Vulnerabilites related to microsoft - activex
Vulnerability from fkie_nvd
Published
2007-12-15 02:46
Modified
2024-11-21 00:40
Severity ?
Summary
Multiple stack-based buffer overflows in the awApi4.AnswerWorks.1 ActiveX control in awApi4.dll 4.0.0.42, as used by Vantage Linguistics AnswerWorks, and Intuit Clearly Bookkeeping, ProSeries, QuickBooks, Quicken, QuickTax, and TurboTax, allow remote attackers to execute arbitrary code via long arguments to the (1) GetHistory, (2) GetSeedQuery, (3) SetSeedQuery, and possibly other methods. NOTE: some of these details are obtained from third party information.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| intuit | bookkeeping | * | |
| intuit | proseries | * | |
| intuit | quickbooks | * | |
| intuit | quicken | * | |
| intuit | quicktax | * | |
| intuit | turbo_tax | * | |
| microsoft | activex | 4.0.0.42 | |
| vantage_linquistics | answerworks | * |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:intuit:bookkeeping:*:*:*:*:*:*:*:*", matchCriteriaId: "8E03C2E2-744E-48E7-A173-0B770146515D", vulnerable: true, }, { criteria: "cpe:2.3:a:intuit:proseries:*:*:*:*:*:*:*:*", matchCriteriaId: "B486008F-6BE1-49AA-B85F-42ADB30DA2FB", vulnerable: true, }, { criteria: "cpe:2.3:a:intuit:quickbooks:*:*:*:*:*:*:*:*", matchCriteriaId: "D46AB956-34B8-4745-9248-36B0D1CF2C2D", vulnerable: true, }, { criteria: "cpe:2.3:a:intuit:quicken:*:*:*:*:*:*:*:*", matchCriteriaId: "5474D5BF-159B-4CE0-9D3F-ED634C57E80F", vulnerable: true, }, { criteria: "cpe:2.3:a:intuit:quicktax:*:*:*:*:*:*:*:*", matchCriteriaId: "E9928CE1-E0E2-45B8-8CE2-D513901DC874", vulnerable: true, }, { criteria: "cpe:2.3:a:intuit:turbo_tax:*:*:*:*:*:*:*:*", matchCriteriaId: "5C18415D-C5E2-4844-AE41-701F2C543516", vulnerable: true, }, { criteria: "cpe:2.3:a:microsoft:activex:4.0.0.42:*:*:*:*:*:*:*", matchCriteriaId: "7079ABAE-D263-4036-A35E-6F3FBC8E7115", vulnerable: true, }, { criteria: "cpe:2.3:a:vantage_linquistics:answerworks:*:*:*:*:*:*:*:*", matchCriteriaId: "69989E7B-2E93-4DEF-AEF8-2A797C0FBE1F", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "Multiple stack-based buffer overflows in the awApi4.AnswerWorks.1 ActiveX control in awApi4.dll 4.0.0.42, as used by Vantage Linguistics AnswerWorks, and Intuit Clearly Bookkeeping, ProSeries, QuickBooks, Quicken, QuickTax, and TurboTax, allow remote attackers to execute arbitrary code via long arguments to the (1) GetHistory, (2) GetSeedQuery, (3) SetSeedQuery, and possibly other methods. NOTE: some of these details are obtained from third party information.", }, { lang: "es", value: "Múltiples desbordamientos de búfer basados en pila en el control ActiveX awApi4.AnswerWorks.1 en awApi4.dll 4.0.0.42, como el utilizado por Vantage Linguistics AnswerWorks, y Intuit Clearly Bookkeeping, ProSeries, QuickBooks, Quicken, QuickTax, y TurboTax, permite a atacantes remotos ejecutar código de su elección mediante argumentos largos a (1) GetHistory, (2) GetSeedQuery, (3) SetSeedQuery, y posiblemente otros métodos. NOTA: algunos de estos detalles se han obtenido de información de terceros.", }, ], id: "CVE-2007-6387", lastModified: "2024-11-21T00:40:01.650", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "HIGH", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "COMPLETE", baseScore: 9.3, confidentialityImpact: "COMPLETE", integrityImpact: "COMPLETE", vectorString: "AV:N/AC:M/Au:N/C:C/I:C/A:C", version: "2.0", }, exploitabilityScore: 8.6, impactScore: 10, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: true, }, ], }, published: "2007-12-15T02:46:00.000", references: [ { source: "cve@mitre.org", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/26566", }, { source: "cve@mitre.org", tags: [ "Patch", "Vendor Advisory", ], url: "http://secunia.com/advisories/26670", }, { source: "cve@mitre.org", tags: [ "Patch", ], url: "http://support.quickbooks.intuit.com/support/qbupdate2007/Default.aspx", }, { source: "cve@mitre.org", tags: [ "Patch", ], url: "http://www.intuit.com/support/security/", }, { source: "cve@mitre.org", tags: [ "Patch", ], url: "http://www.securityfocus.com/bid/26815", }, { source: "cve@mitre.org", tags: [ "Patch", ], url: "http://www.vantagelinguistics.com/answerworks/release/", }, { source: "cve@mitre.org", url: "http://www.vupen.com/english/advisories/2007/4194", }, { source: "cve@mitre.org", url: "http://www.vupen.com/english/advisories/2007/4195", }, { source: "cve@mitre.org", url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/39004", }, { source: "cve@mitre.org", url: "https://www.exploit-db.com/exploits/4825", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/26566", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Patch", "Vendor Advisory", ], url: "http://secunia.com/advisories/26670", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Patch", ], url: "http://support.quickbooks.intuit.com/support/qbupdate2007/Default.aspx", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Patch", ], url: "http://www.intuit.com/support/security/", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Patch", ], url: "http://www.securityfocus.com/bid/26815", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Patch", ], url: "http://www.vantagelinguistics.com/answerworks/release/", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.vupen.com/english/advisories/2007/4194", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.vupen.com/english/advisories/2007/4195", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/39004", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://www.exploit-db.com/exploits/4825", }, ], sourceIdentifier: "cve@mitre.org", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-119", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2008-01-23 22:00
Modified
2024-11-21 00:42
Severity ?
Summary
Multiple buffer overflows in the WebHPVCInstall.HPVirtualRooms14 ActiveX control in HPVirtualRooms14.dll 1.0.0.100, as used in the installation process for HP Virtual Rooms, allow remote attackers to execute arbitrary code via a long (1) AuthenticationURL, (2) PortalAPIURL, or (3) cabroot property value. NOTE: some of these details are obtained from third party information.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| hp | virtual_rooms | 1.0.0.100 | |
| microsoft | activex | * |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:hp:virtual_rooms:1.0.0.100:*:*:*:*:*:*:*", matchCriteriaId: "488DCE80-F39A-4AC7-BD74-F7C00FDF8F8B", vulnerable: true, }, { criteria: "cpe:2.3:a:microsoft:activex:*:*:*:*:*:*:*:*", matchCriteriaId: "EDEF84E6-3C24-4B73-96A4-467F5C03DB04", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "Multiple buffer overflows in the WebHPVCInstall.HPVirtualRooms14 ActiveX control in HPVirtualRooms14.dll 1.0.0.100, as used in the installation process for HP Virtual Rooms, allow remote attackers to execute arbitrary code via a long (1) AuthenticationURL, (2) PortalAPIURL, or (3) cabroot property value. NOTE: some of these details are obtained from third party information.", }, { lang: "es", value: "Múltiples desbordamientos de búfer en el control ActiveX WebHPVCInstall.HPVirtualRooms14.dll 1.0.0.100, usado en el proceso de instalación de HP Virtual Rooms, permiten a atacantes remotos ejecutar código de su elección mediante un valor largo para las propiedades (1) AuthenticationURL, (2) PortalAPIURL, o (3) cabroot. NOTA: algunos de estos detalles se han obtenido de información de terceros.", }, ], id: "CVE-2008-0437", lastModified: "2024-11-21T00:42:05.997", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "HIGH", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "COMPLETE", baseScore: 10, confidentialityImpact: "COMPLETE", integrityImpact: "COMPLETE", vectorString: "AV:N/AC:L/Au:N/C:C/I:C/A:C", version: "2.0", }, exploitabilityScore: 10, impactScore: 10, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], }, published: "2008-01-23T22:00:00.000", references: [ { source: "cve@mitre.org", url: "http://marc.info/?l=full-disclosure&m=120098751528333&w=2", }, { source: "cve@mitre.org", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/28595", }, { source: "cve@mitre.org", url: "http://www.securityfocus.com/bid/27384", }, { source: "cve@mitre.org", url: "http://www.vupen.com/english/advisories/2008/0236", }, { source: "cve@mitre.org", url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/39836", }, { source: "cve@mitre.org", url: "https://www.exploit-db.com/exploits/4959", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://marc.info/?l=full-disclosure&m=120098751528333&w=2", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/28595", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.securityfocus.com/bid/27384", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.vupen.com/english/advisories/2008/0236", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/39836", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://www.exploit-db.com/exploits/4959", }, ], sourceIdentifier: "cve@mitre.org", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-119", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2020-05-06 13:15
Modified
2024-11-21 04:34
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Dext5.ocx ActiveX 5.0.0.116 and eariler versions contain a vulnerability, which could allow remote attacker to download arbitrary file by setting the arguments to the activex method. This can be leveraged for code execution.
