CVE-2007-1723: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the administration console in Secure Computing CipherTrust IronMail 6.1.1 allow remote attackers to inject arbitrary web script or HTML via the 1 network, 2 defRouterIp, 3 hostName, 4 domainName, 5 ipAddress, 6 defaultRouter, 7 dns1, or 8 dns2...

SIAADV-07-004-EN.txt

=============================== - Advisory - =============================== Título: Multipls XSS in Cypherstrust Ironmail 6.1.1 Risk: Medium Date: 20.Feb.2007 Author: Javier Olascoaga WEB: http://www.514.es/ .: INTRO :. IronMail protects enterprise email systems from inbound threats: spam,...

Multiple XSS in IronMail

=============================== - Advisory - =============================== Tнtulo: Multipls XSS in Cypherstrust Ironmail 6.1.1 Risk: Medium Date: 20.Feb.2007 Author: Javier Olascoaga jolascoaga at 514.es WEB: http://www.514.es/ .: INTRO :. IronMail protects enterprise email systems from inbound...

Trend Micro OfficeScan client ActiveX control buffer overflow

Added: 02/21/2007 CVE: CVE-2007-0325 BID: 22585 OSVDB: 33040 Background Trend Micro OfficeScan is a centralized virus and security scan management system. Problem The OfficeScan Web-Deployment SetupINICtrl ActiveX control, which is vulnerable to buffer overflows in multiple methods, is...

Trend Micro OfficeScan Web-Deployment SetupINICtrl ActiveX control buffer overflows

Overview The Trend Micro OfficeScan Web-Deployment SetupINICtrl ActiveX control contains multiple buffer overflows, which could allow a remote attacker to execute arbitrary code on a vulnerable system. Description Trend Micro OfficeScan comes with a web-based administration console that makes use...

Design/Logic Flaw

The Administration Console in Secure Elements Class 5 AVR aka C5 EVM before 2.8.1 does not enforce access control, which allows remote attackers to gain access to servers via the console...

CVE-2006-2715

The Administration Console in Secure Elements Class 5 AVR aka C5 EVM before 2.8.1 does not enforce access control, which allows remote attackers to gain access to servers via the console...

CVE-2006-2715

CVE-2006-2715 affects the Administration Console of Secure Elements Class 5 AVR (C5 EVM) prior to version 2.8.1. Root cause: access control is not enforced, enabling remote attackers to gain console access to servers. Impact is partial confidentiality/integrity/availability. Remediation: upgrade ...

CVE-2006-2715

The Administration Console in Secure Elements Class 5 AVR aka C5 EVM before 2.8.1 does not enforce access control, which allows remote attackers to gain access to servers via the console...

CVE-2006-2715: Undefined Security Weakness

The Administration Console in Secure Elements Class 5 AVR aka C5 EVM before 2.8.1 does not enforce access control, which allows remote attackers to gain access to servers via the console...

Design/Logic Flaw

Unspecified vulnerability in the WebLogic Server Administration Console for BEA WebLogic Server 9.0 prevents the console from setting custom JDBC security policies correctly, which could allow attackers to bypass intended policies...

CVE-2006-2467

BEA WebLogic Server 8.1 up to SP4, 7.0 up to SP6, and 6.1 up to SP7 displays the internal IP address of the WebLogic server in the WebLogic Server Administration Console, which allows remote authenticated administrators to determine the address...

CVE-2006-2470

Unspecified vulnerability in the WebLogic Server Administration Console for BEA WebLogic Server 9.0 prevents the console from setting custom JDBC security policies correctly, which could allow attackers to bypass intended policies...

Information disclosure

The WebLogic Server Administration Console in BEA WebLogic Server 8.1 up to SP4 and 7.0 up to SP6 displays the domain name in the Console login form, which allows remote attackers to obtain sensitive information...

CVE-2006-2468

Vulnerability details for CVE-2006-2468 show that BEA WebLogic Server Administration Console exposes the domain name in the login form for BEA WebLogic Server 8.1 up to SP4 and 7.0 up to SP6. The underlying issue is information disclosure in the Console login interface, which can allow remote att...

CVE-2006-2470

Technical details about CVE-2006-2470 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2006-2468

The WebLogic Server Administration Console in BEA WebLogic Server 8.1 up to SP4 and 7.0 up to SP6 displays the domain name in the Console login form, which allows remote attackers to obtain sensitive information...

CVE-2006-2470

Unspecified vulnerability in the WebLogic Server Administration Console for BEA WebLogic Server 9.0 prevents the console from setting custom JDBC security policies correctly, which could allow attackers to bypass intended policies...

CVE-2006-2468: Undefined Security Weakness

The WebLogic Server Administration Console in BEA WebLogic Server 8.1 up to SP4 and 7.0 up to SP6 displays the domain name in the Console login form, which allows remote attackers to obtain sensitive information...

CVE-2006-2470: Undefined Security Weakness

Unspecified vulnerability in the WebLogic Server Administration Console for BEA WebLogic Server 9.0 prevents the console from setting custom JDBC security policies correctly, which could allow attackers to bypass intended policies...