9.3

CVE-2011-2386

Exploit
VisiWaveReport.exe in AZO Technologies, Inc. VisiWave Site Survey before 2.1.9 allows user-assisted remote attackers to execute arbitrary code via a (1) vws and (2) vwr file with an invalid Type property, which triggers an untrusted pointer dereference.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Visiwave ≫ Site Survey Version <= 2.1
Visiwave ≫ Site Survey Version1.6.12
Visiwave ≫ Site Survey Version2.0.12
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 45.22% 0.986
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

http://osvdb.org/72464
http://secunia.com/advisories/44636
Vendor Advisory
http://www.exploit-db.com/exploits/17317
Exploit
http://www.securityfocus.com/bid/47948
Exploit
http://www.stratsec.net/Research/Advisories/VisiWave-Site-Survey-Report-Trusted-Pointer-%28SS-20
Exploit
http://www.visiwave.com/blog/index.php?/archives/4-Version-2.1.9-Released.html
Vendor Advisory