References
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:raonwiz:dext5:2.7:*:*:*:*:*:*:*", matchCriteriaId: "BEA877FE-C9C2-4107-AB26-ECF0E98478AF", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:a:microsoft:activex:*:*:*:*:*:*:*:*", matchCriteriaId: "13D1D485-EAA6-4FE4-A279-DA8FCB01BBAD", versionEndExcluding: "5.0.0.117", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, ], cveTags: [], descriptions: [ { lang: "en", value: "Dext5.ocx ActiveX 5.0.0.116 and eariler versions contain a vulnerability, which could allow remote attacker to download arbitrary file by setting the arguments to the activex method. This can be leveraged for code execution.", }, { lang: "es", value: "Dext5.ocx ActiveX versiones 5.0.0.116 y anteriores, contiene una vulnerabilidad que podría permitir a un atacante remoto descargar un archivo arbitrario al configurar los argumentos en el método activex. Esto puede ser aprovechado para una ejecución de código.", }, ], id: "CVE-2019-19169", lastModified: "2024-11-21T04:34:17.407", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "HIGH", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 7.5, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P", version: "2.0", }, exploitabilityScore: 10, impactScore: 6.4, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, exploitabilityScore: 1.8, impactScore: 5.9, source: "vuln@krcert.or.kr", type: "Secondary", }, { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 9.8, baseSeverity: "CRITICAL", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, exploitabilityScore: 3.9, impactScore: 5.9, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2020-05-06T13:15:13.040", references: [ { source: "vuln@krcert.or.kr", tags: [ "Vendor Advisory", ], url: "http://www.dext5.com/page/support/notice_view.aspx?pSeq=26", }, { source: "vuln@krcert.or.kr", tags: [ "Third Party Advisory", ], url: "https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35353", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "http://www.dext5.com/page/support/notice_view.aspx?pSeq=26", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35353", }, ], sourceIdentifier: "vuln@krcert.or.kr", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "NVD-CWE-noinfo", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2008-02-01 20:00
Modified
2024-11-21 00:42
Severity ?
Summary
The NamoInstaller.NamoInstall.1 ActiveX control in NamoInstaller.dll 3.0.0.1 and earlier in Namo Web Editor in Sejoong Namo ActiveSquare 6 allows remote attackers to execute arbitrary code via a URL in the argument to the Install method. NOTE: some of these details are obtained from third party information.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| microsoft | activex | * | |
| sejoong_namo | activesquare | 6 |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:microsoft:activex:*:*:*:*:*:*:*:*", matchCriteriaId: "EDEF84E6-3C24-4B73-96A4-467F5C03DB04", vulnerable: true, }, { criteria: "cpe:2.3:a:sejoong_namo:activesquare:6:*:*:*:*:*:*:*", matchCriteriaId: "3F004818-8920-4063-8565-38038C559CAE", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "The NamoInstaller.NamoInstall.1 ActiveX control in NamoInstaller.dll 3.0.0.1 and earlier in Namo Web Editor in Sejoong Namo ActiveSquare 6 allows remote attackers to execute arbitrary code via a URL in the argument to the Install method. NOTE: some of these details are obtained from third party information.", }, { lang: "es", value: "El control ActiveX NamoInstaller.NamoInstall.1 de NamoInstaller.dll 3.0.0.1 y anteriores en Namo Web Editor en Sejoong Namo ActiveSquare 6 permite a atacantes remotos ejecutar código de su elección a través de un URL en el argumento del método Install. \r\nNOTA: algunos de estos detalles han sido obtenidos a partir de la información de terceros.", }, ], id: "CVE-2008-0551", lastModified: "2024-11-21T00:42:21.987", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "HIGH", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "COMPLETE", baseScore: 9.3, confidentialityImpact: "COMPLETE", integrityImpact: "COMPLETE", vectorString: "AV:N/AC:M/Au:N/C:C/I:C/A:C", version: "2.0", }, exploitabilityScore: 8.6, impactScore: 10, obtainAllPrivilege: true, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], }, published: "2008-02-01T20:00:00.000", references: [ { source: "cve@mitre.org", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/28649", }, { source: "cve@mitre.org", tags: [ "Exploit", ], url: "http://www.securityfocus.com/bid/27453", }, { source: "cve@mitre.org", url: "http://www.securityfocus.com/bid/27580", }, { source: "cve@mitre.org", url: "http://www.vupen.com/english/advisories/2008/0299", }, { source: "cve@mitre.org", url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/39943", }, { source: "cve@mitre.org", url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/39974", }, { source: "cve@mitre.org", url: "https://www.exploit-db.com/exploits/4986", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/28649", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Exploit", ], url: "http://www.securityfocus.com/bid/27453", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.securityfocus.com/bid/27580", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.vupen.com/english/advisories/2008/0299", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/39943", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/39974", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://www.exploit-db.com/exploits/4986", }, ], sourceIdentifier: "cve@mitre.org", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-94", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2020-05-06 13:15
Modified
2024-11-21 04:34
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Dext5.ocx ActiveX 5.0.0.116 and eariler versions contain a vulnerability, which could allow remote attacker to download and execute remote arbitrary file by setting the arguments to the activex method. This can be leveraged for code execution.
References
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:raonwiz:dext5:2.7:*:*:*:*:*:*:*", matchCriteriaId: "BEA877FE-C9C2-4107-AB26-ECF0E98478AF", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:a:microsoft:activex:*:*:*:*:*:*:*:*", matchCriteriaId: "13D1D485-EAA6-4FE4-A279-DA8FCB01BBAD", versionEndExcluding: "5.0.0.117", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, ], cveTags: [], descriptions: [ { lang: "en", value: "Dext5.ocx ActiveX 5.0.0.116 and eariler versions contain a vulnerability, which could allow remote attacker to download and execute remote arbitrary file by setting the arguments to the activex method. This can be leveraged for code execution.", }, { lang: "es", value: "Dext5.ocx ActiveX versiones 5.0.0.116 y anteriores, contiene una vulnerabilidad que podría permitir a un atacante remoto descargar y ejecutar archivos arbitrarios remotos al configurar los argumentos en el método activex. Esto puede ser aprovechado para una ejecución de código.", }, ], id: "CVE-2019-19168", lastModified: "2024-11-21T04:34:17.287", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "HIGH", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 7.5, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P", version: "2.0", }, exploitabilityScore: 10, impactScore: 6.4, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, exploitabilityScore: 1.8, impactScore: 5.9, source: "vuln@krcert.or.kr", type: "Secondary", }, { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 9.8, baseSeverity: "CRITICAL", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, exploitabilityScore: 3.9, impactScore: 5.9, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2020-05-06T13:15:12.977", references: [ { source: "vuln@krcert.or.kr", tags: [ "Vendor Advisory", ], url: "http://www.dext5.com/page/support/notice_view.aspx?pSeq=26", }, { source: "vuln@krcert.or.kr", tags: [ "Third Party Advisory", ], url: "https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35352", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "http://www.dext5.com/page/support/notice_view.aspx?pSeq=26", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35352", }, ], sourceIdentifier: "vuln@krcert.or.kr", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "NVD-CWE-noinfo", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2020-05-07 18:15
Modified
2024-11-21 04:34
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
dext5.ocx ActiveX Control in Dext5 Upload 5.0.0.112 and earlier versions contains a vulnerability that could allow remote files to be executed by setting the arguments to the activex method. A remote attacker could induce a user to access a crafted web page, causing damage such as malicious code infection.
