remote attackers to execute arbitrary code via a crafted file aka \Memory Validation Vulnerability.\


Multiple eval injection vulnerabilities in phpScheduleIt before 1.2.11 allow remote attackers to execute arbitrary code via (1) the end_date parameter to reserve.php and (2) the start_date and end_date parameters to check.php. NOTE: the start_date/reserve.php vector is already covered by CVE-2008-6132.


HP Operations Manager has a default password of OvW*busr1 for the ovwebusr account which allows remote attackers to execute arbitrary code via a session that uses the manager role to conduct unrestricted file upload attacks against the /manager servlet in the Tomcat servlet container. NOTE: this might overlap CVE-2009-3099 and CVE-2009-3843.


The loadContentFromCookie function in core/Cookie.php in Piwik before 0.5 does not validate strings obtained from cookies before calling the unserialize function which allows remote attackers to execute arbitrary code or upload arbitrary files via vectors related to the __destruct function in the Piwik_Config class; php://filter URIs; the __destruct functions in Zend Framework as demonstrated by the Zend_Log destructor; the shutdown functions in Zend Framework as demonstrated by the Zend_Log_Writer_Mail class; the render function in the Piwik_View class; Smarty templates; and the _eval function in Smarty.


Multiple format string vulnerabilities in the tolog function in httpdx 1.4 1.4.5 1.4.6 1.4.6b and 1.5 allow (1) remote attackers to execute arbitrary code via format string specifiers in a GET request to the HTTP server component when logging is enabled and allow (2) remote authenticated users to execute arbitrary code via format string specifiers in a PWD command to the FTP server component.


Unspecified vulnerability in the JASS script interpreter in Warcraft III: The Frozen Throne 1.24b and earlier allows user-assisted remote attackers to execute arbitrary code via a crafted custom map. NOTE: some of these details are obtained from third party information.


Unrestricted file upload vulnerability in ofc_upload_image.php in Open Flash Chart v2 Beta 1 through v2 Lug Wyrm Charmer as used in Piwik 0.2.35 through 0.4.3 Woopra Analytics Plugin before 1.4.3.2 and possibly other products when register_globals is enabled allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension through the name parameter with the code in the HTTP_RAW_POST_DATA parameter then accessing it via a direct request to the file in tmp-upload-images/.


HP Operations Dashboard has a default password of j2deployer for the j2deployer account which allows remote attackers to execute arbitrary code via a session that uses the manager role to conduct unrestricted file upload attacks against the /manager servlet in the Tomcat servlet container. NOTE: this might overlap CVE-2009-3098.


Unrestricted file upload vulnerability in banner-edit.php in OpenX adserver 2.8.1 and earlier allows remote authenticated users with banner / file upload permissions to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in an images directory.


Unspecified vulnerability in the Indeo codec in Microsoft Windows 2000 SP4 XP SP2 and SP3 and Server 2003 SP2 allows remote attackers to execute arbitrary code via crafted media content as reported to Microsoft by Paul Byrne of NGS Software. NOTE: this might overlap CVE-2008-3615.


Unrestricted file upload vulnerability in repository/repository_attachment.php in AlienVault Open Source Security Information Management (OSSIM) 2.1.5 and possibly other versions before 2.1.5-4 allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in ossiminstall/uploads/.


Unrestricted file upload vulnerability in Serendipity before 1.5 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension followed by a safe extension then accessing it via a direct request to the file in an unspecified directory. NOTE: some of these details are obtained from third party information.


Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3 and 8.x before 8.2 on Windows and Mac OS X allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams as exploited in the wild in December 2009.


Multiple unrestricted file upload vulnerabilities in upload.php in PHPhotoalbum allow remote attackers to execute arbitrary code by uploading a file with a (1) .php.pgif or (2) .php.pjpeg double extension then accessing it via a direct request to the file in albums/userpics/.


Absolute Computrace Agent V80.845 and V80.866 does not have a digital signature for the configuration block which allows attackers to set up communication with a web site other than the intended search.namequery.com site by modifying data within a disk's inter-partition space. This allows a privileged local user to execute arbitrary code even after that user loses access and all disk partitions are reformatted.


