CWE-623

Unsafe ActiveX Control Marked Safe For Scripting

VariantDraft

Description

An ActiveX control is intended for restricted use, but it has been marked as safe-for-scripting.

This might allow attackers to use dangerous functionality via a web page that accesses the control, which can lead to different resultant vulnerabilities, depending on the control's behavior.

Hierarchy (View 1000)

Parents

CWE-267

Children

none

CVEs mapped to this weakness (3)

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2011-10028	RealNetworks Realarcade Installer	Hig	0.60	—	0.01	Aug 20, 2025	The RealNetworks RealArcade platform includes an ActiveX control (InstallerDlg.dll, version 2.6.0.445) that exposes a method named Exec via the StubbyUtil.ProcessMgr COM object. This method allows remote attackers to execute arbitrary commands on a victim's Windows machine…
CVE-2018-17925	Ge Ifix	Med	0.31	4.8	0.00	Oct 10, 2018	Multiple instances of this vulnerability (Unsafe ActiveX Control Marked Safe For Scripting) have been identified in the third-party ActiveX object provided to GE iFIX versions 2.0 - 5.8 by Gigasoft. Only the independent use of the Gigasoft charting package outside the iFIX…
CVE-2014-2368	Advantech Webaccess		0.00	—	0.02	Jul 19, 2014	The BrowseFolder method in the bwocxrun ActiveX control in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a crafted call.

CVE-2011-10028HigAug 20, 2025
RealNetworks
Realarcade Installer
risk 0.60cvss —epss 0.01
The RealNetworks RealArcade platform includes an ActiveX control (InstallerDlg.dll, version 2.6.0.445) that exposes a method named Exec via the StubbyUtil.ProcessMgr COM object. This method allows remote attackers to execute arbitrary commands on a victim's Windows machine…
CVE-2018-17925MedOct 10, 2018
Ge
Ifix
risk 0.31cvss 4.8epss 0.00
Multiple instances of this vulnerability (Unsafe ActiveX Control Marked Safe For Scripting) have been identified in the third-party ActiveX object provided to GE iFIX versions 2.0 - 5.8 by Gigasoft. Only the independent use of the Gigasoft charting package outside the iFIX…
CVE-2014-2368Jul 19, 2014
Advantech
Webaccess
risk 0.00cvss —epss 0.02
The BrowseFolder method in the bwocxrun ActiveX control in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a crafted call.