Multiple vulnerabilities in Adobe Flash Player could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free error. Adobe is aware of reports that an exploit for CVE-2015-0310 exists in the wild, which is being used in attacks against older versions of Flash Player.

GNU glibc is vulnerable to a heap-based buffer overflow, caused by an incorrect buffer size computation by the __nss_hostname_digits.

There is a vulnerability in the way that a Microsoft Windows library (OleAut32.dll) resizes certain array objects which can lead to remote compromise for users of Internet Explorer and Microsoft Excel.

Microsoft has issued security advisory 3010060 to identify a vulnerability in OLE that could allow remote code execution. This vulnerability, CVE-2014-6352, is present in all supported versions of Microsoft Windows, excluding Windows Server 2003.

This particular vulnerability is in the Microsoft Windows OLE package manager.  One of the common exploit paths witnessed is delivered via in a Powerpoint Show file (the .PPTS extension) and renders objects outside the viewable area capable to execute arbitrary code on an impacted system (Windows 2012 Server, Windows Vista, Windows 7 and Windows 8).

GNU Bash could allow a remote attacker to execute arbitrary commands on the system, caused by a vulnerability in code evaluating specially crafted environment variables. An attacker could exploit this vulnerability to inject and execute arbitrary shell commands on the system. IBM X-Force is aware internet wide scanning and exploitation attempts targeting this vulnerability.

There is a vulnerability in the way Apache Struts 2 cookieinterceptor disallows certaincookie names that can allow an attacker to manipulate session and requestrelated attributes.

A memory corruption vulnerability exists in Microsoft Internet Explorer 6, 7, 8, 9, 10 and 11 and can lead to remote code execution.  Exploitation of this vulnerability has been observed in targeted attacks, such as “Operation Clandestine Fox.”

A vulnerability in Apache Struts, can allow an attacker to send HTTP requests and achieve remote code execution on the server, i.e. the attacker attains the privilege of running any code in the environment that the web server is running. A proof-of-concept (PoC) exploit has been found to be available in the public domain.

A serious vulnerability in the popular open source cryptographic library OpenSSL has been disclosed and Proof-of-Concept (POC) exploit code is publicly available. This affects deployments using 1.0.1 and 1.0.2-beta releases with TLS heartbeat extension enabled. Successful exploitation allows an attacker to remotely read system memory contents without even needing to log on to the server. It is highly advised to update all the affected products as soon as a patch for the particular product is available and to proactively get updates from the affected vendors.