CVSS: 9.3EPSS: 95%CPEs: 21EXPL: 0CVE-2012-1891 – Microsoft Internet Explorer MSADO CacheSize Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2012-1891
Heap-based buffer overflow in Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2 and Windows Data Access Components (WDAC) 6.0 allows remote attackers to execute arbitrary code via crafted XML data that triggers access to an uninitialized object in memory, aka "ADO Cachesize Heap Overflow RCE Vulnerability." Desbordamiento de búfer basado en memoria dinámica en Microsoft Data Access Components (MDAC) v2.8 SP1 y SP2 y Windows Data Access Components (WDAC) v6.0, permite a atacantes remotos ejecutar código arbitrario a través de datos XML manipulados que desencadenan el acceso a un objeto no inicializado en la memoria, también conocido como "ADO Cachesize Heap Overflow RCE Vulnerability." This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the MSADO component. When handling the a user specified CacheSize property the process uses this value to calculate the 'real' cache size. • http://www.us-cert.gov/cas/techalerts/TA12-192A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-045 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14783 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 95%CPEs: 18EXPL: 1CVE-2011-0027 – Microsoft Internet Explorer MSADO CacheSize Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2011-0027
Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2, and Windows Data Access Components (WDAC) 6.0, does not properly validate memory allocation for internal data structures, which allows remote attackers to execute arbitrary code, possibly via a large CacheSize property that triggers an integer wrap and a buffer overflow, aka "ADO Record Memory Vulnerability." NOTE: this might be a duplicate of CVE-2010-1117 or CVE-2010-1118. Microsoft Data Access Components (MDAC) versión 2.8 SP1 y SP2 y Windows Data Access Components (WDAC) versión 6.0 no valida apropiadamente la asignación de memoria para las estructuras de datos internas, lo que permite a los atacantes remotos ejecutar código arbitrario, posiblemente por medio de una propiedad CacheSize larga que desencadena un ajuste de enteros y un desbordamiento del búfer, también se conoce como "ADO Record Memory Vulnerability" Nota: este CVE podría ser un duplicado de CVE-2010-1117 o CVE-2010-1118. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. This vulnerability was submitted to the ZDI via at the annual Pwn2Own competition at CanSecWest. • https://www.exploit-db.com/exploits/15984 http://osvdb.org/70444 http://secunia.com/advisories/42804 http://support.avaya.com/css/P8/documents/100124846 http://vreugdenhilresearch.nl/ms11-002-pwn2own-heap-overflow http://www.securityfocus.com/bid/45698 http://www.securitytracker.com/id?1024947 http://www.us-cert.gov/cas/techalerts/TA11-011A.html http://www.vupen.com/english/advisories/2011/0075 http://www.zerodayinitiative.com/advisories/ZDI-11-002 https://docs.microsoft. • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 89%CPEs: 18EXPL: 0CVE-2011-0026 – Microsoft Data Access Components DSN Overflow Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2011-0026
Integer signedness error in the SQLConnectW function in an ODBC API (odbc32.dll) in Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2, and Windows Data Access Components (WDAC) 6.0, allows remote attackers to execute arbitrary code via a long string in the Data Source Name (DSN) and a crafted szDSN argument, which bypasses a signed comparison and leads to a buffer overflow, aka "DSN Overflow Vulnerability." Error en la propiedad signedness de enteros en la función SQLConnectW en una API de ODBC (odbc32.dll) en Microsoft Data Access Components (MDAC) versión 2.8 SP1 y SP2, y Windows Data Access Components (WDAC) versión 6.0, permite a los atacantes remotos ejecutar código arbitrario por medio de una cadena larga en el Nombre de Origen de Datos (DSN) y un argumento szDSN creado, que omite una comparación firmada y conduce a un desbordamiento del búfer, también se conoce como "DSN Overflow Vulnerability". This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Microsoft Data Access Components. The vulnerability is present in an API call and as such successful exploitation will depend on an application's implementation of this call. The specific flaw exists within the SQLConnectW call in the odbc32.dll component. When calculating the size of a user provided szDSN, the result of a call to lstrlenW is used in a signed comparison to SQL_MAX_DSN_LENGTH to verify the destination buffer size. • http://osvdb.org/70443 http://secunia.com/advisories/42804 http://support.avaya.com/css/P8/documents/100124846 http://www.securityfocus.com/bid/45695 http://www.securitytracker.com/id?1024947 http://www.us-cert.gov/cas/techalerts/TA11-011A.html http://www.vupen.com/english/advisories/2011/0075 http://www.zerodayinitiative.com/advisories/ZDI-11-001 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-002 https://oval.cisecurity.org/repository/search/def • CWE-189: Numeric Errors •
CVSS: 9.3EPSS: 96%CPEs: 13EXPL: 3CVE-2006-5559 – Microsoft Internet Explorer - ADODB Execute Denial of Service (PoC)
https://notcve.org/view.php?id=CVE-2006-5559
The Execute method in the ADODB.Connection 2.7 and 2.8 ActiveX control objects (ADODB.Connection.2.7 and ADODB.Connection.2.8) in the Microsoft Data Access Components (MDAC) 2.5 SP3, 2.7 SP1, 2.8, and 2.8 SP1 does not properly track freed memory when the second argument is a BSTR, which allows remote attackers to cause a denial of service (Internet Explorer crash) and possibly execute arbitrary code via certain strings in the second and third arguments. El objeto de control ActiveX ADODB.Connection 2.7 (ADODB.Connection.2.7) permite a atacantes remotos provocar una denegación de servicio (caída de Internet Explorer) mediante argumentos largos para la función Execute. • https://www.exploit-db.com/exploits/2629 http://blogs.technet.com/msrc/archive/2006/10/27/adodb-connection-poc-published.aspx http://research.eeye.com/html/alerts/zeroday/20061027.html http://secunia.com/advisories/22452 http://securitytracker.com/id?1017127 http://www.kb.cert.org/vuls/id/589272 http://www.osvdb.org/31882 http://www.securityfocus.com/bid/20704 http://www.us-cert.gov/cas/techalerts/TA07-044A.html http://www.vupen.com/english/advisories/2007/0578 • CWE-20: Improper Input Validation •
CVSS: 5.1EPSS: 96%CPEs: 6EXPL: 3CVE-2006-0003 – Microsoft Internet Explorer - 'MDAC' Remote Code Execution (MS06-014)
https://notcve.org/view.php?id=CVE-2006-0003
Unspecified vulnerability in the RDS.Dataspace ActiveX control, which is contained in ActiveX Data Objects (ADO) and distributed in Microsoft Data Access Components (MDAC) 2.7 and 2.8, allows remote attackers to execute arbitrary code via unknown attack vectors. • https://www.exploit-db.com/exploits/2164 https://www.exploit-db.com/exploits/16561 https://www.exploit-db.com/exploits/2052 http://secunia.com/advisories/19583 http://secunia.com/advisories/20719 http://securitytracker.com/id?1015894 http://www.hitachi-support.com/security_e/vuls_e/HS06-013_e/01-e.html http://www.hitachi-support.com/security_e/vuls_e/HS06-013_e/index-e.html http://www.kb.cert.org/vuls/id/234812 http://www.osvdb.org/24517 http:/ •