CVSS: 6.9EPSS: 0%CPEs: 1EXPL: 0CVE-2010-5226
https://notcve.org/view.php?id=CVE-2010-5226
Multiple untrusted search path vulnerabilities in Autodesk Design Review 2011 11.0.0.86 allow local users to gain privileges via a Trojan horse (1) dwmapi.dll, (2) whiptk_wt.7.12.601.dll, or (3) xaml_wt.7.6.0.dll file in the current working directory, as demonstrated by a directory that contains a .dwf file. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Múltiples vulnerabilidades de ruta de búsqueda no confiable en Autodesk Design Review 2011 11.0.0.86 permite a usuarios locales obtener privilegios a través de un troyano (1) dwmapi.dll, whiptk_wt.7.12.601.dll (2), o xaml_wt.7.6.0 (3) . dll en el directorio de trabajo actual, como lo demuestra un directorio que contiene un archivo. dwf. NOTA: el origen de esta información es desconocida, los datos se obtienen exclusivamente a partir de información de terceros. • http://secunia.com/advisories/41013 •
CVSS: 9.3EPSS: 3%CPEs: 8EXPL: 1CVE-2009-3578 – Autodesk Maya Script - Nodes Arbitrary Command Execution
https://notcve.org/view.php?id=CVE-2009-3578
Autodesk Maya 8.0, 8.5, 2008, 2009, and 2010 and Alias Wavefront Maya 6.5 and 7.0 allow remote attackers to execute arbitrary code via a (1) .ma or (2) .mb file that uses the Maya Embedded Language (MEL) python command or unspecified other MEL commands, related to "Script Nodes." Autodesk Maya v8.0, v8.5, v2008, v2009, y v2010 y Alias Wavefront Maya v6.5 y v7.0 permite a atacantes remotos ejecutar código de su elección a través de archvio (1) .ma o (2) .mb que usa comando python de Maya Embedded Language (MEL) u otros comandos MEL no especificados, relacionado con (Script Nodes). • https://www.exploit-db.com/exploits/10213 http://securitytracker.com/id?1023228 http://www.coresecurity.com/content/maya-arbitrary-command-execution http://www.securityfocus.com/archive/1/508013/100/0/threaded http://www.securityfocus.com/bid/36636 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.3EPSS: 3%CPEs: 7EXPL: 3CVE-2009-3577 – Autodesk 3ds - Max Application Callbacks Arbitrary Command Execution
https://notcve.org/view.php?id=CVE-2009-3577
Autodesk 3D Studio Max (3DSMax) 6 through 9 and 2008 through 2010 allows remote attackers to execute arbitrary code via a .max file with a MAXScript statement that calls the DOSCommand method, related to "application callbacks." Autodesk 3D Studio Max (3DSMax) v6 hasta v9 y v2008 hasta v2010 permite a atacantes remotos ejecutar código de su elección a través de un archivo .max con una sentencia MAXScript que llama al método DOSCommand, relacionado con "application callbacks." • https://www.exploit-db.com/exploits/33272 http://securitytracker.com/id?1023230 http://www.coresecurity.com/content/3dsmax-arbitrary-command-execution http://www.securityfocus.com/archive/1/508012/100/0/threaded http://www.securityfocus.com/bid/36634 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.3EPSS: 2%CPEs: 2EXPL: 3CVE-2009-3576 – Autodesk SoftImage Scene TOC - Arbitrary Command Execution
https://notcve.org/view.php?id=CVE-2009-3576
Autodesk Softimage 7.x and Softimage XSI 6.x allow remote attackers to execute arbitrary JavaScript code via a scene package containing a Scene Table of Contents (aka .scntoc) file with a Script_Content element, as demonstrated by code that loads the WScript.Shell ActiveX control. Autodesk Softimage v7.x y Softimage XSI v6.x permite a atacantes remotos ejecutar código JavaScript de su elección a través de un paquete de escena que contiene un archivo Tabla de Contenidos de Escena (como .scntoc) con un elemento Script_Content, como queda demostrado por el código que carga el control ActiveX WScript.Shell. • https://www.exploit-db.com/exploits/10211 https://www.exploit-db.com/exploits/33273 http://securitytracker.com/id?1023229 http://www.coresecurity.com/content/softimage-arbitrary-command-execution http://www.securityfocus.com/archive/1/508011/100/0/threaded http://www.securityfocus.com/bid/36637 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.3EPSS: 1%CPEs: 3EXPL: 1CVE-2008-4472 – Autodesk DWF Viewer Control / LiveUpdate Module - Remote Code Execution
https://notcve.org/view.php?id=CVE-2008-4472
The UpdateEngine class in the LiveUpdate ActiveX control (LiveUpdate16.DLL 17.2.56), as used in Revit Architecture 2009 SP2 and Autodesk Design Review 2009, allows remote attackers to execute arbitrary programs via the second argument to the ApplyPatch method. La clase UpdateEngine en el control Active X LiveUpdate (LiveUpdate16.DLL 17.2.56), utilizado en Revit Architecture 2009 SP2 y Autodesk Design Review 2009, que permite a los atacantes remotos ejecutar arbitrariamente programas a través del segundo argumento del método ApplyPatch. • https://www.exploit-db.com/exploits/6630 http://images.autodesk.com/adsk/files/live_update_hotfix0.html http://retrogod.altervista.org/9sg_autodesk_revit_arch_2009_exploit.html http://securityreason.com/securityalert/4361 http://usa.autodesk.com/adsk/servlet/ps/dl/item?siteID=123112&id=12452198&linkID=11705366 http://www.securityfocus.com/archive/1/496847/100/0/threaded http://www.securityfocus.com/bid/31490 http://www.vupen.com/english/advisories/2008/2704 https://exchange.xforce. • CWE-264: Permissions, Privileges, and Access Controls •