Internet Explorer 5.01 SP3 through 6.0 SP1 does not properly determine object types that are returned by web servers which could allow remote attackers to execute arbitrary code via an object tag with a data parameter to a malicious file hosted on a server that returns an unsafe Content-Type aka the \Object Type\ vulnerability.


Gallery.pm in Apache::Gallery (aka A::G) uses predictable temporary filenames when running Inline::C which allows local users to execute arbitrary code by creating and modifying the files before Apache::Gallery does.


The IN_MIDI.DLL plugin 3.01 and earlier as used in Winamp 2.91 allows remote attackers to execute arbitrary code via a MIDI file with a large \Track data size\ value.


The NtSetLdtEntries function in the programming interface for the Local Descriptor Table (LDT) in Windows NT 4.0 and Windows 2000 allows local attackers to gain access to kernel memory and execute arbitrary code via an expand-down data segment descriptor descriptor that points to protected memory.


Unknown vulnerability in the HSQLDB component in JBoss 3.2.1 and 3.0.8 on Java 1.4.x platforms when running in the default configuration allows remote attackers to conduct unauthorized activities and possibly execute arbitrary code via certain SQL statements to (1) TCP port 1701 in JBoss 3.2.1 and (2) port 1476 in JBoss 3.0.8.


The Utility Manager in Microsoft Windows 2000 executes winhlp32.exe with system privileges which allows local users to execute arbitrary code via a \Shatter\ style attack using a Windows message that accesses the context sensitive help button in the GUI as demonstrated using the File Open dialog in the Help window a different vulnerability than CVE-2004-0213.


A \buffer management error\ in buffer_append_space of buffer.c for OpenSSH before 3.7 may allow remote attackers to execute arbitrary code by causing an incorrect amount of memory to be freed and corrupting the heap a different vulnerability than CVE-2003-0695.


The default installation of MSDE via McAfee ePolicy Orchestrator 2.0 through 3.0 allows attackers to execute arbitrary code via a series of steps that (1) obtain the database administrator username and encrypted password in a configuration file from the ePO server using a certain request (2) crack the password due to weak cryptography and (3) use the password to pass commands through xp_cmdshell.


The control for listing accessibility options in the Accessibility Utility Manager on Windows 2000 (ListView) does not properly handle Windows messages which allows local users to execute arbitrary code via a \Shatter\ style message to the Utility Manager that references a user-controlled callback function.


FUNC.pm in IkonBoard 3.1.2a and earlier including 3.1.1 does not properly cleanse the \lang\ cookie when it contains illegal characters which allows remote attackers to execute arbitrary code when the cookie is inserted into a Perl \eval\ statement.


The Authenticode capability in Microsoft Windows NT through Server 2003 does not prompt the user to download and install ActiveX controls when the system is low on memory which could allow remote attackers to execute arbitrary code without user approval.


parse_xml.cgi in Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote attackers to execute arbitrary code via shell metacharacters.


Unknown multiple vulnerabilities in (1) lpstat and (2) the libprint library in Solaris 2.6 through 9 may allow attackers to execute arbitrary code or read or write arbitrary files.


Format string vulnerability in mod_gzip_printf for mod_gzip 1.3.26.1a and earlier and possibly later official versions when running in debug mode and using the Apache log allows remote attackers to execute arbitrary code via format string characters in an HTTP GET request with an \Accept-Encoding: gzip\ header.


\Shatter\ vulnerability in CommCtl32.dll in Windows XP may allow local users to execute arbitrary code by sending (1) BCM_GETTEXTMARGIN or (2) BCM_SETTEXTMARGIN button control messages to privileged applications.


The Tutorials 2.0 module in XOOPS and E-XOOPS allows remote attackers to execute arbitrary code by uploading a PHP file without a MIME image type then directly accessing the uploaded file.


man before 1.5l allows attackers to execute arbitrary code via a malformed man file with improper quotes which causes the my_xsprintf function to return a string with the value \unsafe \ which is then executed as a program via a system call if it is in the search path of the user who runs man.


Integer signedness errors in the POP3 client for Mirabilis ICQ Pro 2003a allow remote attackers to execute arbitrary code via the (1) Subject or (2) Date headers.


