The specific flaw exists within processing of the AddStringUserProperty method within the UCCDRAW.UCCDrawCtrl.1 ActiveX control of UCanCode E-XD Visualization Enterprise Suite. The process does not properly validate a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to execute arbitrary code under the context of the current process. This module runs a web server waiting for vulnerable clients (Internet Explorer 6, 7, 8) to connect to it.

This module exploits a vulnerability in Sparklabs Viscosity. By abusing a configuration channel between the application and the underlying service, an attacker can trigger the loading of a DLL from a path under his control, gaining SYSTEM privileges.

This module exploits a vulnerability in the IRemUnknown2 COM interface, an attacker can abuse the fact that the local unmarshaled proxy can be for a different interface to that requested by QueryInterface resulting in a type confusion, which can be leveraged to elevate privileges.

This module exploits an exceptional condition in "lsasrv.dll" by sending a crafted "Session Setup Request" SMBv1 or SMBv2 packet that is affected during the NTML Auth message.

Sync Breeze Enterprise is prone to a buffer-overflow vulnerability when handling a crafted GET request, this can trigger an overflow in a finite-sized internal memory buffer, and install an agent with SYSTEM privileges.

HP Intelligent Management Center is prone to a remote vulnerability that allows attackers to execute commands under the context of system.

The vulnerability exists within the WdMacCtl ActiveX control This module runs a web server waiting for vulnerable clients (Internet Explorer 8) to connect to it.

This module exploits a vulnerability on target via a SMB crafted packet.

DiskBoss server is prone to a buffer-overflow vulnerability when handling a crafted GET request, this can trigger an overflow in a finite-sized internal memory buffer, and install an agent with SYSTEM privileges.

An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java object to the Jenkins CLI, making Jenkins connect to an attacker-controlled LDAP server, which in turn can send a serialized payload leading to code execution, bypassing existing protection mechanisms. This can be exploited by malicious local attackers to gain SYSTEM privileges on Windows targets.