Exposed Unsafe ActiveX Method
CWE-618
An ActiveX control is intended for use in a web browser, but it exposes dangerous methods that perform actions that are outside of the browser's security model (e.g. the zone or domain).
We track 1 vulnerability of this type. 100% are rated high or critical, and the average CVSS score is 8.0.
How this weakness is prevented
- Implementation: If you must expose a method, make sure to perform input validation on all arguments, and protect against all possible vulnerabilities.
- Architecture and Design: Use code signing, although this does not protect against any weaknesses that are already in the control.
- Architecture and Design System Configuration: Where possible, avoid marking the control as safe for scripting.
Latest Exposed Unsafe ActiveX Method vulnerabilities
- 8.0 High severity
GlobalProtect App: Exposed Unsafe ActiveX Method
A vulnerability in the Palo Alto Networks GlobalProtect app on Windows allows a remote attacker to run ActiveX controls within the context of an authenticated Windows user. This enables the attacker to run commands as if they are a legitimate authenticated use