ByteOS

Product:Windows

Added At:25 Feb, 2022

Due At:25 Aug, 2022

Microsoft Windows Code Injection Vulnerability

Microsoft Windows allow remote attackers to execute arbitrary code via a crafted OLE object.

Used in Ransomware

Unknown

CWE

CWE-94

Required Action:

Apply updates per vendor instructions.

Additional Notes:

https://nvd.nist.gov/vuln/detail/CVE-2014-6352

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:microsoft

Assigner Org ID:f38d906d-7342-40ea-92c1-6c4a2c6478c8

Published At:22 Oct, 2014 | 14:00

Updated At:30 Jul, 2025 | 01:46

▼CVE Numbering Authority (CNA)

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object, as exploited in the wild in October 2014 with a crafted PowerPoint document.

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/97714	vdb-entry x_refsource_XF
http://twitter.com/ohjeongwook/statuses/524795124270653440	x_refsource_MISC
http://secunia.com/advisories/61803	third-party-advisory x_refsource_SECUNIA
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-064	vendor-advisory x_refsource_MS
http://www.securitytracker.com/id/1031097	vdb-entry x_refsource_SECTRACK
http://blogs.technet.com/b/srd/archive/2014/11/11/assessing-risk-for-the-november-2014-security-updates.aspx	x_refsource_CONFIRM
http://www.securityfocus.com/bid/70690	vdb-entry x_refsource_BID
https://technet.microsoft.com/library/security/3010060	x_refsource_CONFIRM

Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/97714

Resource:

vdb-entry

x_refsource_XF

Hyperlink: http://twitter.com/ohjeongwook/statuses/524795124270653440

Resource:

x_refsource_MISC

Resource:

third-party-advisory

x_refsource_SECUNIA

Hyperlink: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-064

Resource:

vendor-advisory

x_refsource_MS

Hyperlink: http://www.securitytracker.com/id/1031097

Resource:

vdb-entry

x_refsource_SECTRACK

Hyperlink: http://blogs.technet.com/b/srd/archive/2014/11/11/assessing-risk-for-the-november-2014-security-updates.aspx

Resource:

x_refsource_CONFIRM

Hyperlink: http://www.securityfocus.com/bid/70690

Resource:

vdb-entry

x_refsource_BID

Hyperlink: https://technet.microsoft.com/library/security/3010060

Resource:

x_refsource_CONFIRM

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/97714	vdb-entry x_refsource_XF x_transferred
http://twitter.com/ohjeongwook/statuses/524795124270653440	x_refsource_MISC x_transferred
http://secunia.com/advisories/61803	third-party-advisory x_refsource_SECUNIA x_transferred
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-064	vendor-advisory x_refsource_MS x_transferred
http://www.securitytracker.com/id/1031097	vdb-entry x_refsource_SECTRACK x_transferred
http://blogs.technet.com/b/srd/archive/2014/11/11/assessing-risk-for-the-november-2014-security-updates.aspx	x_refsource_CONFIRM x_transferred
http://www.securityfocus.com/bid/70690	vdb-entry x_refsource_BID x_transferred
https://technet.microsoft.com/library/security/3010060	x_refsource_CONFIRM x_transferred

Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/97714

Resource:

vdb-entry

x_refsource_XF

x_transferred

Hyperlink: http://twitter.com/ohjeongwook/statuses/524795124270653440

Resource:

x_refsource_MISC

x_transferred

Resource:

third-party-advisory

x_refsource_SECUNIA

x_transferred

Hyperlink: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-064

Resource:

vendor-advisory

x_refsource_MS

x_transferred

Hyperlink: http://www.securitytracker.com/id/1031097

Resource:

vdb-entry

x_refsource_SECTRACK

x_transferred

Hyperlink: http://blogs.technet.com/b/srd/archive/2014/11/11/assessing-risk-for-the-november-2014-security-updates.aspx

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: http://www.securityfocus.com/bid/70690

Resource:

vdb-entry

x_refsource_BID

x_transferred

Hyperlink: https://technet.microsoft.com/library/security/3010060

Resource:

x_refsource_CONFIRM

x_transferred

2. CISA ADP Vulnrichment

Problem Types

Type	CWE ID	Description
CWE	CWE-noinfo	CWE-noinfo Not enough information

Type: CWE

CWE ID: CWE-noinfo

Description: CWE-noinfo Not enough information

Metrics

Version	Base score	Base severity	Vector
3.1	7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Version: 3.1