References
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:raonwiz:dext5:2.7:*:*:*:*:*:*:*", matchCriteriaId: "BEA877FE-C9C2-4107-AB26-ECF0E98478AF", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:a:microsoft:activex:*:*:*:*:*:*:*:*", matchCriteriaId: "59744341-06A4-469B-BC39-105241222ED6", versionEndIncluding: "5.0.0.112", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, ], cveTags: [], descriptions: [ { lang: "en", value: "dext5.ocx ActiveX Control in Dext5 Upload 5.0.0.112 and earlier versions contains a vulnerability that could allow remote files to be executed by setting the arguments to the activex method. A remote attacker could induce a user to access a crafted web page, causing damage such as malicious code infection.", }, { lang: "es", value: "dext5.ocx ActiveX Control en Dext5 Upload versión 5.0.0.112 y versiones anteriores, contiene una vulnerabilidad que podría permitir que archivos remotos sean ejecutados mediante la configuración de los argumentos en el método activex. Un atacante remoto podría inducir a un usuario para que acceda a una página web diseñada, causando un daño tal y como una infección de código malicioso.", }, ], id: "CVE-2019-19164", lastModified: "2024-11-21T04:34:16.767", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 6.8, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:N/C:P/I:P/A:P", version: "2.0", }, exploitabilityScore: 8.6, impactScore: 6.4, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: true, }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, exploitabilityScore: 1.8, impactScore: 5.9, source: "vuln@krcert.or.kr", type: "Secondary", }, { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, exploitabilityScore: 2.8, impactScore: 5.9, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2020-05-07T18:15:11.163", references: [ { source: "vuln@krcert.or.kr", tags: [ "Vendor Advisory", ], url: "http://www.dext5.com/page/support/notice_view.aspx?pSeq=23", }, { source: "vuln@krcert.or.kr", tags: [ "Third Party Advisory", ], url: "https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35344", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "http://www.dext5.com/page/support/notice_view.aspx?pSeq=23", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35344", }, ], sourceIdentifier: "vuln@krcert.or.kr", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-20", }, ], source: "vuln@krcert.or.kr", type: "Secondary", }, { description: [ { lang: "en", value: "NVD-CWE-noinfo", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2008-01-29 20:00
Modified
2024-11-21 00:42
Severity ?
Summary
A certain ActiveX control in Comodo AntiVirus 2.0 allows remote attackers to execute arbitrary commands via the ExecuteStr method.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| comodo | comodo_antivirus | 2.0 | |
| microsoft | activex | * |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:comodo:comodo_antivirus:2.0:*:*:*:*:*:*:*", matchCriteriaId: "98228D94-5590-4C57-87F0-D688F3E44460", vulnerable: true, }, { criteria: "cpe:2.3:a:microsoft:activex:*:*:*:*:*:*:*:*", matchCriteriaId: "EDEF84E6-3C24-4B73-96A4-467F5C03DB04", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "A certain ActiveX control in Comodo AntiVirus 2.0 allows remote attackers to execute arbitrary commands via the ExecuteStr method.", }, { lang: "es", value: "Un ciertolador ActiveX en Comodo AntiVirus 2.0 permite a atacantes remotos ejecutar comandos de su elección a través del método ExecuteStr.", }, ], id: "CVE-2008-0470", lastModified: "2024-11-21T00:42:10.797", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "HIGH", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "COMPLETE", baseScore: 9.3, confidentialityImpact: "COMPLETE", integrityImpact: "COMPLETE", vectorString: "AV:N/AC:M/Au:N/C:C/I:C/A:C", version: "2.0", }, exploitabilityScore: 8.6, impactScore: 10, obtainAllPrivilege: true, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: true, }, ], }, published: "2008-01-29T20:00:00.000", references: [ { source: "cve@mitre.org", tags: [ "Exploit", ], url: "http://www.securityfocus.com/bid/27424", }, { source: "cve@mitre.org", url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/39904", }, { source: "cve@mitre.org", url: "https://www.exploit-db.com/exploits/4974", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Exploit", ], url: "http://www.securityfocus.com/bid/27424", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/39904", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://www.exploit-db.com/exploits/4974", }, ], sourceIdentifier: "cve@mitre.org", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "NVD-CWE-Other", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2008-02-12 23:00
Modified
2024-11-21 00:41
Severity ?
Summary
Unspecified vulnerability in an ActiveX control (dxtmsft.dll) in Microsoft Internet Explorer 5.01, 6 SP1 and SP2, and 7 allows remote attackers to execute arbitrary code via a crafted image, aka "Argument Handling Memory Corruption Vulnerability."
References
Impacted products
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:microsoft:activex:*:*:*:*:*:*:*:*", matchCriteriaId: "EDEF84E6-3C24-4B73-96A4-467F5C03DB04", vulnerable: true, }, { criteria: "cpe:2.3:a:microsoft:ie:5.01:windows_2000_sp4:*:*:*:*:*:*", matchCriteriaId: "B054A26A-7414-41B2-A46D-49E798D7A346", vulnerable: true, }, { criteria: "cpe:2.3:a:microsoft:ie:6:windows_server_2003_sp1:*:*:*:*:*:*", matchCriteriaId: "B80088A3-2AA4-44A2-98DF-359E15F8E18B", vulnerable: true, }, { criteria: "cpe:2.3:a:microsoft:ie:6:windows_server_2003_sp1_itanium:*:*:*:*:*:*", matchCriteriaId: "181D0FA2-79E1-4422-9810-D7A557805872", vulnerable: true, }, { criteria: "cpe:2.3:a:microsoft:ie:6:windows_xp_sp2:*:*:*:*:*:*", matchCriteriaId: "81C4C1ED-AC7D-4970-8B34-62D304A83FE9", vulnerable: true, }, { criteria: "cpe:2.3:a:microsoft:ie:7:windows_server_2003_sp1:*:*:*:*:*:*", matchCriteriaId: "574EE6CB-7AF4-4DE2-B668-36BBCB19FCC1", vulnerable: true, }, { criteria: "cpe:2.3:a:microsoft:ie:7:windows_xp_sp2:*:*:*:*:*:*", matchCriteriaId: "BE2858A5-C9BF-40D8-B3D2-056562BF1C87", vulnerable: true, }, { criteria: "cpe:2.3:a:microsoft:internet_explorer:6:*:windows_server_2003_sp2:*:*:*:*:*", matchCriteriaId: "75234062-241B-421A-B7BC-610A5B0D8EF9", vulnerable: true, }, { criteria: "cpe:2.3:a:microsoft:internet_explorer:6:*:windows_server_2003_sp2_itanium:*:*:*:*:*", matchCriteriaId: "82D6ABD4-C607-44E8-8D84-25406AE0F3C8", vulnerable: true, }, { criteria: "cpe:2.3:a:microsoft:internet_explorer:6:*:windows_server_2003_x64_edition:*:*:*:*:*", matchCriteriaId: "379FE901-58AC-4F47-9B3B-9A40D723CC88", vulnerable: true, }, { criteria: "cpe:2.3:a:microsoft:internet_explorer:6:*:windows_server_2003_x64_edition_sp2:*:*:*:*:*", matchCriteriaId: "EC18DBBB-9C9E-4532-B390-92C35E52943A", vulnerable: true, }, { criteria: "cpe:2.3:a:microsoft:internet_explorer:6:*:windows_xp_professional_x64_edition:*:*:*:*:*", matchCriteriaId: "49C8060E-CFB9-4EEA-B5B9-B7607B046AE8", vulnerable: true, }, { criteria: "cpe:2.3:a:microsoft:internet_explorer:6:*:windows_xp_professional_x64_edition_sp2:*:*:*:*:*", matchCriteriaId: "FB17CABD-21BE-454F-9602-19DB444A574C", vulnerable: true, }, { criteria: "cpe:2.3:a:microsoft:internet_explorer:7:*:windows_server_2003_sp1_itanium:*:*:*:*:*", matchCriteriaId: "AB202F47-248D-4290-955F-D1304C6F2395", vulnerable: true, }, { criteria: "cpe:2.3:a:microsoft:internet_explorer:7:*:windows_server_2003_sp2:*:*:*:*:*", matchCriteriaId: "3994AE83-EC42-4893-AF51-BC98F35A53CE", vulnerable: true, }, { criteria: "cpe:2.3:a:microsoft:internet_explorer:7:*:windows_server_2003_sp2_itanium:*:*:*:*:*", matchCriteriaId: "33F4B074-7BA5-4A36-A866-945D771D2EA5", vulnerable: true, }, { criteria: "cpe:2.3:a:microsoft:internet_explorer:7:*:windows_server_2003_x64_edition:*:*:*:*:*", matchCriteriaId: "491333D2-FDB1-4FC8-B54C-19E06B57FC33", vulnerable: true, }, { criteria: "cpe:2.3:a:microsoft:internet_explorer:7:*:windows_server_2003_x64_edition_sp2:*:*:*:*:*", matchCriteriaId: "E8453618-EDD7-41F4-840E-AA323A873B2F", vulnerable: true, }, { criteria: "cpe:2.3:a:microsoft:internet_explorer:7:*:windows_vista:*:*:*:*:*", matchCriteriaId: "E5E8CC5B-B8E9-4B54-AE32-4632E77F0320", vulnerable: true, }, { criteria: "cpe:2.3:a:microsoft:internet_explorer:7:*:windows_vista_x64:*:*:*:*:*", matchCriteriaId: "EA7D9655-718E-42D6-9752-64BA3AAC5546", vulnerable: true, }, { criteria: "cpe:2.3:a:microsoft:internet_explorer:7:*:windows_xp_professional_x64_edition:*:*:*:*:*", matchCriteriaId: "8E5B894F-6E15-46DA-93B4-EAB9468D37A4", vulnerable: true, }, { criteria: "cpe:2.3:a:microsoft:internet_explorer:7:*:windows_xp_professional_x64_edition_sp2:*:*:*:*:*", matchCriteriaId: "CCE0AF0B-DF2A-4F3F-8F5C-0E4056A34229", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "Unspecified vulnerability in an ActiveX control (dxtmsft.dll) in Microsoft Internet Explorer 5.01, 6 SP1 and SP2, and 7 allows remote attackers to execute arbitrary code via a crafted image, aka \"Argument Handling Memory Corruption Vulnerability.