Microsoft Activex vulnerabilities

5 CVEs affecting Microsoft Activex, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2008-0078, published 2008-02-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2008-0437, published 2008-01-23. High severity, CVSS 10.0. EPSS: 58.1% chance of exploitation in the next 30 days. Multiple buffer overflows in the WebHPVCInstall.HPVirtualRooms14 ActiveX control in HPVirtualRooms14.dll 1.0.0.100, as used in the installation process for HP Virtual Rooms, allow remote attackers to…
CVE-2007-6387, published 2007-12-15. High severity, CVSS 9.3. EPSS: 38% chance of exploitation in the next 30 days. Multiple stack-based buffer overflows in the awApi4.AnswerWorks.1 ActiveX control in awApi4.dll 4.0.0.42, as used by Vantage Linguistics AnswerWorks, and Intuit Clearly Bookkeeping, ProSeries,…
CVE-2008-0470, published 2008-01-29. High severity, CVSS 9.3. EPSS: 30.9% chance of exploitation in the next 30 days. A certain ActiveX control in Comodo AntiVirus 2.0 allows remote attackers to execute arbitrary commands via the ExecuteStr method.
CVE-2008-0551, published 2008-02-01. High severity, CVSS 9.3. EPSS: 29.7% chance of exploitation in the next 30 days. The NamoInstaller.NamoInstall.1 ActiveX control in NamoInstaller.dll 3.0.0.1 and earlier in Namo Web Editor in Sejoong Namo ActiveSquare 6 allows remote attackers to execute arbitrary code via a URL…
CVE-2008-0078, published 2008-02-12. High severity, CVSS 9.3. EPSS: 29.1% chance of exploitation in the next 30 days. Unspecified vulnerability in an ActiveX control (dxtmsft.dll) in Microsoft Internet Explorer 5.01, 6 SP1 and SP2, and 7 allows remote attackers to execute arbitrary code via a crafted image, aka…