Format string vulnerability in ePO service for McAfee ePolicy Orchestrator 2.0 2.5 and 2.5.1 allows remote attackers to execute arbitrary code via a POST request with format strings in the computerlist parameter which are used when logging a failed name resolution.


The ByteCode Verifier component of Microsoft Virtual Machine (VM) build 5.0.3809 and earlier as used in Windows and Internet Explorer allows remote attackers to bypass security checks and execute arbitrary code via a malicious Java applet aka \Flaw in Microsoft VM Could Enable System Compromise.\


The loadClass method of the sun.applet.AppletClassLoader class in the Java Virtual Machine (JVM) in Sun SDK and JRE 1.4.1_03 and earlier allows remote attackers to bypass sandbox restrictions and execute arbitrary code via a loaded class name that contains \/\ (slash) instead of \.\ (dot) characters which bypasses a call to the Security Manager's checkPackageAccess method.


Kerberos FTP client allows remote FTP sites to execute arbitrary code via a pipe (|) character in a filename that is retrieved by the client.


Help and Support Center in Microsoft Windows XP SP1 does not properly validate HCP URLs which allows remote attackers to execute arbitrary code via quotation marks in an hcp:// URL which are not quoted when constructing the argument list to HelpCtr.exe.


FrontRange GoldMine mail agent 5.70 and 6.00 before 30503 directly sends HTML to the default browser without setting its security zone or otherwise labeling it untrusted which allows remote attackers to execute arbitrary code via a message that is rendered in IE using a less secure zone.


Internet Explorer 5.01 through 6.0 does not properly handle object tags returned from a Web server during XML data binding which allows remote attackers to execute arbitrary code via an HTML e-mail message or web page.


Openwebmail in cPanel 5.0 when run using suid Perl adds the directory in the SCRIPT_FILENAME environment variable to Perl's @INC include array which allows local users to execute arbitrary code by modifying SCRIPT_FILENAME to reference a directory containing a malicious openwebmail-shared.pl executable.


slashem-tty in the FreeBSD Ports Collection is installed with write permissions for the games group which allows local users with group games privileges to modify slashem-tty and execute arbitrary code as other users as demonstrated using a separate vulnerability in LTris.


The showHelp() function in Microsoft Internet Explorer 5.01 5.5 and 6.0 supports certain types of pluggable protocols that allow remote attackers to bypass the cross-domain security model and execute arbitrary code aka \Improper Cross Domain Security Validation with ShowHelp functionality.\


KaZaA Media Desktop (KMD) 2.0 launches advertisements in the Internet Explorer (IE) local security zone which could allow remote attackers to view local files and possibly execute arbitrary code.


Unknown vulnerability in CDE Print Viewer (dtprintinfo) for Sun Solaris 2.6 through 9 may allow local users to execute arbitrary code.


The Guile plugin for the Gnumeric spreadsheet package allows attackers to execute arbitrary code.


websendmail in Webgais 1.0 allows a remote user to access arbitrary files and execute arbitrary code via the receiver parameter ($VAR_receiver variable).


Java 2 Micro Edition (J2ME) does not properly validate bytecode which allows remote attackers to escape the Kilobyte Virtual Machine (KVM) sandbox and execute arbitrary code.


Microsoft Windows XP Explorer allows attackers to execute arbitrary code via a HTML and script in a self-executing folder that references an executable file within the folder which is automatically executed when a user accesses the folder.


Inetd32 Administration Tool of Hummingbird Connectivity 7.1 and 9.0 allows local users to execute arbitrary code by changing the program for handling incoming connections.


** DISPUTED ** Microsoft Windows 2000 XP and possibly 2003 allows local users with the SeDebugPrivilege privilege to execute arbitrary code as kernel and read or write kernel memory via the NtSystemDebugControl function which does not verify its pointer arguments. Note: this issue has been disputed since Administrator privileges are typically required to exploit this issue thus privilege boundaries are not crossed.


Format string vulnerability in VMware Workstation 4.5.2 build-8848 if running with elevated privileges might allow local users to execute arbitrary code via format string specifiers in command line arguments. NOTE: it is not clear if there are any default or typical circumstances under which VMware would be running with privileges beyond those already available to the attackers so this might not be a vulnerability.