Base score: 7.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Metrics Other Info

kev

dateAdded:

2022-02-25

reference:

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-6352

Timeline

Event	Date
CVE-2014-6352 added to CISA KEV	2022-02-25 00:00:00

Event: CVE-2014-6352 added to CISA KEV

Date: 2022-02-25 00:00:00

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:secure@microsoft.com

Published At:22 Oct, 2014 | 14:55

Updated At:12 Apr, 2025 | 10:46

CISA Catalog

Date Added	Due Date	Vulnerability Name	Required Action
2022-02-25	2022-08-25	Microsoft Windows Code Injection Vulnerability	Apply updates per vendor instructions.

Date Added: 2022-02-25

Due Date: 2022-08-25

Vulnerability Name: Microsoft Windows Code Injection Vulnerability

Required Action: Apply updates per vendor instructions.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Secondary	3.1	7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary	2.0	9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C

Type: Primary

Version: 3.1

Base score: 7.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Type: Secondary

Version: 3.1

Base score: 7.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 9.3

Base severity: HIGH

Vector:

AV:N/AC:M/Au:N/C:C/I:C/A:C

CPE Matches

cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*

>>windows_7>>-

cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*

>>windows_8>>-

cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*

>>windows_8.1>>-

cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*

>>windows_rt>>-

cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*

>>windows_rt_8.1>>-

cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*

>>windows_server_2008>>-

cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*

>>windows_server_2008>>r2

cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*

>>windows_server_2012>>-

cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*

>>windows_server_2012>>r2

cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*

>>windows_vista>>-

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov

CWE ID: NVD-CWE-noinfo

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://blogs.technet.com/b/srd/archive/2014/11/11/assessing-risk-for-the-november-2014-security-updates.aspx	secure@microsoft.com	Broken Link Patch Vendor Advisory
http://secunia.com/advisories/61803	secure@microsoft.com	Broken Link
http://twitter.com/ohjeongwook/statuses/524795124270653440	secure@microsoft.com	Third Party Advisory
http://www.securityfocus.com/bid/70690	secure@microsoft.com	Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1031097	secure@microsoft.com	Broken Link Third Party Advisory VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-064	secure@microsoft.com	Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/97714	secure@microsoft.com	Third Party Advisory VDB Entry
https://technet.microsoft.com/library/security/3010060	secure@microsoft.com	Patch Vendor Advisory
http://blogs.technet.com/b/srd/archive/2014/11/11/assessing-risk-for-the-november-2014-security-updates.aspx	af854a3a-2127-422b-91ae-364da2661108	Broken Link Patch Vendor Advisory
http://secunia.com/advisories/61803	af854a3a-2127-422b-91ae-364da2661108	Broken Link
http://twitter.com/ohjeongwook/statuses/524795124270653440	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
http://www.securityfocus.com/bid/70690	af854a3a-2127-422b-91ae-364da2661108	Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1031097	af854a3a-2127-422b-91ae-364da2661108	Broken Link Third Party Advisory VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-064	af854a3a-2127-422b-91ae-364da2661108	Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/97714	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory VDB Entry
https://technet.microsoft.com/library/security/3010060	af854a3a-2127-422b-91ae-364da2661108	Patch Vendor Advisory

Hyperlink: http://blogs.technet.com/b/srd/archive/2014/11/11/assessing-risk-for-the-november-2014-security-updates.aspx

Source: secure@microsoft.com

Resource:

Broken Link

Patch

Vendor Advisory

Source: secure@microsoft.com

Resource:

Broken Link

Hyperlink: http://twitter.com/ohjeongwook/statuses/524795124270653440

Source: secure@microsoft.com

Resource:

Third Party Advisory

Hyperlink: http://www.securityfocus.com/bid/70690

Source: secure@microsoft.com

Resource:

Broken Link

Third Party Advisory

VDB Entry

Hyperlink: http://www.securitytracker.com/id/1031097

Source: secure@microsoft.com

Resource:

Broken Link

Third Party Advisory

VDB Entry

Hyperlink: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-064

Source: secure@microsoft.com

Resource:

Patch

Vendor Advisory

Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/97714

Source: secure@microsoft.com

Resource:

Third Party Advisory

VDB Entry

Hyperlink: https://technet.microsoft.com/library/security/3010060

Source: secure@microsoft.com

Resource:

Patch

Vendor Advisory

Hyperlink: http://blogs.technet.com/b/srd/archive/2014/11/11/assessing-risk-for-the-november-2014-security-updates.aspx

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Patch

Vendor Advisory

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Hyperlink: http://twitter.com/ohjeongwook/statuses/524795124270653440

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: http://www.securityfocus.com/bid/70690

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Third Party Advisory

VDB Entry

Hyperlink: http://www.securitytracker.com/id/1031097

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Third Party Advisory

VDB Entry

Hyperlink: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-064

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Patch

Vendor Advisory

Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/97714

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

VDB Entry

Hyperlink: https://technet.microsoft.com/library/security/3010060

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Patch

Vendor Advisory

Similar CVEs

5082Records found

CVE-2022-34245

Matching Score-8

Matching Score-8

CVSS Score-7.8||HIGH

EPSS-0.12% / 32.38%

7 Day CHG~0.00%

Published-15 Jul, 2022 | 15:48

Updated-23 Apr, 2025 | 17:58

Adobe InDesign Font Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

Adobe InDesign versions 17.2.1 (and earlier) and 16.4.1 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Vendor-Adobe Inc.Apple Inc.Microsoft Corporation

Product-windows indesign macos InDesign

CWE ID-CWE-122

Heap-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2010-1758

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-13.96% / 94.07%

7 Day CHG~0.00%

Published-11 Jun, 2010 | 19:00

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving DOM Range objects.

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CVE-2010-1774

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-5.92% / 90.26%

7 Day CHG~0.00%

Published-11 Jun, 2010 | 19:00

Updated-11 Apr, 2025 | 00:51

WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, accesses out-of-bounds memory during processing of HTML tables, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted HTML document.

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2015-7653

Matching Score-8

Matching Score-8

CVSS Score-9.3||HIGH

EPSS-5.83% / 90.19%

7 Day CHG~0.00%

Published-11 Nov, 2015 | 11:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via crafted globalToLocal arguments, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows iphone_os mac_os_x android n/a

CVE-2010-1262

Matching Score-8

Matching Score-8

CVSS Score-9.3||HIGH

EPSS-60.98% / 98.24%

7 Day CHG~0.00%

Published-08 Jun, 2010 | 22:00

Updated-11 Apr, 2025 | 00:51

Microsoft Internet Explorer 6 SP1 and SP2, 7, and 8 allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, related to the CStyleSheet object and a free of the root container, aka "Memory Corruption Vulnerability."

Product-windows_7 windows_xp windows_server_2008 windows_2000 windows_2003_server windows_vista internet_explorer n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2010-1402

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-8.82% / 92.19%

7 Day CHG~0.00%

Published-11 Jun, 2010 | 17:28

Updated-11 Apr, 2025 | 00:51

Double free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to an event listener in an SVG document, related to duplicate event listeners, a timer, and an AnimateTransform object.

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CVE-2010-1280

Matching Score-8

Matching Score-8

CVSS Score-8.8||HIGH

EPSS-37.16% / 97.04%

7 Day CHG~0.00%

Published-13 May, 2010 | 17:00

Updated-11 Apr, 2025 | 00:51

Adobe Shockwave Player before 11.5.7.609 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted .dir (aka Director) file, related to (1) an erroneous dereference and (2) a certain Shock.dir file.

Vendor-n/a Microsoft Corporation Apple Inc.Adobe Inc.

Product-windows shockwave_player macos n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2010-1260

Matching Score-8

Matching Score-8

CVSS Score-7.5||HIGH

EPSS-50.16% / 97.75%

7 Day CHG~0.00%

Published-08 Jun, 2010 | 22:00

Updated-11 Apr, 2025 | 00:51

The IE8 Developer Toolbar in Microsoft Internet Explorer 8 SP1, SP2, and SP3 allows user-assisted remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "HTML Element Memory Corruption Vulnerability."

Product-windows_7 windows_xp windows_server_2008 windows_2003_server windows_vista internet_explorer n/a ie

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2015-7651

Matching Score-8

Matching Score-8

CVSS Score-9.3||HIGH

EPSS-5.83% / 90.19%

7 Day CHG~0.00%

Published-11 Nov, 2015 | 11:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via crafted DefineFunction atoms, a different vulnerability than CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows iphone_os mac_os_x android n/a

CVE-2010-1419

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-10.05% / 92.78%

7 Day CHG~0.00%

Published-11 Jun, 2010 | 19:00

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows user-assisted remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving a certain window close action that occurs during a drag-and-drop operation.

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CVE-2010-1281

Matching Score-8

Matching Score-8

CVSS Score-8.8||HIGH

EPSS-12.84% / 93.77%

7 Day CHG~0.00%

Published-13 May, 2010 | 17:00

Updated-11 Apr, 2025 | 00:51

iml32.dll in Adobe Shockwave Player before 11.5.7.609 does not validate a certain value from a file before using it in file-pointer calculations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted .dir (aka Director) file.

Vendor-n/a Microsoft Corporation Apple Inc.Adobe Inc.

Product-windows shockwave_player macos n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2010-1286

Matching Score-8

Matching Score-8

CVSS Score-9.3||HIGH

EPSS-4.40% / 88.57%

7 Day CHG~0.00%

Published-13 May, 2010 | 21:00

Updated-11 Apr, 2025 | 00:51

Adobe Shockwave Player before 11.5.7.609 allows attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2010-1284, CVE-2010-1287, CVE-2010-1289, CVE-2010-1290, and CVE-2010-1291.

Vendor-n/a Microsoft Corporation Apple Inc.Adobe Inc.

Product-windows windows_7 shockwave_player windows_server_2008 windows_server_2003 windows_vista macos n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2010-1246

Matching Score-8

Matching Score-8

CVSS Score-9.3||HIGH

EPSS-61.40% / 98.26%

7 Day CHG~0.00%

Published-08 Jun, 2010 | 20:00

Updated-11 Apr, 2025 | 00:51

Stack-based buffer overflow in Microsoft Office Excel 2002 SP3 allows remote attackers to execute arbitrary code via an Excel file with a malformed RTD (0x813) record, aka "Excel RTD Memory Corruption Vulnerability."

Product-excel n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2010-1793

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-41.15% / 97.30%

7 Day CHG~0.00%

Published-30 Jul, 2010 | 20:00

Updated-11 Apr, 2025 | 00:51

Multiple use-after-free vulnerabilities in WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS X 10.4; and webkitgtk before 1.2.6; allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a (1) font-face or (2) use element in an SVG document.

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CVE-2021-21056

Matching Score-8

Matching Score-8

CVSS Score-7.8||HIGH

EPSS-3.94% / 87.88%

7 Day CHG~0.00%

Published-12 Mar, 2021 | 18:15

Updated-23 Apr, 2025 | 19:42

Adobe FrameMaker Out-of-Bounds Read Vulnerability Could Lead To Remote Code Execution

Adobe Framemaker version 2020.0.1 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Vendor-Adobe Inc.Microsoft Corporation

Product-framemaker windows FrameMaker

CWE ID-CWE-125

Out-of-bounds Read

CVE-2010-1790

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-3.79% / 87.61%

7 Day CHG~0.00%

Published-30 Jul, 2010 | 20:00

Updated-11 Apr, 2025 | 00:51

WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS X 10.4; and webkitgtk before 1.2.6; does not properly handle just-in-time (JIT) compiled JavaScript stubs, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted HTML document, related to a "reentrancy issue."

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CVE-2010-1777

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-2.84% / 85.69%

7 Day CHG~0.00%

Published-29 Jul, 2010 | 18:00

Updated-11 Apr, 2025 | 00:51

Buffer overflow in Apple iTunes before 9.2.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted itpc: URL.

Product-windows_7 windows_xp windows_vista itunes mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2010-1780

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-6.49% / 90.72%

7 Day CHG~0.00%

Published-30 Jul, 2010 | 20:00

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS X 10.4; and webkitgtk before 1.2.6; allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to element focus.

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CVE-2015-8050

Matching Score-8

Matching Score-8

CVSS Score-9.3||HIGH

EPSS-6.34% / 90.60%

7 Day CHG~0.00%

Published-10 Dec, 2015 | 02:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in the MovieClip object implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via a crafted beginGradientFill call, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows iphone_os mac_os_x android n/a

CVE-2010-1881

Matching Score-8

Matching Score-8

CVSS Score-9.3||HIGH

EPSS-56.15% / 98.02%

7 Day CHG~0.00%

Published-14 Jul, 2010 | 18:31

Updated-11 Apr, 2025 | 00:51

The FieldList ActiveX control in the Microsoft Access Wizard Controls in ACCWIZ.dll in Microsoft Office Access 2003 SP3 does not properly interact with the memory-access approach used by Internet Explorer and Office during instantiation, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via an HTML document that references this control along with crafted persistent storage data, aka "ACCWIZ.dll Uninitialized Variable Vulnerability."

Product-office access n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2010-1788

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-6.54% / 90.74%

7 Day CHG~0.00%

Published-30 Jul, 2010 | 20:00

Updated-11 Apr, 2025 | 00:51

WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS X 10.4; and webkitgtk before 1.2.6; allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a use element in an SVG document.

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2010-1728

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.3||HIGH

EPSS-11.46% / 93.33%

7 Day CHG~0.00%

Published-05 May, 2010 | 14:00

Updated-11 Apr, 2025 | 00:51

Opera before 10.53 on Windows and Mac OS X does not properly handle a series of document modifications that occur asynchronously, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via JavaScript that writes <marquee> sequences in an infinite loop, leading to attempted use of uninitialized memory. NOTE: this might overlap CVE-2006-6955.

Vendor-n/a Microsoft Corporation Apple Inc.Opera

Product-windows opera_browser mac_os_x n/a

CVE-2010-1759

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-48.80% / 97.68%

7 Day CHG~0.00%

Published-11 Jun, 2010 | 19:00

Updated-11 Apr, 2025 | 00:51

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CVE-2010-1792

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-6.54% / 90.74%

7 Day CHG~0.00%

Published-30 Jul, 2010 | 20:00

Updated-11 Apr, 2025 | 00:51

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2010-1285

Matching Score-8

Matching Score-8

CVSS Score-9.3||HIGH

EPSS-10.10% / 92.80%

7 Day CHG~0.00%

Published-30 Jun, 2010 | 18:00

Updated-11 Apr, 2025 | 00:51

Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow attackers to execute arbitrary code via unspecified manipulations involving the newclass (0x58) operator and an "invalid pointer vulnerability" that triggers memory corruption, a different vulnerability than CVE-2010-2168 and CVE-2010-2201.

Vendor-n/a Microsoft Corporation Apple Inc.Adobe Inc.

Product-windows acrobat_reader acrobat mac_os_x n/a

CWE ID-CWE-20

Improper Input Validation

CVE-2010-1245

Matching Score-8

Matching Score-8

CVSS Score-9.3||HIGH

EPSS-61.40% / 98.26%

7 Day CHG~0.00%

Published-08 Jun, 2010 | 20:00

Updated-11 Apr, 2025 | 00:51

Unspecified vulnerability in Microsoft Office Excel 2002 SP3, Office 2004 for Mac, Office 2008 for Mac, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via an Excel file with a malformed SxView (0xB0) record, aka "Excel Record Memory Corruption Vulnerability," a different vulnerability than CVE-2010-0824 and CVE-2010-0821.

Product-open_xml_file_format_converter office excel n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2010-1392

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-7.91% / 91.69%

7 Day CHG~0.00%

Published-11 Jun, 2010 | 17:28

Updated-11 Apr, 2025 | 00:51

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CVE-2010-1410

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-19.69% / 95.21%

7 Day CHG~0.00%

Published-11 Jun, 2010 | 17:28

Updated-11 Apr, 2025 | 00:51

WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via an SVG document with nested use elements.

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2010-1412

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-16.21% / 94.56%

7 Day CHG~0.00%

Published-11 Jun, 2010 | 17:28

Updated-11 Apr, 2025 | 00:51

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CVE-2010-1295

Matching Score-8

Matching Score-8

CVSS Score-9.3||HIGH

EPSS-12.52% / 93.68%

7 Day CHG~0.00%

Published-30 Jun, 2010 | 18:00

Updated-11 Apr, 2025 | 00:51

Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-2202, CVE-2010-2207, CVE-2010-2209, CVE-2010-2210, CVE-2010-2211, and CVE-2010-2212.

Vendor-n/a Microsoft Corporation Apple Inc.Adobe Inc.

Product-windows acrobat_reader acrobat mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2010-1250

Matching Score-8

Matching Score-8

CVSS Score-9.3||HIGH

EPSS-62.41% / 98.30%

7 Day CHG~0.00%

Published-08 Jun, 2010 | 20:00

Updated-11 Apr, 2025 | 00:51

Heap-based buffer overflow in Microsoft Office Excel 2002 SP3, Office 2004 for Mac, Office 2008 for Mac, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via an Excel file with malformed (1) EDG (0x88) and (2) Publisher (0x89) records, aka "Excel EDG Memory Corruption Vulnerability."

Product-open_xml_file_format_converter office excel n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2010-1771

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-8.54% / 92.03%

7 Day CHG~0.00%

Published-11 Jun, 2010 | 19:00

Updated-11 Apr, 2025 | 00:51

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CVE-2010-1784

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-4.92% / 89.21%

7 Day CHG~0.00%

Published-30 Jul, 2010 | 20:00

Updated-11 Apr, 2025 | 00:51

The counters functionality in the Cascading Style Sheets (CSS) implementation in WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS X 10.4; and webkitgtk before 1.2.6; allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document.

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2010-1251

Matching Score-8

Matching Score-8

CVSS Score-9.3||HIGH

EPSS-57.32% / 98.06%

7 Day CHG~0.00%

Published-08 Jun, 2010 | 20:00

Updated-11 Apr, 2025 | 00:51

Unspecified vulnerability in Microsoft Office Excel 2002 SP3 and Office 2004 for Mac allows remote attackers to execute arbitrary code via a crafted Excel file, aka "Excel Record Stack Corruption Vulnerability."

Product-office excel n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2010-1885

Matching Score-8

Matching Score-8

CVSS Score-9.3||HIGH

EPSS-91.47% / 99.66%

7 Day CHG~0.00%

Published-14 Jun, 2010 | 18:00

Updated-11 Apr, 2025 | 00:51

The MPC::HexToNum function in helpctr.exe in Microsoft Windows Help and Support Center in Windows XP and Windows Server 2003 does not properly handle malformed escape sequences, which allows remote attackers to bypass the trusted documents whitelist (fromHCP option) and execute arbitrary commands via a crafted hcp:// URL, aka "Help Center URL Validation Vulnerability."

Product-windows_server_2003 windows_xp windows_2003_server n/a

CWE ID-CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVE-2022-35706

Matching Score-8

Matching Score-8

CVSS Score-7.8||HIGH

EPSS-0.28% / 50.75%

7 Day CHG~0.00%

Published-19 Sep, 2022 | 15:47

Updated-23 Apr, 2025 | 16:57

Adobe Bridge SVG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

Adobe Bridge version 12.0.2 (and earlier) and 11.1.3 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Vendor-Adobe Inc.Apple Inc.Microsoft Corporation

Product-windows bridge macos Bridge

CWE ID-CWE-122

Heap-based Buffer Overflow

CVE-2010-1791

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-10.31% / 92.88%

7 Day CHG~0.00%

Published-30 Jul, 2010 | 20:00

Updated-11 Apr, 2025 | 00:51

Integer signedness error in WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving a JavaScript array index.

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CVE-2016-4229

Matching Score-8

Matching Score-8

CVSS Score-8.8||HIGH

EPSS-71.61% / 98.67%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-4173, CVE-2016-4174, CVE-2016-4222, CVE-2016-4226, CVE-2016-4227, CVE-2016-4228, CVE-2016-4230, CVE-2016-4231, and CVE-2016-4248.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-416

Use After Free

CVE-2010-1750

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-5.72% / 90.08%

7 Day CHG~0.00%

Published-11 Jun, 2010 | 17:28

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in Apple Safari before 5.0 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to improper window management.

Product-windows_7 windows_xp safari windows_vista n/a

CVE-2010-1882

Matching Score-8

Matching Score-8

CVSS Score-9.3||HIGH

EPSS-62.23% / 98.30%

7 Day CHG~0.00%

Published-11 Aug, 2010 | 18:00

Updated-11 Apr, 2025 | 00:51

Multiple buffer overflows in the MPEG Layer-3 Audio Codec for Microsoft DirectShow in l3codecx.ax in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allow remote attackers to execute arbitrary code via an MPEG Layer-3 audio stream in (1) a crafted media file or (2) crafted streaming content, aka "MPEG Layer-3 Audio Decoder Buffer Overflow Vulnerability."

Product-windows_server_2003 windows_xp windows_2003_server n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2010-1248

Matching Score-8

Matching Score-8

CVSS Score-9.3||HIGH

EPSS-62.25% / 98.30%

7 Day CHG~0.00%

Published-08 Jun, 2010 | 20:00

Updated-11 Apr, 2025 | 00:51

Buffer overflow in Microsoft Office Excel 2002 SP3 and Office 2004 for Mac allows remote attackers to execute arbitrary code via an Excel file with a malformed HFPicture (0x866) record, aka "Excel HFPicture Memory Corruption Vulnerability."

Product-office excel n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2015-8058

Matching Score-8

Matching Score-8

CVSS Score-9.3||HIGH

EPSS-6.36% / 90.61%

7 Day CHG~0.00%

Published-10 Dec, 2015 | 02:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows iphone_os mac_os_x android n/a

CVE-2010-1261

Matching Score-8

Matching Score-8

CVSS Score-9.3||HIGH

EPSS-58.33% / 98.12%

7 Day CHG~0.00%

Published-08 Jun, 2010 | 22:00

Updated-11 Apr, 2025 | 00:51

Product-windows_7 windows_xp windows_server_2008 windows_2003_server windows_vista internet_explorer n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2021-21102

Matching Score-8

Matching Score-8

CVSS Score-8.8||HIGH

EPSS-2.44% / 84.58%

7 Day CHG~0.00%

Published-28 Jun, 2021 | 13:45

Updated-23 Apr, 2025 | 19:40

Adobe Illustrator DOCX file parsing directory traversal vulnerability could lead to remote code execution

Adobe Illustrator version 25.2 (and earlier) is affected by a Path Traversal vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Vendor-Adobe Inc.Microsoft Corporation

Product-windows illustrator Illustrator

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2015-7632

Matching Score-8

Matching Score-8

CVSS Score-9.3||HIGH

EPSS-6.99% / 91.07%

7 Day CHG~0.00%

Published-14 Oct, 2015 | 23:00

Updated-12 Apr, 2025 | 10:46

Buffer overflow in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via a Loader object with a crafted loaderBytes property.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows mac_os_x android n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2010-1761

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-8.37% / 91.95%

7 Day CHG~0.00%

Published-11 Jun, 2010 | 19:00

Updated-11 Apr, 2025 | 00:51

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CVE-2010-1799

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-67.68% / 98.51%

7 Day CHG~0.00%

Published-16 Aug, 2010 | 18:25

Updated-11 Apr, 2025 | 00:51

Stack-based buffer overflow in the error-logging functionality in Apple QuickTime before 7.6.7 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file.

Product-windows quicktime n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2010-1883

Matching Score-8

Matching Score-8

CVSS Score-7.8||HIGH

EPSS-67.17% / 98.50%

7 Day CHG~0.00%

Published-13 Oct, 2010 | 18:00

Updated-11 Apr, 2025 | 00:51

Integer overflow in the Embedded OpenType (EOT) Font Engine in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows remote attackers to execute arbitrary code via a crafted table in an embedded font, aka "Embedded OpenType Font Integer Overflow Vulnerability."

Product-windows_7 windows_xp windows_server_2008 windows_server_2003 windows_2003_server windows_vista n/a

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2010-1783

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-4.92% / 89.21%

7 Day CHG~0.00%

Published-30 Jul, 2010 | 20:00

Updated-11 Apr, 2025 | 00:51

WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS X 10.4; and webkitgtk before 1.2.6; does not properly handle dynamic modification of a text node, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document.

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2021-21098

Matching Score-8

Matching Score-8