CVE-2017-0152
HighSummary
CVE-2017-0152 is a remote code execution vulnerability in the Microsoft scripting engine that improperly handles objects in memory in Microsoft browsers. An attacker could exploit this vulnerability to execute arbitrary code in the context of the current user.
Risk Assessment
Exploitation of this vulnerability could allow an attacker to gain the same user rights as the current user, posing a significant security risk to the system.
Recommendation
It is recommended to update Microsoft browsers to the latest version and implement appropriate security measures to minimize the risk of exploitation.
Related vulnerabilities
- CVE-2026-93352Critical
Laravel-Mediable versions 7.0.0 to 7.0.2 contain an incomplete patch for CVE-2026-49972 — the .pht extension is missing from the forbidden_extensions blocklist in config/mediable.php. Apache on Debian and Ubuntu executes .pht files as PHP, allowing an attacker to upload a malicious file and achieve remote code execution.
- CVE-2026-6928Critical
IBM Concert versions 1.0.0 through 3.0.0 references or accesses memory after it has been freed (use-after-free). An attacker who can influence program execution or input may exploit this condition to corrupt memory, cause application crashes, or execute arbitrary code.
- CVE-2026-6730Critical
IBM Concert versions 1.0.0 through 3.0.0 is vulnerable to a buffer overflow caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system.
- CVE-2026-6721Critical
IBM Concert versions 1.0.0 through 3.0.0 allows an unauthenticated remote attacker to supply specially crafted input that is incorporated into OS commands, resulting in arbitrary command execution. Successful exploitation allows remote code execution with the privileges of the affected application.
- CVE-2026-67404Critical
RabbitMQ prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 — when no CA bundle is available, ssl_options/1 falls back to [{verify, verify_none}] with no warning. An attacker in a man-in-the-middle position can forge the JWKS response, leading the broker to accept arbitrary JWTs.
- CVE-2026-67231Critical
RabbitMQ prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 — the trust-store plugin installs a verify_fun that overrides {bad_cert, unknown_ca} / {bad_cert, selfsigned_peer} when the presented cert "matches" a whitelisted one. The match key relies solely on issuer name and serial number, which can be easily forged, allowing TLS client authentication bypass.
- CVE-2026-87900Critical
WP Toolkit for cPanel versions 6.11.2-10794 and earlier contains an argument injection vulnerability that allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts.
- CVE-2026-87899Critical
cPanel contains an execution with unnecessary privileges vulnerability that allows remote authenticated users to execute arbitrary code with root privileges.
- CVE-2026-87898Critical
OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.
- CVE-2026-84719Critical
A flaw in the Ansible Automation Platform automation-controller: when copying a WorkflowJobTemplate, the deep-copy permission sanitizer validates only inventory, unified_job_template, and credentials of each cloned node and fails to check instance_groups (and execution_environment and labels) preserved from the original. A user with organization workflow-admin permission but no role on the referenced instance groups can copy a workflow, become its administrator, and launch jobs pinned to instance groups they are not authorized to use — including the control-plane instance group — bypassing the InstanceGroup use_role boundary and causing attacker-influenced automation to run in the control-plane execution context.
Original NVD description (English source)
A remote code execution vulnerability exists in the way affected Microsoft scripting engine render when handling objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user, aka "Scripting Engine Memory Corruption Vulnerability."