Skip to content
OpenAdvisories

Weakness (CWE)

CWE-623: Unsafe ActiveX Control Marked Safe For Scripting

Variant Draft

The product includes an ActiveX control that is intended for restricted use, but the control has been marked as safe-for-scripting.

How to prevent it (2 mitigations)

  1. Architecture and Design

    During development, do not mark it as safe for scripting.

  2. System Configuration

    After distribution, you can set the kill bit for the control so that it is not accessible from Internet Explorer.

Source: MITRE CWE-623

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 8.7
    CVE-2011-10028 Public exploit

    RealNetworks Arcade Games StubbyUtil.ProcessMgr ActiveX Arbitrary Code Execution

    The RealNetworks RealArcade platform includes an ActiveX control (InstallerDlg.dll, version 2.6.0.445) that exposes a method named Exec via the StubbyUtil.ProcessMgr COM object. This method allows remote attackers to execute arbitrary commands on a victim's W…

    RealNetworks RealArcade ActiveX
  • Unscored —
    CVE-2018-17925

    Multiple instances of this vulnerability (Unsafe ActiveX Control Marked Safe For Scripting) have been identified in the…

    GE iFix
  • High 7.5
    CVE-2014-2368

    Advantech WebAccess Unsafe ActiveX Control Marked Safe For Scripting

    The BrowseFolder method in the bwocxrun ActiveX control in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a crafted call.

    Advantech WebAccess