\"", }, { lang: "es", value: "Vulnerabilidad sin especificar en el Control ActiveX (dxtmsft.dll) en Microsoft Internet Explorer 5.01, 6 SP1 y SP2, y 7, que permite a atacantes remotos ejecutar código de su elección a través de una imagen manipulada, también conocida como \"Vulnerabilidad de memoria en el manejo de un argumento\"", }, ], id: "CVE-2008-0078", lastModified: "2024-11-21T00:41:07.197", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "HIGH", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "COMPLETE", baseScore: 9.3, confidentialityImpact: "COMPLETE", integrityImpact: "COMPLETE", vectorString: "AV:N/AC:M/Au:N/C:C/I:C/A:C", version: "2.0", }, exploitabilityScore: 8.6, impactScore: 10, obtainAllPrivilege: true, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: true, }, ], }, published: "2008-02-12T23:00:00.000", references: [ { source: "secure@microsoft.com", url: "http://marc.info/?l=bugtraq&m=120361015026386&w=2", }, { source: "secure@microsoft.com", url: "http://marc.info/?l=bugtraq&m=120361015026386&w=2", }, { source: "secure@microsoft.com", url: "http://secunia.com/advisories/28903", }, { source: "secure@microsoft.com", url: "http://www.securityfocus.com/bid/27689", }, { source: "secure@microsoft.com", url: "http://www.securitytracker.com/id?1019381", }, { source: "secure@microsoft.com", tags: [ "US Government Resource", ], url: "http://www.us-cert.gov/cas/techalerts/TA08-043C.html", }, { source: "secure@microsoft.com", url: "http://www.vupen.com/english/advisories/2008/0512/references", }, { source: "secure@microsoft.com", url: "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-010", }, { source: "secure@microsoft.com", url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4904", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://marc.info/?l=bugtraq&m=120361015026386&w=2", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://marc.info/?l=bugtraq&m=120361015026386&w=2", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://secunia.com/advisories/28903", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.securityfocus.com/bid/27689", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.securitytracker.com/id?1019381", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "US Government Resource", ], url: "http://www.us-cert.gov/cas/techalerts/TA08-043C.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.vupen.com/english/advisories/2008/0512/references", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-010", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4904", }, ], sourceIdentifier: "secure@microsoft.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-94", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
cve-2019-19169
Vulnerability from cvelistv5
Published
2020-05-06 12:54
Modified
2024-08-05 02:09
Severity ?
EPSS score ?
Summary
Dext5.ocx ActiveX 5.0.0.116 and eariler versions contain a vulnerability, which could allow remote attacker to download arbitrary file by setting the arguments to the activex method. This can be leveraged for code execution.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.dext5.com/page/support/notice_view.aspx?pSeq=26 | x_refsource_MISC | |
| https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35353 | x_refsource_MISC |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| RAONwiz | Dext.ocx ActiveX Control in Dext5 Upload |
Version: 5.0.0.116 and prior < 5.0.0.117 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T02:09:39.405Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "http://www.dext5.com/page/support/notice_view.aspx?pSeq=26", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35353", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { platforms: [ "Windows", ], product: "Dext.ocx ActiveX Control in Dext5 Upload", vendor: "RAONwiz", versions: [ { lessThan: "5.0.0.117", status: "affected", version: "5.0.0.116 and prior", versionType: "custom", }, ], }, ], descriptions: [ { lang: "en", value: "Dext5.ocx ActiveX 5.0.0.116 and eariler versions contain a vulnerability, which could allow remote attacker to download arbitrary file by setting the arguments to the activex method. This can be leveraged for code execution.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, }, ], problemTypes: [ { descriptions: [ { description: "File download", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2020-05-06T12:54:08", orgId: "cdd7a122-0fae-4202-8d86-14efbacc2863", shortName: "krcert", }, references: [ { tags: [ "x_refsource_MISC", ], url: "http://www.dext5.com/page/support/notice_view.aspx?pSeq=26", }, { tags: [ "x_refsource_MISC", ], url: "https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35353", }, ], source: { discovery: "UNKNOWN", }, x_generator: { engine: "Vulnogram 0.0.9", }, x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "vuln@krcert.or.kr", ID: "CVE-2019-19169", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Dext.ocx ActiveX Control in Dext5 Upload", version: { version_data: [ { platform: "Windows", version_affected: "<", version_name: "5.0.0.116 and prior", version_value: "5.0.0.117", }, ], }, }, ], }, vendor_name: "RAONwiz", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Dext5.ocx ActiveX 5.0.0.116 and eariler versions contain a vulnerability, which could allow remote attacker to download arbitrary file by setting the arguments to the activex method. This can be leveraged for code execution.", }, ], }, generator: { engine: "Vulnogram 0.0.9", }, impact: { cvss: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "File download", }, ], }, ], }, references: { reference_data: [ { name: "http://www.dext5.com/page/support/notice_view.aspx?pSeq=26", refsource: "MISC", url: "http://www.dext5.com/page/support/notice_view.aspx?pSeq=26", }, { name: "https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35353", refsource: "MISC", url: "https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35353", }, ], }, source: { discovery: "UNKNOWN", }, }, }, }, cveMetadata: { assignerOrgId: "cdd7a122-0fae-4202-8d86-14efbacc2863", assignerShortName: "krcert", cveId: "CVE-2019-19169", datePublished: "2020-05-06T12:54:08", dateReserved: "2019-11-21T00:00:00", dateUpdated: "2024-08-05T02:09:39.405Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2008-0437
Vulnerability from cvelistv5
Published
2008-01-23 21:00
Modified
2024-08-07 07:46
Severity ?
EPSS score ?
Summary
Multiple buffer overflows in the WebHPVCInstall.HPVirtualRooms14 ActiveX control in HPVirtualRooms14.dll 1.0.0.100, as used in the installation process for HP Virtual Rooms, allow remote attackers to execute arbitrary code via a long (1) AuthenticationURL, (2) PortalAPIURL, or (3) cabroot property value. NOTE: some of these details are obtained from third party information.
