[ERPSCAN-15-012] SAP Afaria 7 XComms – Buffer Overflow

ERPSCAN Research Advisory ERPSCAN-15-012 SAP Afaria 7 XComms – Buffer Overflow Application: SAP Afaria 7 Versions Affected: SAP Afaria 7, probably others Vendor URL: http://SAP.com Bugs: Buffer Overflow Sent: 13.03.2015 Reported: 14.03.2015 Vendor response: 14.03.2015 Date of Public Advisory:...

CVE-2015-4092

SAP Afaria 7.00.6620.2 SP5 contains a Buffer Overflow in the XComms process (CVE-2015-4092). ERPScan/SAP advisories describe that an anonymous attacker can remotely exploit a crafted request to crash the server’s XComms component and potentially execute code. Impact includes DoS and, in some disc...

CVE-2014-4092

Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-4098...

CVE-2014-4092

Microsoft Internet Explorer 8–11 contains multiple use-after-free memory corruption vulnerabilities (CTableCell, CTableOMRowCache, CGeneratedTreeNode) that can lead to remote code execution. Exploitation requires visiting a crafted or malicious page/file; attacker-controlled in-memory objects can...

Microsoft Internet Explorer Memory Corruption (MS14-052: CVE-2014-4092)

A remote code execution vulnerability has been reported in Microsoft Internet Explorer. The vulnerability is due to an error in the way that Internet Explorer accesses an object that has not been correctly initialized or has been deleted. A remote attacker can exploit this issue by enticing a use...

Microsoft Internet Explorer CVE-2014-4092 Remote Memory Corruption Vulnerability

Description Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted webpage. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in...

CVE-2011-4092

CVE-2011-4092 affects obby (aka libobby), where SSL server certificates are not verified. This allows remote attackers to spoof servers by presenting an arbitrary certificate. The connected sources reiterate that the underlying issue is the lack of server certificate verification, with no documen...

CVE-2012-4092

CVE-2012-4092 affects Cisco UCS Central Software’s management interface, where improper validation of vCenter console identities enables MITM-style interception—read/modify inter-device data streams. Root cause: identity spoofing between vCenter consoles and UCS Manager. Impact is partial confide...

CVE-2013-4092

The CVE-2013-4092 entry concerns Imperva SecureSphere SOM (Management Server) version 9.0.0.5. The issue enables context‑dependent attackers to obtain sensitive information by exploiting (1) a session ID in the jsessionid field to access secsphLogin.jsp or (2) credentials in the j_password parame...

CVE-2013-4092

The SecureSphere Operations Manager SOM Management Server in Imperva SecureSphere 9.0.0.5 allows context-dependent attackers to obtain sensitive information by leveraging the presence of 1 a session ID in the jsessionid field to secsphLogin.jsp or 2 credentials in the jpassword parameter to...

Adobe Shockwave Player Multiple Remote Code Execution Vulnerabilities - Feb 2011

This host is installed with Adobe Shockwave Player and is prone to multiple remote code execution vulnerabilities. OpenVAS Vulnerability Test $Id: gbadobeshockwaveplayermultcodeexecvulnfeb11.nasl 5424 2017-02-25 16:52:36Z teissa $ Adobe Shockwave Player Multiple Remote Code Execution...

Security update available for Shockwave Player

Security update available for Shockwave Player Release date: February 8, 2011 Vulnerability identifier: APSB11-01 CVE number: CVE-2010-2587, CVE-2010-2588, CVE-2010-2589, CVE-2010-4092, CVE-2010-4093, CVE-2010-4187, CVE-2010-4188, CVE-2010-4189, CVE-2010-4190, CVE-2010-4191, CVE-2010-4192,...

Shockwave Player < 11.5.9.620 (APSB11-01)

The remote Windows host contains a version of Adobe's Shockwave Player that is earlier than 11.5.9.620. Such versions are potentially affected by the following issues : - Several unspecified errors exist in the 'dirapi.dll' module that may allow arbitrary code execution. CVE-2010-2587,...

CVE-2010-4092

Adobe Shockwave Player contains a Use-After-Free vulnerability (CVE-2010-4092) in an unspecified compatibility component related to the Settings window and an unloaded library. Affected software is Shockwave Player before version 11.5.9.620. The issue allows user-assisted remote code execution wh...

CVE-2009-4092

The CVE-2009-4092 entry describes a Cross-site request forgery (CSRF) vulnerability in Simplog 0.9.3.2 (and possibly earlier) affecting the user.php component. The underlying issue enables remote attackers to hijack the authentication of administrators and users to perform password-change request...

CVE-2009-4092

Cross-site request forgery CSRF vulnerability in user.php in Simplog 0.9.3.2, and possibly earlier, allows remote attackers to hijack the authentication of administrators and users for requests that change passwords...

Apple QuickTime and iTunes Movie File Heap Memory Corruption (CVE-2005-4092)

Apple QuickTime is a multimedia player that supports a wide range of media formats. The QuickTime product is also installed as a component with the Apple iTunes product. The software supports parsing and displaying picture files as well as numerous video formats. QuickTime is capable of processin...

CVE-2008-4092

SQL injection vulnerability in printfeature.php in myPHPNuke MPN before 1.8.88rc2 allows remote attackers to execute arbitrary SQL commands via the artid parameter...

CVE-2008-4092

The CVE-2008-4092 issue affects myPHPNuke (MPN) before version 1.8.8_8rc2, where a SQL injection vulnerability in printfeature.php allows remote attackers to execute arbitrary SQL commands via the artid parameter. The vulnerability arises in the handling of artid, permitting exploitation without ...

openSUSE 10 Security Update : gvim (gvim-4092)

This update of Vim addresses a format-string bug in 'helptags'. This bug can be exploited to execute code with the privileges of the user running Vim. CVE-2007-2953 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...