Tecr0C

Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

External control of file name or path in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

A Type Confusion issue exists where an attacker can use specially crafted `.ctl` files to achieve arbitrary code execution. Type Confusion occurs when a program accesses a resource using a type that is different from the type it was originally allocated with, leading to unexpected behavior.

A flaw exists in the parsing of PDF files within Soda PDF Desktop, resulting from insufficient validation of user-supplied data. This can lead to a write past the end of an allocated buffer, potentially allowing a remote attacker to execute code in the context of the current process. User interaction is required, such as visiting a malicious page or opening a malicious file, to trigger the issue.

A flaw exists in the parsing of PDF files within Soda PDF Desktop due to insufficient validation of user-supplied data. This can lead to a read past the end of an allocated object, potentially disclosing sensitive information. User interaction is required, such as visiting a malicious page or opening a malicious file, to trigger this issue. An attacker could potentially leverage this in combination with other issues to execute arbitrary code within the current process.

A flaw exists in the parsing of PDF files within Soda PDF Desktop, stemming from insufficient validation of user-supplied data. This can lead to a read past the end of an allocated object, potentially disclosing sensitive information. User interaction is required, specifically the target must open a malicious file or visit a malicious page. An attacker could potentially leverage this issue, in combination with other flaws, to execute arbitrary code within the current process.

A flaw exists in the parsing of PDF files within Soda PDF Desktop. The issue stems from insufficient validation of user-supplied data, potentially leading to a read past the end of an allocated object. An attacker could leverage this, potentially in combination with other issues, to disclose sensitive information. User interaction is required, such as visiting a malicious page or opening a malicious file, to trigger the issue.

A memory corruption issue exists in the PDF file parsing functionality of Soda PDF Desktop, potentially leading to information disclosure. The issue was discovered by Rocco Calvi (@TecR0c) of TecSecurity.

This issue allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this, as the target must visit a malicious page or open a malicious file. The flaw exists within the parsing of XE files due to a lack of proper validation of user-supplied data, resulting in a read past the end of an allocated data structure. An attacker can leverage this to execute code in the context of the current process.

This issue allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this issue, specifically, the target must visit a malicious page or open a malicious file. The flaw exists within the parsing of LI files due to a lack of validation of object existence prior to operations being performed on the object. An attacker can leverage this to execute code in the context of the current process.

This issue allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this, as the target must visit a malicious page or open a malicious file. The flaw exists within the parsing of CO files due to a lack of proper validation of user-supplied data, resulting in a read past the end of an allocated data structure. An attacker can leverage this to execute code in the context of the current process.

A type confusion flaw exists in the parsing of CO files within Ashlar-Vellum Cobalt. The lack of proper validation of user-supplied data can allow remote attackers to execute arbitrary code in the context of the current process. User interaction is required to exploit this issue, such as visiting a malicious page or opening a malicious file.

This issue allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this, as the target must visit a malicious page or open a malicious file. The flaw resides within the parsing of XE files due to a lack of proper validation of user-supplied data, resulting in a read past the end of an allocated data structure. An attacker can leverage this to execute code in the context of the current process.

Ashlar-Vellum Cobalt is susceptible to a type confusion vulnerability in its AR file parsing functionality. This issue can lead to remote code execution.

A type confusion vulnerability exists in the parsing of CO files within Ashlar-Vellum Cobalt. This flaw stems from insufficient validation of user-supplied data, potentially allowing remote attackers to execute arbitrary code. User interaction is required, such as visiting a malicious page or opening a malicious file, to trigger the vulnerability.

This issue allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this flaw, as the target must visit a malicious page or open a malicious file. The vulnerability stems from insufficient validation of user-supplied data during the parsing of AR files, leading to a read past the end of an allocated data structure. An attacker can exploit this to execute code within the context of the current process.

This issue allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this, as the target must visit a malicious page or open a malicious file. The flaw resides within the parsing of XE files due to a lack of proper validation of user-supplied data, resulting in a read before the start of an allocated data structure. An attacker can leverage this to execute code in the context of the current process.

This issue allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this issue, as the target must visit a malicious page or open a malicious file. The flaw exists within the parsing of CO files due to a lack of proper validation of user-supplied data, resulting in a write past the end of an allocated data structure. An attacker can leverage this to execute code in the context of the current process.

This issue allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this issue, as the target must visit a malicious page or open a malicious file. The flaw resides within the parsing of CO files, resulting from insufficient validation of user-supplied data, leading to a memory corruption condition. An attacker can leverage this to execute code in the context of the current process.

This issue allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this, as the target must visit a malicious page or open a malicious file. The flaw resides within the parsing of AR files due to a lack of proper validation of user-supplied data, leading to a write past the end of an allocated data structure. An attacker can leverage this to execute code in the context of the current process.