References
| ▼ | URL | Tags |
|---|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/39836 | vdb-entry, x_refsource_XF | |
| http://www.securityfocus.com/bid/27384 | vdb-entry, x_refsource_BID | |
| http://secunia.com/advisories/28595 | third-party-advisory, x_refsource_SECUNIA | |
| http://marc.info/?l=full-disclosure&m=120098751528333&w=2 | mailing-list, x_refsource_FULLDISC | |
| https://www.exploit-db.com/exploits/4959 | exploit, x_refsource_EXPLOIT-DB | |
| http://www.vupen.com/english/advisories/2008/0236 | vdb-entry, x_refsource_VUPEN |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-07T07:46:54.540Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "hpvirtualrooms-hpvirtualrooms14-activex-bo(39836)", tags: [ "vdb-entry", "x_refsource_XF", "x_transferred", ], url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/39836", }, { name: "27384", tags: [ "vdb-entry", "x_refsource_BID", "x_transferred", ], url: "http://www.securityfocus.com/bid/27384", }, { name: "28595", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/28595", }, { name: "20080122 HP Virtual Rooms WebHPVCInstall Control Multiple Buffer Overflows", tags: [ "mailing-list", "x_refsource_FULLDISC", "x_transferred", ], url: "http://marc.info/?l=full-disclosure&m=120098751528333&w=2", }, { name: "4959", tags: [ "exploit", "x_refsource_EXPLOIT-DB", "x_transferred", ], url: "https://www.exploit-db.com/exploits/4959", }, { name: "ADV-2008-0236", tags: [ "vdb-entry", "x_refsource_VUPEN", "x_transferred", ], url: "http://www.vupen.com/english/advisories/2008/0236", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "n/a", vendor: "n/a", versions: [ { status: "affected", version: "n/a", }, ], }, ], datePublic: "2008-01-21T00:00:00", descriptions: [ { lang: "en", value: "Multiple buffer overflows in the WebHPVCInstall.HPVirtualRooms14 ActiveX control in HPVirtualRooms14.dll 1.0.0.100, as used in the installation process for HP Virtual Rooms, allow remote attackers to execute arbitrary code via a long (1) AuthenticationURL, (2) PortalAPIURL, or (3) cabroot property value. NOTE: some of these details are obtained from third party information.", }, ], problemTypes: [ { descriptions: [ { description: "n/a", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2017-09-28T12:57:01", orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", shortName: "mitre", }, references: [ { name: "hpvirtualrooms-hpvirtualrooms14-activex-bo(39836)", tags: [ "vdb-entry", "x_refsource_XF", ], url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/39836", }, { name: "27384", tags: [ "vdb-entry", "x_refsource_BID", ], url: "http://www.securityfocus.com/bid/27384", }, { name: "28595", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/28595", }, { name: "20080122 HP Virtual Rooms WebHPVCInstall Control Multiple Buffer Overflows", tags: [ "mailing-list", "x_refsource_FULLDISC", ], url: "http://marc.info/?l=full-disclosure&m=120098751528333&w=2", }, { name: "4959", tags: [ "exploit", "x_refsource_EXPLOIT-DB", ], url: "https://www.exploit-db.com/exploits/4959", }, { name: "ADV-2008-0236", tags: [ "vdb-entry", "x_refsource_VUPEN", ], url: "http://www.vupen.com/english/advisories/2008/0236", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "cve@mitre.org", ID: "CVE-2008-0437", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "n/a", version: { version_data: [ { version_value: "n/a", }, ], }, }, ], }, vendor_name: "n/a", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Multiple buffer overflows in the WebHPVCInstall.HPVirtualRooms14 ActiveX control in HPVirtualRooms14.dll 1.0.0.100, as used in the installation process for HP Virtual Rooms, allow remote attackers to execute arbitrary code via a long (1) AuthenticationURL, (2) PortalAPIURL, or (3) cabroot property value. NOTE: some of these details are obtained from third party information.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "n/a", }, ], }, ], }, references: { reference_data: [ { name: "hpvirtualrooms-hpvirtualrooms14-activex-bo(39836)", refsource: "XF", url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/39836", }, { name: "27384", refsource: "BID", url: "http://www.securityfocus.com/bid/27384", }, { name: "28595", refsource: "SECUNIA", url: "http://secunia.com/advisories/28595", }, { name: "20080122 HP Virtual Rooms WebHPVCInstall Control Multiple Buffer Overflows", refsource: "FULLDISC", url: "http://marc.info/?l=full-disclosure&m=120098751528333&w=2", }, { name: "4959", refsource: "EXPLOIT-DB", url: "https://www.exploit-db.com/exploits/4959", }, { name: "ADV-2008-0236", refsource: "VUPEN", url: "http://www.vupen.com/english/advisories/2008/0236", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", assignerShortName: "mitre", cveId: "CVE-2008-0437", datePublished: "2008-01-23T21:00:00", dateReserved: "2008-01-23T00:00:00", dateUpdated: "2024-08-07T07:46:54.540Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2008-0470
Vulnerability from cvelistv5
Published
2008-01-29 19:00
Modified
2024-08-07 07:46
Severity ?
EPSS score ?
Summary
A certain ActiveX control in Comodo AntiVirus 2.0 allows remote attackers to execute arbitrary commands via the ExecuteStr method.
References
| ▼ | URL | Tags |
|---|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/39904 | vdb-entry, x_refsource_XF | |
| http://www.securityfocus.com/bid/27424 | vdb-entry, x_refsource_BID | |
| https://www.exploit-db.com/exploits/4974 | exploit, x_refsource_EXPLOIT-DB |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-07T07:46:54.932Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "comodo-antivirus-command-execution(39904)", tags: [ "vdb-entry", "x_refsource_XF", "x_transferred", ], url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/39904", }, { name: "27424", tags: [ "vdb-entry", "x_refsource_BID", "x_transferred", ], url: "http://www.securityfocus.com/bid/27424", }, { name: "4974", tags: [ "exploit", "x_refsource_EXPLOIT-DB", "x_transferred", ], url: "https://www.exploit-db.com/exploits/4974", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "n/a", vendor: "n/a", versions: [ { status: "affected", version: "n/a", }, ], }, ], datePublic: "2008-01-23T00:00:00", descriptions: [ { lang: "en", value: "A certain ActiveX control in Comodo AntiVirus 2.0 allows remote attackers to execute arbitrary commands via the ExecuteStr method.", }, ], problemTypes: [ { descriptions: [ { description: "n/a", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2017-09-28T12:57:01", orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", shortName: "mitre", }, references: [ { name: "comodo-antivirus-command-execution(39904)", tags: [ "vdb-entry", "x_refsource_XF", ], url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/39904", }, { name: "27424", tags: [ "vdb-entry", "x_refsource_BID", ], url: "http://www.securityfocus.com/bid/27424", }, { name: "4974", tags: [ "exploit", "x_refsource_EXPLOIT-DB", ], url: "https://www.exploit-db.com/exploits/4974", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "cve@mitre.org", ID: "CVE-2008-0470", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "n/a", version: { version_data: [ { version_value: "n/a", }, ], }, }, ], }, vendor_name: "n/a", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "A certain ActiveX control in Comodo AntiVirus 2.0 allows remote attackers to execute arbitrary commands via the ExecuteStr method.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "n/a", }, ], }, ], }, references: { reference_data: [ { name: "comodo-antivirus-command-execution(39904)", refsource: "XF", url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/39904", }, { name: "27424", refsource: "BID", url: "http://www.securityfocus.com/bid/27424", }, { name: "4974", refsource: "EXPLOIT-DB", url: "https://www.exploit-db.com/exploits/4974", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", assignerShortName: "mitre", cveId: "CVE-2008-0470", datePublished: "2008-01-29T19:00:00", dateReserved: "2008-01-29T00:00:00", dateUpdated: "2024-08-07T07:46:54.932Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2007-6387
Vulnerability from cvelistv5
Published
2007-12-15 02:00
Modified
2024-08-07 16:02
Severity ?
EPSS score ?