Kerio Personal Firewall (KPF) 2.1.5 allows local users to execute arbitrary code with SYSTEM privileges via the Load button in the Firewall Configuration Files option which does not drop privileges before opening the file loading dialog box.


Unknown vulnerability in Adminedit.pl YaBB 1 Gold before 1.3.2 allows attackers to execute arbitrary code via settings.pl.


Microsoft Windows XP Explorer allows local users to execute arbitrary code via a system folder with a Desktop.ini file containing a .ShellClassInfo specifier with a CLSID value that is associated with an executable file.


Microsoft Windows Internet Explorer 5.5 and 6.0 allows remote attackers to execute arbitrary code via an embedded script that uses Shell Helper objects and a shortcut (link) to execute the target script.


Certain third-party packages for CVSup 16.1h such as SuSE Linux contain untrusted paths in the ELF RPATH fields of certain executables which could allow local users to execute arbitrary code by causing cvsup to link against malicious libraries that are created in world-writable directories such as /usr/src/packages.


PHP file include injection vulnerability in isearch.inc.php for iSearch allows remote attackers to execute arbitrary code via the isearch_path parameter.


Microsoft Outlook 2000 and 2003 when configured to use Microsoft Word 2000 or 2003 as the e-mail editor and when forwarding e-mail does not properly handle an opening OBJECT tag that does not have a closing OBJECT tag which causes Outlook to automatically download the URI in the data property of the OBJECT tag and might allow remote attackers to execute arbitrary code.


Format string vulnerability in qwik-smtpd.c in QwikMail SMTP (qwik-smtpd) 0.3 and earlier allows remote attackers to execute arbitrary code via format specifiers in the (1) clientRcptTo array and the (2) Received and (3) messageID variables possibly involving HELO and hostname arguments.


ImageManager in e107 before 0.617 does not properly check the types of uploaded files which allows remote attackers to execute arbitrary code by uploading a PHP file via the upload parameter to images.php.


Novell Client Firewall (NCF) 2.0 as based on the Agnitum Outpost Firewall allows local users to execute arbitrary code with SYSTEM privileges by opening the NCF tray icon and using the Help functionality to launch programs with SYSTEM privileges.


DokuWiki before 2004-10-19 when used on a web server that permits execution based on file extension allows remote attackers to execute arbitrary code by uploading a file with an appropriate extension such as \.php\ or \.cgi\.


The upgrade for BlackICE PC Protection 3.6 and earlier sets insecure permissions for .INI files such as (1) blackice.ini (2) firewall.ini (3) protect.ini or (4) sigs.ini which allows local users to modify BlackICE configuration or possibly execute arbitrary code by exploiting vulnerabilities in the .INI parsers.


changepassword.cgi in ChangePassword 0.8 when installed setuid allows local users to execute arbitrary code by modifying the PATH environment variable to point to a malicious \make\ program.


The login page for cPanel 9.1.0 and possibly other versions allows remote attackers to execute arbitrary code via shell metacharacters in the user parameter.


Attachment Mod 2.3.10 module for phpBB when used with Apache mod_mime does not properly handle files with multiple file extensions such as .php.rar which allows remote attackers to upload and execute arbitrary code.


Format string vulnerability in the gpsd_report function for BerliOS GPD daemon (gpsd formerly pygps) 1.9.0 through 2.7 allows remote attackers to execute arbitrary code via certain GPS requests containing format string specifiers that are not properly handled in syslog calls.


UploadFile.php in MoniWiki 1.0.9.2 and earlier when used with Apache mod_mime does not properly handle files with two file extensions such as .php.hwp which allows remote attackers to upload and execute arbitrary code.


The AVXSCANONLINE.AvxScanOnlineCtrl.1 ActiveX control in BitDefender Scan Online allows remote attackers to (1) obtain sensitive information such as system drives and contents or (2) use the RequestFile method to download and execute arbitrary code via an object codebase that uses bitdefender.cab.


The Sun Java Plugin capability in Java 2 Runtime Environment (JRE) 1.4.2_01 1.4.2_04 and possibly earlier versions does not properly restrict access between Javascript and Java applets during data transfer which allows remote attackers to load unsafe classes and execute arbitrary code by using the reflection API to access private Java packages.


Format string vulnerability in the PRINT_ERROR function in common.c for Cherokee Web Server 0.4.16 and earlier allows local users to execute arbitrary code via format string specifiers in the -C command line argument. NOTE: it is not clear whether this issue could be exploited remotely or if Cherokee is running at escalated privileges. Therefore it might not be a vulnerability.


Internet Explorer 6.0 on Windows XP SP2 allows remote attackers to execute arbitrary code by using the \Related Topics\ command in the Help ActiveX Control (hhctrl.ocx) to open a Help popup window containing the PCHealth tools.htm file in the local zone and injecting Javascript to be executed as demonstrated using \writehta.txt\ and the ADODB recordset which saves a .HTA file to the local system aka the \HTML Help ActiveX control Cross Domain Vulnerability.\


The \Allow cPanel users to reset their password via email\ feature in cPanel 9.1.0 build 34 and earlier including 8.x allows remote attackers to execute arbitrary code via the user parameter to resetpass.


The DownloadLoop function in main.c for greed 0.81p allows remote attackers to execute arbitrary code via a GRX file containing a filename with shell metacharacters.


Format string vulnerability in the _msg function in error.c in socat 1.4.0.3 and earlier when used as an HTTP proxy client and run with the -ly option allows remote attackers or local users to execute arbitrary code via format string specifiers in a syslog message.


Hotfoon 4.0 does not notify users before opening links in web browsers which could allow remote attackers to execute arbitrary code via a certain link sent in a chat window.


Jetbox One 2.0.8 and possibly other versions allow remote attackers with Author privileges in the IMAGES module to upload PHP files and execute arbitrary code.


The load_elf_binary function in the binfmt_elf loader (binfmt_elf.c) in Linux kernel 2.4.x up to 2.4.27 and 2.6.x up to 2.6.8 does not properly check return values from calls to the kernel_read function which may allow local users to modify sensitive memory in a setuid program and execute arbitrary code.


wget 1.8.x and 1.9.x does not filter or quote control characters when displaying HTTP responses to the terminal which may allow remote malicious web servers to inject terminal escape sequences and execute arbitrary code.


The binfmt_elf loader (binfmt_elf.c) in Linux kernel 2.4.x up to 2.4.27 and 2.6.x up to 2.6.8 does not properly handle a failed call to the mmap function which causes an incorrect mapped image and may allow local users to execute arbitrary code.


The WINS service (wins.exe) on Microsoft Windows NT Server 4.0 Windows 2000 Server and Windows Server 2003 allows remote attackers to write to arbitrary memory locations and possibly execute arbitrary code via a modified memory pointer in a WINS replication packet to TCP port 42 aka the \Association Context Vulnerability.\


Windows Media Player 9 allows remote attackers to execute arbitrary code via a PNG file containing large (1) width or (2) height values aka the \PNG Processing Vulnerability.\


The MHTML protocol handler in Microsoft Outlook Express 5.5 SP2 through Outlook Express 6 SP1 allows remote attackers to bypass domain restrictions and execute arbitrary code as demonstrated on Internet Explorer using script in a compiled help (CHM) file that references the InfoTech Storage (ITS) protocol handlers such as (1) ms-its (2) ms-itss (3) its or (4) mk:@MSITStore aka the \MHTML URL Processing Vulnerability.\


Unknown vulnerability in the Graphics Rendering Engine processes of Microsoft Windows 2000 Windows XP and Windows Server 2003 allows remote attackers to execute arbitrary code via (1) Windows Metafile (WMF) or (2) Enhanced Metafile (EMF) image formats that involve \an unchecked buffer.\


The WebBrowser ActiveX control or the Internet Explorer HTML rendering engine (MSHTML) as used in Internet Explorer 6 allows remote attackers to execute arbitrary code in the Local Security context by using the showModalDialog method and modifying the location to execute code such as Javascript as demonstrated using (1) delayed HTTP redirect operations and an HTTP response with a Location: header containing a \URL:\ prepended to a \ms-its\ protocol URI or (2) modifying the location attribute of the window as exploited by the Download.ject (aka Scob aka Toofer) using the ADODB.Stream object.


Apple Remote Desktop Client 1.2.4 executes a GUI application as root when it is started by an Apple Remote Desktop Administrator application which allows remote authenticated users to execute arbitrary code when loginwindow is active via Fast User Switching.


The DHCP Server service for Microsoft Windows NT 4.0 Server and Terminal Server Edition does not properly validate the length of certain messages which allows remote attackers to execute arbitrary code via a malformed DHCP message aka the \DHCP Request Vulnerability.\


serve_notify in CVS 1.12.x through 1.12.8 and 1.11.x through 1.11.16 does not properly handle empty data lines which may allow remote attackers to perform an \out-of-bounds\ write for a single byte to execute arbitrary code or modify critical program data.


Microsoft Internet Explorer 6.0.2800.1106 on Microsoft Windows XP SP2 and other versions including 5.01 and 5.5 allows remote web servers to bypass zone restrictions and execute arbitrary code in the local computer zone by redirecting a function to another function with the same name as demonstrated by SimilarMethodNameRedir aka the \Similar Method Name Redirection Cross Domain Vulnerability.\


The Unreal Engine as used in DeusEx 1.112fm and earlier Devastation 390 and earlier Mobile Forces 20000 and earlier Nerf Arena Blast 1.2 and earlier Postal 2 1337 and earlier Rune 107 and earlier Tactical Ops 3.4.0 and earlier Unreal 1 226f and earlier Unreal II XMP 7710 and earlier Unreal Tournament 451b and earlier Unreal Tournament 2003 2225 and earlier Unreal Tournament 2004 before 3236 Wheel of Time 333b and earlier and X-com Enforcer allows remote attackers to execute arbitrary code via a UDP packet containing a secure query with a long value which overwrites memory.


Multiple format string vulnerabilities in GNU Anubis 3.6.0 through 3.6.2 3.9.92 and 3.9.93 allow remote attackers to execute arbitrary code via format string specifiers in strings passed to (1) the info function in log.c (2) the anubis_error function in errs.c or (3) the ssl_error function in ssl.c.


Help and Support Center in Microsoft Windows XP and Windows Server 2003 SP1 does not properly validate HCP URLs which allows remote attackers to execute arbitrary code as demonstrated using certain hcp:// URLs that access the DVD Upgrade capability (dvdupgrd.htm).


Mozilla Firefox before the Preview Release Mozilla before 1.7.3 and Thunderbird before 0.8 allows remote attackers to perform cross-domain scripting and possibly execute arbitrary code by convincing a user to drag and drop javascript: links to a frame or page in another domain.


Multiple format string vulnerabilities in HTTP Application Intelligence (AI) component in Check Point Firewall-1 NG-AI R55 and R54 and Check Point Firewall-1 HTTP Security Server included with NG FP1 FP2 and FP3 allows remote attackers to execute arbitrary code via HTTP requests that cause format string specifiers to be used in an error message as demonstrated using the scheme of a URI.


Microsoft Word for Windows 6.0 Converter (MSWRD632.WPC) as used in WordPad does not properly validate certain data lengths which allows remote attackers to execute arbitrary code via a .wri .rtf and .doc file sent by email or malicious web site aka \Font Conversion Vulnerability \ a different vulnerability than CVE-2004-0571.


The memory_limit functionality in PHP 4.x up to 4.3.7 and 5.x up to 5.0.0RC3 under certain conditions such as when register_globals is enabled allows remote attackers to execute arbitrary code by triggering a memory_limit abort during execution of the zend_hash_init function and overwriting a HashTable destructor pointer before the initialization of key data structures is complete.


Double free vulnerabilities in the error handling code for ASN.1 decoders in the (1) Key Distribution Center (KDC) library and (2) client library for MIT Kerberos 5 (krb5) 1.3.4 and earlier may allow remote attackers to execute arbitrary code.


Microsoft Word for Windows 6.0 Converter does not properly validate certain data lengths which allows remote attackers to execute arbitrary code via a .wri .rtf and .doc file sent by email or malicious web site aka \Table Conversion Vulnerability \ a different vulnerability than CVE-2004-0901.


The SMTP (Simple Mail Transfer Protocol) component of Microsoft Windows XP 64-bit Edition Windows Server 2003 Windows Server 2003 64-bit Edition and the Exchange Routing Engine component of Exchange Server 2003 allows remote attackers to execute arbitrary code via a malicious DNS response message containing length values that are not properly validated.


