Dmitri Kaslov

Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial of service vulnerability caused by unbounded nesting depth when parsing SOAP/XML and JSON request bodies before authentication. Attackers can send a single deeply nested request to WebMail, WebAdmin, or WebMail Proxy listeners to exhaust the stack and crash SMTP, IMAP, POP3, and web services repeatedly.

A remote code execution issue exists due to the way the scripting engine handles objects in memory. This could allow an attacker to corrupt memory and execute arbitrary code in the context of the current user. If the user has administrative rights, the attacker could take control of the system, install programs, view or modify data, or create new accounts with full rights.

This issue allows remote attackers to execute arbitrary code on vulnerable installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The flaw exists within the parsing of U3D files due to the lack of proper initialization of a `pointer` prior to accessing it. An attacker can leverage this to execute code under the context of the current process.

This issue allows remote attackers to disclose sensitive information on vulnerable installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The flaw exists within the parsing of U3D files due to the lack of proper validation of user-supplied data, resulting in a read past the end of an allocated object. An attacker can leverage this, in conjunction with other issues, to execute code in the context of the current process.

Name of the Vulnerable Software and Affected Versions: Foxit Reader version 9.0.0.29935 Description: This issue allows remote attackers to execute arbitrary code on vulnerable installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The flaw exists within the parsing of PDF documents due to the lack of proper validation of user-supplied data, resulting in a type confusion condition. An attacker can leverage this to execute code under the context of the current process. Recommendations: For Foxit Reader version 9.0.0.29935, update to a version that addresses the PDF parsing type confusion issue to prevent remote code execution. As a temporary workaround, consider restricting the opening of PDF files from untrusted sources until a patch is available.

Name of the Vulnerable Software and Affected Versions: Microsoft Edge in Microsoft Windows 10 version 1703 Description: An information disclosure issue exists due to how Microsoft Edge handles objects in memory. This could allow an attacker to obtain information that could be used to further compromise the user's system. Recommendations: For Microsoft Edge in Microsoft Windows 10 version 1703, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to the improper handling of objects in memory by Microsoft Excel, which can be exploited by a remote attacker to execute arbitrary code in the context of the current user. This can lead to remote code execution.