Summary
Multiple stack-based buffer overflows in the awApi4.AnswerWorks.1 ActiveX control in awApi4.dll 4.0.0.42, as used by Vantage Linguistics AnswerWorks, and Intuit Clearly Bookkeeping, ProSeries, QuickBooks, Quicken, QuickTax, and TurboTax, allow remote attackers to execute arbitrary code via long arguments to the (1) GetHistory, (2) GetSeedQuery, (3) SetSeedQuery, and possibly other methods. NOTE: some of these details are obtained from third party information.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.vantagelinguistics.com/answerworks/release/ | x_refsource_CONFIRM | |
| http://www.vupen.com/english/advisories/2007/4194 | vdb-entry, x_refsource_VUPEN | |
| https://www.exploit-db.com/exploits/4825 | exploit, x_refsource_EXPLOIT-DB | |
| http://support.quickbooks.intuit.com/support/qbupdate2007/Default.aspx | x_refsource_MISC | |
| http://secunia.com/advisories/26566 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.intuit.com/support/security/ | x_refsource_CONFIRM | |
| http://secunia.com/advisories/26670 | third-party-advisory, x_refsource_SECUNIA | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/39004 | vdb-entry, x_refsource_XF | |
| http://www.securityfocus.com/bid/26815 | vdb-entry, x_refsource_BID | |
| http://www.vupen.com/english/advisories/2007/4195 | vdb-entry, x_refsource_VUPEN |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-07T16:02:36.380Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "http://www.vantagelinguistics.com/answerworks/release/", }, { name: "ADV-2007-4194", tags: [ "vdb-entry", "x_refsource_VUPEN", "x_transferred", ], url: "http://www.vupen.com/english/advisories/2007/4194", }, { name: "4825", tags: [ "exploit", "x_refsource_EXPLOIT-DB", "x_transferred", ], url: "https://www.exploit-db.com/exploits/4825", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "http://support.quickbooks.intuit.com/support/qbupdate2007/Default.aspx", }, { name: "26566", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/26566", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "http://www.intuit.com/support/security/", }, { name: "26670", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/26670", }, { name: "vantage-answerworks-bo(39004)", tags: [ "vdb-entry", "x_refsource_XF", "x_transferred", ], url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/39004", }, { name: "26815", tags: [ "vdb-entry", "x_refsource_BID", "x_transferred", ], url: "http://www.securityfocus.com/bid/26815", }, { name: "ADV-2007-4195", tags: [ "vdb-entry", "x_refsource_VUPEN", "x_transferred", ], url: "http://www.vupen.com/english/advisories/2007/4195", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "n/a", vendor: "n/a", versions: [ { status: "affected", version: "n/a", }, ], }, ], datePublic: "2007-12-11T00:00:00", descriptions: [ { lang: "en", value: "Multiple stack-based buffer overflows in the awApi4.AnswerWorks.1 ActiveX control in awApi4.dll 4.0.0.42, as used by Vantage Linguistics AnswerWorks, and Intuit Clearly Bookkeeping, ProSeries, QuickBooks, Quicken, QuickTax, and TurboTax, allow remote attackers to execute arbitrary code via long arguments to the (1) GetHistory, (2) GetSeedQuery, (3) SetSeedQuery, and possibly other methods. NOTE: some of these details are obtained from third party information.", }, ], problemTypes: [ { descriptions: [ { description: "n/a", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2017-09-28T12:57:01", orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", shortName: "mitre", }, references: [ { tags: [ "x_refsource_CONFIRM", ], url: "http://www.vantagelinguistics.com/answerworks/release/", }, { name: "ADV-2007-4194", tags: [ "vdb-entry", "x_refsource_VUPEN", ], url: "http://www.vupen.com/english/advisories/2007/4194", }, { name: "4825", tags: [ "exploit", "x_refsource_EXPLOIT-DB", ], url: "https://www.exploit-db.com/exploits/4825", }, { tags: [ "x_refsource_MISC", ], url: "http://support.quickbooks.intuit.com/support/qbupdate2007/Default.aspx", }, { name: "26566", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/26566", }, { tags: [ "x_refsource_CONFIRM", ], url: "http://www.intuit.com/support/security/", }, { name: "26670", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/26670", }, { name: "vantage-answerworks-bo(39004)", tags: [ "vdb-entry", "x_refsource_XF", ], url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/39004", }, { name: "26815", tags: [ "vdb-entry", "x_refsource_BID", ], url: "http://www.securityfocus.com/bid/26815", }, { name: "ADV-2007-4195", tags: [ "vdb-entry", "x_refsource_VUPEN", ], url: "http://www.vupen.com/english/advisories/2007/4195", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "cve@mitre.org", ID: "CVE-2007-6387", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "n/a", version: { version_data: [ { version_value: "n/a", }, ], }, }, ], }, vendor_name: "n/a", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Multiple stack-based buffer overflows in the awApi4.AnswerWorks.1 ActiveX control in awApi4.dll 4.0.0.42, as used by Vantage Linguistics AnswerWorks, and Intuit Clearly Bookkeeping, ProSeries, QuickBooks, Quicken, QuickTax, and TurboTax, allow remote attackers to execute arbitrary code via long arguments to the (1) GetHistory, (2) GetSeedQuery, (3) SetSeedQuery, and possibly other methods. NOTE: some of these details are obtained from third party information.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "n/a", }, ], }, ], }, references: { reference_data: [ { name: "http://www.vantagelinguistics.com/answerworks/release/", refsource: "CONFIRM", url: "http://www.vantagelinguistics.com/answerworks/release/", }, { name: "ADV-2007-4194", refsource: "VUPEN", url: "http://www.vupen.com/english/advisories/2007/4194", }, { name: "4825", refsource: "EXPLOIT-DB", url: "https://www.exploit-db.com/exploits/4825", }, { name: "http://support.quickbooks.intuit.com/support/qbupdate2007/Default.aspx", refsource: "MISC", url: "http://support.quickbooks.intuit.com/support/qbupdate2007/Default.aspx", }, { name: "26566", refsource: "SECUNIA", url: "http://secunia.com/advisories/26566", }, { name: "http://www.intuit.com/support/security/", refsource: "CONFIRM", url: "http://www.intuit.com/support/security/", }, { name: "26670", refsource: "SECUNIA", url: "http://secunia.com/advisories/26670", }, { name: "vantage-answerworks-bo(39004)", refsource: "XF", url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/39004", }, { name: "26815", refsource: "BID", url: "http://www.securityfocus.com/bid/26815", }, { name: "ADV-2007-4195", refsource: "VUPEN", url: "http://www.vupen.com/english/advisories/2007/4195", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", assignerShortName: "mitre", cveId: "CVE-2007-6387", datePublished: "2007-12-15T02:00:00", dateReserved: "2007-12-14T00:00:00", dateUpdated: "2024-08-07T16:02:36.380Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2019-19168
Vulnerability from cvelistv5
Published
2020-05-06 12:54
Modified
2024-08-05 02:09
Severity ?
EPSS score ?
Summary
Dext5.ocx ActiveX 5.0.0.116 and eariler versions contain a vulnerability, which could allow remote attacker to download and execute remote arbitrary file by setting the arguments to the activex method. This can be leveraged for code execution.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.dext5.com/page/support/notice_view.aspx?pSeq=26 | x_refsource_MISC | |
| https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35352 | x_refsource_MISC |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| RAONwiz | Dext.ocx ActiveX Control in Dext5 Upload |
Version: 5.0.0.116 and prior < 5.0.0.117 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T02:09:39.363Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "http://www.dext5.com/page/support/notice_view.aspx?pSeq=26", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35352", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { platforms: [ "Windows", ], product: "Dext.ocx ActiveX Control in Dext5 Upload", vendor: "RAONwiz", versions: [ { lessThan: "5.0.0.117", status: "affected", version: "5.0.0.116 and prior", versionType: "custom", }, ], }, ], descriptions: [ { lang: "en", value: "Dext5.ocx ActiveX 5.0.0.116 and eariler versions contain a vulnerability, which could allow remote attacker to download and execute remote arbitrary file by setting the arguments to the activex method. This can be leveraged for code execution.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, }, ], problemTypes: [ { descriptions: [ { description: "File download & execution", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2020-05-06T12:54:11", orgId: "cdd7a122-0fae-4202-8d86-14efbacc2863", shortName: "krcert", }, references: [ { tags: [ "x_refsource_MISC", ], url: "http://www.dext5.com/page/support/notice_view.aspx?pSeq=26", }, { tags: [ "x_refsource_MISC", ], url: "https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35352", }, ], source: { discovery: "UNKNOWN", }, x_generator: { engine: "Vulnogram 0.0.9", }, x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "vuln@krcert.or.kr", ID: "CVE-2019-19168", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Dext.ocx ActiveX Control in Dext5 Upload", version: { version_data: [ { platform: "Windows", version_affected: "<", version_name: "5.0.0.116 and prior", version_value: "5.0.0.117", }, ], }, }, ], }, vendor_name: "RAONwiz", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Dext5.ocx ActiveX 5.0.0.116 and eariler versions contain a vulnerability, which could allow remote attacker to download and execute remote arbitrary file by setting the arguments to the activex method. This can be leveraged for code execution.", }, ], }, generator: { engine: "Vulnogram 0.0.9", }, impact: { cvss: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "File download & execution", }, ], }, ], }, references: { reference_data: [ { name: "http://www.dext5.com/page/support/notice_view.aspx?pSeq=26", refsource: "MISC", url: "http://www.dext5.com/page/support/notice_view.aspx?pSeq=26", }, { name: "https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35352", refsource: "MISC", url: "https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35352", }, ], }, source: { discovery: "UNKNOWN", }, }, }, }, cveMetadata: { assignerOrgId: "cdd7a122-0fae-4202-8d86-14efbacc2863", assignerShortName: "krcert", cveId: "CVE-2019-19168", datePublished: "2020-05-06T12:54:11", dateReserved: "2019-11-21T00:00:00", dateUpdated: "2024-08-05T02:09:39.363Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2008-0551
Vulnerability from cvelistv5
Published
2008-02-01 19:41
Modified
2024-08-07 07:46
Severity ?
