Weakness (CWE)
CWE-623: Unsafe ActiveX Control Marked Safe For Scripting
Variant Draft
The product includes an ActiveX control that is intended for restricted use, but the control has been marked as safe-for-scripting.
How to prevent it (2 mitigations)
-
Architecture and Design
During development, do not mark it as safe for scripting.
-
System Configuration
After distribution, you can set the kill bit for the control so that it is not accessible from Internet Explorer.
Source: MITRE CWE-623
1 result · Clear filters · Feed
-
High 8.7CVE-2011-10028 Public exploit
RealNetworks Arcade Games StubbyUtil.ProcessMgr ActiveX Arbitrary Code Execution
The RealNetworks RealArcade platform includes an ActiveX control (InstallerDlg.dll, version 2.6.0.445) that exposes a method named Exec via the StubbyUtil.ProcessMgr COM object. This method allows remote attackers to execute arbitrary commands on a victim's W…