CVE Vulnerability Advisory Database

[Affected Scope] Oracle Java 7 Update 10 and earlier versions (all versions prior to Java 7 Update 11).

[Impact] Remote attackers can completely bypass the JVM security sandbox and execute arbitrary system commands with the privileges of the running user by enticing them to visit a malicious web page containing a crafted Java applet.

[Mitigation] Immediately upgrade to Oracle Java 7 Update 11 or later (or migrate to modern LTS versions like Java 8/11/17), and disable the Java browser plug-in across all enterprise endpoints.

[Affected Scope] Oracle Fusion Middleware versions 11.1.1.4, 11.1.1.6, and 11.1.2.0 within the Oracle Reports Developer component.

[Impact] Unauthenticated remote attackers can read or upload arbitrary files via the URLPARAMETER functionality, which can be chained with CVE-2012-3153 to achieve Remote Code Execution (RCE) via JSP web shell upload.

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or restrict external access to the rwservlet endpoint and implement strict URL filtering.

[Affected Scope] Oracle Java SE 7 Update 7 and earlier versions of the JRE (Java Runtime Environment)

[Impact] Unauthenticated remote attackers can completely compromise system confidentiality, integrity, and availability, leading to Remote Code Execution (RCE)

[Mitigation] Immediately upgrade to Java SE 7 Update 9 or later, and restrict JAX-WS class loading in legacy environments

[Affected Scope] Microsoft Internet Explorer versions 6, 7, 8, and 9

[Impact] Remote attackers can execute arbitrary code with the privileges of the current user by enticing a user to visit a specially crafted website

[Mitigation] Apply the official cumulative security update (MS12-063), transition to a modern supported browser, or apply the official Fix it solution

[Affected Scope] Oracle Java SE 7 Update 6 and earlier JRE (Java Runtime Environment) versions

[Impact] Remote attackers can completely bypass SecurityManager restrictions and execute arbitrary code with elevated privileges via a crafted malicious applet

[Mitigation] Immediately upgrade to Java SE 7 Update 7 or later, or disable the Java browser plugin across all endpoints

[Affected Scope] Systems running Microsoft Office 2003/2007/2010, SQL Server 2000/2005/2008, or Visual Basic 6.0 Runtime utilizing MSCOMCTL.OCX

[Impact] Remote attackers can execute arbitrary code with the privileges of the active user by corrupting system memory via crafted documents or web pages

[Mitigation] Apply the official Microsoft MS12-060 security update or configure ActiveX Kill Bits for the vulnerable TabStrip control

[Affected Scope] Systems running Microsoft XML Core Services (MSXML) versions 3.0, 4.0, 5.0, and 6.0, primarily accessed via Internet Explorer

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (memory corruption) by enticing a user to visit a specially crafted malicious website

[Mitigation] Apply the official Microsoft security update (MS12-043) immediately, or implement ActiveX Kill Bit workarounds to block the execution of vulnerable MSXML components

[Affected Scope] Legacy versions of Adobe Flash Player and Adobe AIR on Windows, macOS, Linux, and Android

[Impact] Execution of arbitrary code or Denial of Service (DoS) via memory corruption when processing specially crafted Flash content (SWF)

[Mitigation] Upgrade Adobe Flash Player and AIR to the patched versions, or completely uninstall the End-of-Life (EOL) Flash Player from all endpoints

[Affected Scope] PHP versions before 5.3.12 and 5.4.x before 5.4.2, configured to run as a CGI script (php-cgi)

[Impact] Unauthenticated remote attackers can execute arbitrary code by injecting command-line options via HTTP query strings

[Mitigation] Upgrade to patched PHP versions or configure web server rewrite rules to block malicious query strings

[Affected Scope] Microsoft Office 2003/2007/2010, SQL Server 2000/2005/2008, and Visual Basic 6.0 Runtime utilizing the MSCOMCTL.OCX library