EPSS score ?
Summary
The NamoInstaller.NamoInstall.1 ActiveX control in NamoInstaller.dll 3.0.0.1 and earlier in Namo Web Editor in Sejoong Namo ActiveSquare 6 allows remote attackers to execute arbitrary code via a URL in the argument to the Install method. NOTE: some of these details are obtained from third party information.
References
| ▼ | URL | Tags |
|---|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/39943 | vdb-entry, x_refsource_XF | |
| https://www.exploit-db.com/exploits/4986 | exploit, x_refsource_EXPLOIT-DB | |
| http://www.securityfocus.com/bid/27580 | vdb-entry, x_refsource_BID | |
| http://www.vupen.com/english/advisories/2008/0299 | vdb-entry, x_refsource_VUPEN | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/39974 | vdb-entry, x_refsource_XF | |
| http://secunia.com/advisories/28649 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/27453 | vdb-entry, x_refsource_BID |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-07T07:46:55.117Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "activesquare-namoinstaller-code-execution(39943)", tags: [ "vdb-entry", "x_refsource_XF", "x_transferred", ], url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/39943", }, { name: "4986", tags: [ "exploit", "x_refsource_EXPLOIT-DB", "x_transferred", ], url: "https://www.exploit-db.com/exploits/4986", }, { name: "27580", tags: [ "vdb-entry", "x_refsource_BID", "x_transferred", ], url: "http://www.securityfocus.com/bid/27580", }, { name: "ADV-2008-0299", tags: [ "vdb-entry", "x_refsource_VUPEN", "x_transferred", ], url: "http://www.vupen.com/english/advisories/2008/0299", }, { name: "namoinstaller-namoinstaller-code-execution(39974)", tags: [ "vdb-entry", "x_refsource_XF", "x_transferred", ], url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/39974", }, { name: "28649", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/28649", }, { name: "27453", tags: [ "vdb-entry", "x_refsource_BID", "x_transferred", ], url: "http://www.securityfocus.com/bid/27453", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "n/a", vendor: "n/a", versions: [ { status: "affected", version: "n/a", }, ], }, ], datePublic: "2008-01-25T00:00:00", descriptions: [ { lang: "en", value: "The NamoInstaller.NamoInstall.1 ActiveX control in NamoInstaller.dll 3.0.0.1 and earlier in Namo Web Editor in Sejoong Namo ActiveSquare 6 allows remote attackers to execute arbitrary code via a URL in the argument to the Install method. NOTE: some of these details are obtained from third party information.", }, ], problemTypes: [ { descriptions: [ { description: "n/a", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2017-09-28T12:57:01", orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", shortName: "mitre", }, references: [ { name: "activesquare-namoinstaller-code-execution(39943)", tags: [ "vdb-entry", "x_refsource_XF", ], url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/39943", }, { name: "4986", tags: [ "exploit", "x_refsource_EXPLOIT-DB", ], url: "https://www.exploit-db.com/exploits/4986", }, { name: "27580", tags: [ "vdb-entry", "x_refsource_BID", ], url: "http://www.securityfocus.com/bid/27580", }, { name: "ADV-2008-0299", tags: [ "vdb-entry", "x_refsource_VUPEN", ], url: "http://www.vupen.com/english/advisories/2008/0299", }, { name: "namoinstaller-namoinstaller-code-execution(39974)", tags: [ "vdb-entry", "x_refsource_XF", ], url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/39974", }, { name: "28649", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/28649", }, { name: "27453", tags: [ "vdb-entry", "x_refsource_BID", ], url: "http://www.securityfocus.com/bid/27453", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "cve@mitre.org", ID: "CVE-2008-0551", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "n/a", version: { version_data: [ { version_value: "n/a", }, ], }, }, ], }, vendor_name: "n/a", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "The NamoInstaller.NamoInstall.1 ActiveX control in NamoInstaller.dll 3.0.0.1 and earlier in Namo Web Editor in Sejoong Namo ActiveSquare 6 allows remote attackers to execute arbitrary code via a URL in the argument to the Install method. NOTE: some of these details are obtained from third party information.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "n/a", }, ], }, ], }, references: { reference_data: [ { name: "activesquare-namoinstaller-code-execution(39943)", refsource: "XF", url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/39943", }, { name: "4986", refsource: "EXPLOIT-DB", url: "https://www.exploit-db.com/exploits/4986", }, { name: "27580", refsource: "BID", url: "http://www.securityfocus.com/bid/27580", }, { name: "ADV-2008-0299", refsource: "VUPEN", url: "http://www.vupen.com/english/advisories/2008/0299", }, { name: "namoinstaller-namoinstaller-code-execution(39974)", refsource: "XF", url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/39974", }, { name: "28649", refsource: "SECUNIA", url: "http://secunia.com/advisories/28649", }, { name: "27453", refsource: "BID", url: "http://www.securityfocus.com/bid/27453", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", assignerShortName: "mitre", cveId: "CVE-2008-0551", datePublished: "2008-02-01T19:41:00", dateReserved: "2008-02-01T00:00:00", dateUpdated: "2024-08-07T07:46:55.117Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2008-0078
Vulnerability from cvelistv5
Published
2008-02-12 22:00
Modified
2024-08-07 07:32
Severity ?
EPSS score ?
Summary
Unspecified vulnerability in an ActiveX control (dxtmsft.dll) in Microsoft Internet Explorer 5.01, 6 SP1 and SP2, and 7 allows remote attackers to execute arbitrary code via a crafted image, aka "Argument Handling Memory Corruption Vulnerability."
