Skip to content
OpenAdvisories

Weakness (CWE)

CWE-618: Exposed Unsafe ActiveX Method

Variant Incomplete

An ActiveX control is intended for use in a web browser, but it exposes dangerous methods that perform actions that are outside of the browser's security model (e.g. the zone or domain).

How to prevent it (3 mitigations)

  1. Implementation

    If you must expose a method, make sure to perform input validation on all arguments, and protect against all possible vulnerabilities.

  2. Architecture and Design

    Use code signing, although this does not protect against any weaknesses that are already in the control.

  3. Architecture and Design, System Configuration

    Where possible, avoid marking the control as safe for scripting.

Source: MITRE CWE-618

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 6.8
    CVE-2026-97400

    jdmpview / DTFJ reads arbitrary local files and makes arbitrary outbound requests when opening a third-party diagnostic dump bundle (XXE in XMLIndexReader)

    In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary rem…

    Eclipse Foundation Eclipse OpenJ9
  • Medium 6.0
    CVE-2025-0118

    GlobalProtect App: Execution of Unsafe ActiveX Control Vulnerability

    A vulnerability in the Palo Alto Networks GlobalProtect app on Windows allows a remote attacker to run ActiveX controls within the context of an authenticated Windows user. This enables the attacker to run commands as if they are a legitimate authenticated us…

    Palo Alto Networks GlobalProtect App GlobalProtect UWP App Network devices