[Impact] Remote attackers can execute arbitrary code with the privileges of the active user by enticing them to open a crafted Office document, RTF file, or malicious website

[Mitigation] Apply the official Microsoft MS12-027 security patch immediately, or configure registry Kill-Bits to disable the vulnerable ActiveX controls

[Affected Scope] Legacy Adobe Flash Player versions 10.x and 11.x on Windows, macOS, Linux, Solaris, and Android

[Impact] Attackers can execute arbitrary code or trigger a Denial of Service (DoS) via memory corruption by leveraging specially crafted Flash content

[Mitigation] Immediately uninstall legacy Flash Player components or restrict execution via browser policies and system-level access controls

[Affected Scope] Apache Struts versions prior to 2.2.3.1

[Impact] Unauthenticated remote attackers can execute arbitrary Java code with system privileges on the target server by sending crafted HTTP request parameters.

[Mitigation] Immediately upgrade Apache Struts to version 2.2.3.1 or later secure releases.

[Affected Scope] Adobe Reader and Acrobat 10.1.1 and earlier on Windows and Mac OS X, and Adobe Reader 9.x through 9.4.6 on UNIX

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (memory corruption) via a specially crafted PDF document containing malicious U3D data

[Mitigation] Apply the official security patches immediately, or disable the vulnerable U3D parsing component (rt3d.dll) as a temporary workaround

[Affected Scope] Windows XP, Vista, 7, and Windows Server 2003, 2008 kernel-mode drivers (win32k.sys)

[Impact] Remote code execution (RCE) with kernel-level privileges via crafted TrueType font data in Word documents or web pages

[Mitigation] Apply official MS11-087 security patches or implement the T2EMBED.DLL registry/ACL workaround

[Affected Scope] Adobe Flash Player before 10.2.154.27, Adobe Reader/Acrobat 9.x and 10.x, and Microsoft Office documents containing embedded Flash (.swf) files.

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (DoS) via crafted Flash content embedded in documents or web pages.

[Mitigation] Immediately uninstall legacy Adobe Flash Player, update Adobe Reader/Acrobat to the patched versions, and restrict Flash execution in Office documents.

[Affected Scope] Microsoft PowerPoint 2002 SP3 and PowerPoint 2003 SP3

[Impact] Remote attackers can execute arbitrary code with the privileges of the active user by tricking them into opening a crafted PowerPoint 95 document

[Mitigation] Apply the official MS10-088 security update or configure File Block settings via registry to restrict legacy PowerPoint 95 formats

[Affected Scope] Microsoft Internet Explorer versions 6, 7, and 8

[Impact] Remote attackers can execute arbitrary code with the privileges of the active user via a specially crafted web page

[Mitigation] Apply official cumulative security updates (MS10-090 or later), transition to modern browsers, or implement temporary workarounds

[Affected Scope] JBoss Seam 2 (jboss-seam2) framework as integrated in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux

[Impact] Remote attackers can execute arbitrary Java code and system commands via crafted URLs when the Java Security Manager is not properly configured

[Mitigation] Upgrade to the patched version of JBoss Seam/EAP, enable the Java Security Manager, and implement strict input validation filters

[Affected Scope] Oracle Java SE and Java for Business 6 Update 18 and earlier, 5.0 Update 23 and earlier, and 1.4.2_25 and earlier

[Impact] Remote attackers can completely bypass Java sandbox restrictions and execute arbitrary code with the privileges of the running process, compromising confidentiality, integrity, and availability

[Mitigation] Immediately upgrade to the latest patched Java SE versions, disable Java browser plugins, and decommission unsupported legacy JRE environments

[Affected Scope] Microsoft Internet Explorer 6, 6 SP1, and 7.

[Impact] Remote attackers can execute arbitrary code with the privileges of the logged-in user by enticing them to visit a specially crafted webpage.

[Mitigation] Apply the official Microsoft security updates, or implement workarounds such as setting the ActiveX Kill-Bit for the affected CLSID.