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/27689 | vdb-entry, x_refsource_BID | |
| http://www.securitytracker.com/id?1019381 | vdb-entry, x_refsource_SECTRACK | |
| http://marc.info/?l=bugtraq&m=120361015026386&w=2 | vendor-advisory, x_refsource_HP | |
| http://marc.info/?l=bugtraq&m=120361015026386&w=2 | vendor-advisory, x_refsource_HP | |
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4904 | vdb-entry, signature, x_refsource_OVAL | |
| http://www.us-cert.gov/cas/techalerts/TA08-043C.html | third-party-advisory, x_refsource_CERT | |
| http://www.vupen.com/english/advisories/2008/0512/references | vdb-entry, x_refsource_VUPEN | |
| https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-010 | vendor-advisory, x_refsource_MS | |
| http://secunia.com/advisories/28903 | third-party-advisory, x_refsource_SECUNIA |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-07T07:32:24.051Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "27689", tags: [ "vdb-entry", "x_refsource_BID", "x_transferred", ], url: "http://www.securityfocus.com/bid/27689", }, { name: "1019381", tags: [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred", ], url: "http://www.securitytracker.com/id?1019381", }, { name: "HPSBST02314", tags: [ "vendor-advisory", "x_refsource_HP", "x_transferred", ], url: "http://marc.info/?l=bugtraq&m=120361015026386&w=2", }, { name: "SSRT080016", tags: [ "vendor-advisory", "x_refsource_HP", "x_transferred", ], url: "http://marc.info/?l=bugtraq&m=120361015026386&w=2", }, { name: "oval:org.mitre.oval:def:4904", tags: [ "vdb-entry", "signature", "x_refsource_OVAL", "x_transferred", ], url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4904", }, { name: "TA08-043C", tags: [ "third-party-advisory", "x_refsource_CERT", "x_transferred", ], url: "http://www.us-cert.gov/cas/techalerts/TA08-043C.html", }, { name: "ADV-2008-0512", tags: [ "vdb-entry", "x_refsource_VUPEN", "x_transferred", ], url: "http://www.vupen.com/english/advisories/2008/0512/references", }, { name: "MS08-010", tags: [ "vendor-advisory", "x_refsource_MS", "x_transferred", ], url: "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-010", }, { name: "28903", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/28903", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "n/a", vendor: "n/a", versions: [ { status: "affected", version: "n/a", }, ], }, ], datePublic: "2008-02-12T00:00:00", descriptions: [ { lang: "en", value: "Unspecified vulnerability in an ActiveX control (dxtmsft.dll) in Microsoft Internet Explorer 5.01, 6 SP1 and SP2, and 7 allows remote attackers to execute arbitrary code via a crafted image, aka \"Argument Handling Memory Corruption Vulnerability.\"", }, ], problemTypes: [ { descriptions: [ { description: "n/a", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2018-10-12T19:57:01", orgId: "f38d906d-7342-40ea-92c1-6c4a2c6478c8", shortName: "microsoft", }, references: [ { name: "27689", tags: [ "vdb-entry", "x_refsource_BID", ], url: "http://www.securityfocus.com/bid/27689", }, { name: "1019381", tags: [ "vdb-entry", "x_refsource_SECTRACK", ], url: "http://www.securitytracker.com/id?1019381", }, { name: "HPSBST02314", tags: [ "vendor-advisory", "x_refsource_HP", ], url: "http://marc.info/?l=bugtraq&m=120361015026386&w=2", }, { name: "SSRT080016", tags: [ "vendor-advisory", "x_refsource_HP", ], url: "http://marc.info/?l=bugtraq&m=120361015026386&w=2", }, { name: "oval:org.mitre.oval:def:4904", tags: [ "vdb-entry", "signature", "x_refsource_OVAL", ], url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4904", }, { name: "TA08-043C", tags: [ "third-party-advisory", "x_refsource_CERT", ], url: "http://www.us-cert.gov/cas/techalerts/TA08-043C.html", }, { name: "ADV-2008-0512", tags: [ "vdb-entry", "x_refsource_VUPEN", ], url: "http://www.vupen.com/english/advisories/2008/0512/references", }, { name: "MS08-010", tags: [ "vendor-advisory", "x_refsource_MS", ], url: "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-010", }, { name: "28903", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/28903", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "secure@microsoft.com", ID: "CVE-2008-0078", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "n/a", version: { version_data: [ { version_value: "n/a", }, ], }, }, ], }, vendor_name: "n/a", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Unspecified vulnerability in an ActiveX control (dxtmsft.dll) in Microsoft Internet Explorer 5.01, 6 SP1 and SP2, and 7 allows remote attackers to execute arbitrary code via a crafted image, aka \"Argument Handling Memory Corruption Vulnerability.\"", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "n/a", }, ], }, ], }, references: { reference_data: [ { name: "27689", refsource: "BID", url: "http://www.securityfocus.com/bid/27689", }, { name: "1019381", refsource: "SECTRACK", url: "http://www.securitytracker.com/id?1019381", }, { name: "HPSBST02314", refsource: "HP", url: "http://marc.info/?l=bugtraq&m=120361015026386&w=2", }, { name: "SSRT080016", refsource: "HP", url: "http://marc.info/?l=bugtraq&m=120361015026386&w=2", }, { name: "oval:org.mitre.oval:def:4904", refsource: "OVAL", url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4904", }, { name: "TA08-043C", refsource: "CERT", url: "http://www.us-cert.gov/cas/techalerts/TA08-043C.html", }, { name: "ADV-2008-0512", refsource: "VUPEN", url: "http://www.vupen.com/english/advisories/2008/0512/references", }, { name: "MS08-010", refsource: "MS", url: "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-010", }, { name: "28903", refsource: "SECUNIA", url: "http://secunia.com/advisories/28903", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f38d906d-7342-40ea-92c1-6c4a2c6478c8", assignerShortName: "microsoft", cveId: "CVE-2008-0078", datePublished: "2008-02-12T22:00:00", dateReserved: "2008-01-03T00:00:00", dateUpdated: "2024-08-07T07:32:24.051Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2019-19164
Vulnerability from cvelistv5
Published
2020-05-07 18:00
Modified
2024-08-05 02:09
Severity ?
EPSS score ?
Summary
dext5.ocx ActiveX Control in Dext5 Upload 5.0.0.112 and earlier versions contains a vulnerability that could allow remote files to be executed by setting the arguments to the activex method. A remote attacker could induce a user to access a crafted web page, causing damage such as malicious code infection.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35344 | x_refsource_CONFIRM | |
| http://www.dext5.com/page/support/notice_view.aspx?pSeq=23 | x_refsource_CONFIRM |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| RAONWiz | dext.ocx ActiveX Control in Dext5 Upload |
Version: Affected: 5.0.0.112 and earlier Version: Fixed: 5.0.0.113 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T02:09:39.379Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35344", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "http://www.dext5.com/page/support/notice_view.aspx?pSeq=23", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "dext.ocx ActiveX Control in Dext5 Upload", vendor: "RAONWiz", versions: [ { status: "affected", version: "Affected: 5.0.0.112 and earlier", }, { status: "affected", version: "Fixed: 5.0.0.113", }, ], }, ], credits: [ { lang: "en", value: "Yu, Donghyun", }, ], descriptions: [ { lang: "en", value: "dext5.ocx ActiveX Control in Dext5 Upload 5.0.0.112 and earlier versions contains a vulnerability that could allow remote files to be executed by setting the arguments to the activex method. A remote attacker could induce a user to access a crafted web page, causing damage such as malicious code infection.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-20", description: "CWE-20 Improper Input Validation", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2020-05-07T18:00:57", orgId: "cdd7a122-0fae-4202-8d86-14efbacc2863", shortName: "krcert", }, references: [ { tags: [ "x_refsource_CONFIRM", ], url: "https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35344", }, { tags: [ "x_refsource_CONFIRM", ], url: "http://www.dext5.com/page/support/notice_view.aspx?pSeq=23", }, ], source: { discovery: "UNKNOWN", }, title: "Dext5 Upload ActiveX Arbitrary File Execution Vulnerability", x_generator: { engine: "Vulnogram 0.0.9", }, x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "vuln@krcert.or.kr", ID: "CVE-2019-19164", STATE: "PUBLIC", TITLE: "Dext5 Upload ActiveX Arbitrary File Execution Vulnerability", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "dext.ocx ActiveX Control in Dext5 Upload", version: { version_data: [ { version_value: "Affected: 5.0.0.112 and earlier", }, { version_value: "Fixed: 5.0.0.113", }, ], }, }, ], }, vendor_name: "RAONWiz", }, ], }, }, credit: [ { lang: "eng", value: "Yu, Donghyun", }, ], data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "dext5.ocx ActiveX Control in Dext5 Upload 5.0.0.112 and earlier versions contains a vulnerability that could allow remote files to be executed by setting the arguments to the activex method. A remote attacker could induce a user to access a crafted web page, causing damage such as malicious code infection.", }, ], }, generator: { engine: "Vulnogram 0.0.9", }, impact: { cvss: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "CWE-20 Improper Input Validation", }, ], }, ], }, references: { reference_data: [ { name: "https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35344", refsource: "CONFIRM", url: "https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35344", }, { name: "http://www.dext5.com/page/support/notice_view.aspx?pSeq=23", refsource: "CONFIRM", url: "http://www.dext5.com/page/support/notice_view.aspx?pSeq=23", }, ], }, source: { discovery: "UNKNOWN", }, }, }, }, cveMetadata: { assignerOrgId: "cdd7a122-0fae-4202-8d86-14efbacc2863", assignerShortName: "krcert", cveId: "CVE-2019-19164", datePublished: "2020-05-07T18:00:57", dateReserved: "2019-11-21T00:00:00", dateUpdated: "2024-08-05T02:09:39.379Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }