CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Microsoft Windows XMLDOM ActiveX Control Information Disclosure Vulnerability (CVE-2013-7331)
[Affected Scope] Microsoft.XMLDOM ActiveX control and Internet Explorer on Microsoft Windows 8.1 and earlier
[Impact] Remote attackers can determine the existence of local pathnames, UNC shares, intranet hostnames, and IP addresses via error code analysis
[Mitigation] Apply the MS14-052 cumulative security update or restrict ActiveX execution in Internet Explorer
Microsoft Internet Explorer ActiveX Control (icardie.dll) Out-of-Bounds Write Remote Code Execution Vulnerability (CVE-2013-3918)
[Affected Scope] Internet Explorer and the icardie.dll ActiveX control running on Windows XP, Vista, 7, 8, 8.1, and Windows Server 2003, 2008, 2012
[Impact] Remote attackers can execute arbitrary code or cause a denial of service (system crash) by enticing users to visit a specially crafted malicious web page
[Mitigation] Apply the official Microsoft MS13-090 security patch or configure the ActiveX Kill Bit for the icardie.dll control via the registry
Microsoft Windows Video ActiveX Control (msvidctl.dll) Stack Buffer Overflow Remote Code Execution Vulnerability (CVE-2008-0015)
[Affected Scope] Systems running Microsoft Windows 2000 SP4, XP SP2/SP3, Server 2003 SP2, Vista, and Server 2008 utilizing the MPEG2TuneRequest ActiveX control (msvidctl.dll)
[Impact] Remote attackers can execute arbitrary code with the privileges of the logged-in user by enticing them to visit a specially crafted malicious web page
[Mitigation] Apply the official Microsoft security updates (MS09-037) or configure the ActiveX Kill Bit in the Windows Registry to disable the vulnerable control