CVE-2005-3650

The CodeSupport.ocx ActiveX control, as used by Sony to uninstall the First4Internet XCP DRM, has "safe for scripting" enabled, which allows remote attackers to execute arbitrary code by calling vulnerable functions such as RebootMachine, IsAdministrator, and ExecuteCode.

• CWE-94

• http://hack.fi/~muzzy/sony-drm/
• http://secunia.com/advisories/17610Vendor Advisory
• http://www.freedom-to-tinker.com/?p=927
• http://www.kb.cert.org/vuls/id/312073Third Party Advisory, US Government Resource
• http://www.osvdb.org/20887
• http://www.securityfocus.com/bid/15430
• http://www.vupen.com/english/advisories/2005/2454Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23063
• http://hack.fi/~muzzy/sony-drm/
• http://secunia.com/advisories/17610Vendor Advisory
• http://www.freedom-to-tinker.com/?p=927
• http://www.kb.cert.org/vuls/id/312073Third Party Advisory, US Government Resource
• http://www.osvdb.org/20887
• http://www.securityfocus.com/bid/15430
• http://www.vupen.com/english/advisories/2005/2454Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23063

Published

Nov 17, 2005

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2005-3644PNP_GetDeviceList (upnp_getdevicelist) in UPnP for Microsoft…
• CVE-2005-3645phpAdsNew and phpPgAds 2.0.6 and possibly earlier versions a…
• CVE-2005-3646Multiple SQL injection vulnerabilities in lib-sessions.inc.p…
• CVE-2005-3647Folder Guard allows local users to bypass protections by run…
• CVE-2005-3648Multiple SQL injection vulnerabilities in the get_record fun…
• CVE-2005-3649jumpto.php in Moodle 1.5.2 allows remote attackers to redire…
• CVE-2005-3651Stack-based buffer overflow in the dissect_ospf_v3_address_p…
• CVE-2005-3652Heap-based buffer overflow in Citrix Program Neighborhood cl…
• CVE-2005-3653Heap-based buffer overflow in the iGateway service for vario…
• CVE-2005-3654Blue Coat Systems Inc. WinProxy before 6.1a allows remote at…
• CVE-2005-3655Heap-based buffer overflow in Novell Open Enterprise Server …
• CVE-2005-3656Multiple format string vulnerabilities in logging functions …