The URI handlers in Konqueror for KDE 3.2.2 and earlier do not properly filter \-\ characters that begin a hostname in a (1) telnet (2) rlogin (3) ssh or (4) mailto URI which allows remote attackers to manipulate the options that are passed to the associated programs possibly to read arbitrary files or execute arbitrary code.


The uudecoding feature in Adobe Acrobat Reader 5.0.5 and 5.0.6 for Unix and Linux and possibly other versions including those before 5.0.9 allows remote attackers to execute arbitrary code via shell metacharacters (\`\ or backtick) in the filename of the PDF file that is provided to the uudecode command.


The (1) libsasl and (2) libsasl2 libraries in Cyrus-SASL 2.1.18 and earlier trust the SASL_PATH environment variable to find all available SASL plug-ins which allows local users to execute arbitrary code by modifying the SASL_PATH to point to malicious programs.


The Windows Shell application in Windows 98 Windows ME Windows NT 4.0 Windows 2000 Windows XP and Windows Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename as demonstrated using Internet Explorer 6.0.2800.1106 on Windows XP.


The PHP package in Slackware 8.1 9.0 and 9.1 when linked against a static library includes /tmp in the search path which allows local users to execute arbitrary code as the PHP user by inserting shared libraries into the appropriate path.


The Linux install .tar.gz archives for Mozilla Firefox before the Preview Release Mozilla before 1.7.3 and Thunderbird before 0.8 create certain files with insecure permissions which could allow local users to overwrite those files and execute arbitrary code.


PHP before 4.3.7 on Win32 platforms does not properly filter all shell metacharacters which allows local or remote attackers to execute arbitrary code overwrite files and access internal environment variables via (1) the \%\ \|\ or \>\ characters to the escapeshellcmd function or (2) the \%\ character to the escapeshellarg function.


x11.c in xonix 1.4 and earlier uses the current working directory to find and execute the rmail program which allows local users to execute arbitrary code by modifying the path to point to a malicious rmail program.


acpRunner ActiveX 1.2.5.0 allows remote attackers to execute arbitrary code via the (1) DownLoadURL (2) SaveFilePath and (3) Download ActiveX methods.


The \Show in Finder\ button in the Safari web browser in Mac OS X 10.3.4 and 10.2.8 may execute downloaded applications which could allow remote attackers to execute arbitrary code.


Double free vulnerability for the error_prog_name string in CVS 1.12.x through 1.12.8 and 1.11.x through 1.11.16 may allow remote attackers to execute arbitrary code.


Internet Explorer 6.x on Windows XP SP2 allows remote attackers to execute arbitrary code as demonstrated using a document with a draggable file type such as .xml .doc .py .cdf .css .pdf or .ppt and using ADODB.Connection and ADODB.recordset to write to a .hta file that is interpreted in the Local Zone by HTML Help.


Confirm 0.62 and earlier could allow remote attackers to execute arbitrary code via an e-mail header that contains shell metacharacters such as \ ` | ; or $.


Double free vulnerabilities in error handling code in krb524d for MIT Kerberos 5 (krb5) 1.2.8 and earlier may allow remote attackers to execute arbitrary code.


The XPInstall installer in Mozilla Firefox before the Preview Release Mozilla before 1.7.3 and Thunderbird before 0.8 sets insecure permissions for certain installed files within xpi packages which could allow local users to overwrite arbitrary files or execute arbitrary code.


VirtualPC_Services in Microsoft Virtual PC for Mac 6.0 through 6.1 allows local attackers to truncate and overwrite arbitrary files and execute arbitrary code via a symlink attack on the VPCServices_Log temporary file.


In FreeBSD before 11.2-RELEASE an application which calls setrlimit() to increase RLIMIT_STACK may turn a read-only memory region below the stack into a read-write region. A specially crafted executable could be exploited to execute arbitrary code in the user context.


IBM Domino 8.5.3 and 9.0 is vulnerable to a stack based overflow in the IMAP service that could allow an authenticated attacker to execute arbitrary code by specifying a large mailbox name. IBM X-Force ID: 124749.