Heige

A validation issue was addressed with improved input sanitization. Processing a maliciously crafted mail message may lead to running arbitrary javascript. The issue is related to insufficient input validation, which can be exploited by a remote attacker to impact data integrity.

The issue is related to incorrect code generation management in the Microsoft Jet Red Database Engine and Access Connectivity Engine of Microsoft Windows operating systems. It allows a remote attacker to execute arbitrary code.

An access issue was addressed with improved access restrictions. Processing a maliciously crafted document may lead to a cross site scripting attack.

Name of the Vulnerable Software and Affected Versions: Windows Jet Database Engine (affected versions not specified) Description: A remote code execution issue exists due to the improper handling of objects in memory by the Windows Jet Database Engine. This could allow an attacker to execute arbitrary code on a victim system by enticing the victim to open a specially crafted file. The issue is also described as a buffer overflow vulnerability in the Microsoft JET Database Engine. The vulnerability enables remote attackers to execute arbitrary code and affect the system. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue involves the `iBooks` component and allows attackers to conduct sandbox-escape attacks or cause a denial of service (memory corruption) via a crafted app.

The issue is related to the Messages component mishandling filename encoding, allowing remote attackers to obtain sensitive information. The exploitation of this issue can lead to unauthorized access to confidential data.

The issue is related to the ParametersInterceptor in Apache Struts, which does not properly restrict access to the getClass method. This allows remote attackers to manipulate the ClassLoader and execute arbitrary code via a crafted request. The vulnerability exists due to an incomplete fix for a previous issue. It is related to the implementation of the getClass method, which has access control deficiencies when using the ParametersInterceptor with the class parameter. Exploitation of this vulnerability can allow a remote attacker to execute arbitrary code by sending a specially crafted request.

The issue is related to the CookieInterceptor in Apache Struts, where an incomplete fix for a previous issue has led to a vulnerability. This vulnerability allows remote attackers to manipulate the ClassLoader and execute arbitrary code via a crafted request, due to insufficient access restrictions when handling wildcard cookiesName values. The exploitation requires the application to be configured to accept all cookies, allowing access to the class parameter directly mapped to the getClass() method.