CVE-2007-4152

The CVE-2007-4152 issue affects Visionsoft Audit on Demand Service (VSAOD) in Visionsoft Audit 12.4.0.0. The vulnerability allows remote replay of data from the DETAILS and PROCESS sections of a session that schedules an audit. This is the stated impact in the provided documents; no exploitation ...

CVE-2007-4148

Heap-based buffer overflow in the Visionsoft Audit on Demand Service VSAOD in Visionsoft Audit 12.4.0.0 allows remote attackers to cause a denial of service persistent daemon crashes or execute arbitrary code via a long filename in a "LOG." command...

CVE-2007-4150

The Visionsoft Audit on Demand Service VSAOD in Visionsoft Audit 12.4.0.0 uses weak cryptography XOR when 1 transmitting passwords, which allows remote attackers to obtain sensitive information by sniffing the network; and 2 storing passwords in the configuration file, which allows local users to...

CVE-2007-4149

CVE-2007-4149 affects Visionsoft Audit on Demand Service (VSAOD) in Visionsoft Audit 12.4.0.0. The issue occurs because unauthenticated remote commands (LOG., SETTINGSFILE, UNINSTALL) allow arbitrary file creation/overwrite, reconfiguration of VSAOD, or denial of service (daemon shutdown). The fi...

CVE-2007-4149

The Visionsoft Audit on Demand Service VSAOD in Visionsoft Audit 12.4.0.0 does not require authentication for 1 the "LOG." command, which allows remote attackers to create or overwrite arbitrary files; 2 the SETTINGSFILE command, which allows remote attackers to overwrite the ini file, and...

CVE-2007-4150

The CVE-2007-4150 issue affects Visionsoft Audit 12.4.0.0 (Visionsoft Audit) where weak cryptography (XOR) is used for passwords: during transmission over the network (passwords can be sniffed) and in the configuration file (local read access can reveal passwords). No further exploit details are ...

CVE-2007-4151

The Visionsoft Audit on Demand Service VSAOD in Visionsoft Audit 12.4.0.0 allows remote attackers to obtain sensitive information via 1 a LOG.ON command, which reveals the logging pathname in the server response; 2 a VER command, which reveals the version number in the server response; and 3 a...

CVE-2007-4148

CVE-2007-4148 concerns Visionsoft Audit’s Audit on Demand Service (VSAOD). A heap-based buffer overflow in VSAOD (Visionsoft Audit 12.4.0.0) is triggered by a long filename in a "LOG." command, enabling remote attackers to cause persistent daemon crashes and, per NVD, potentially execute arbitrar...

CVE-2007-4152

The Visionsoft Audit on Demand Service VSAOD in Visionsoft Audit 12.4.0.0 allows remote attackers to conduct replay attacks by capturing and resending data from the DETAILS and PROCESS sections of a session that schedules an audit...

CVE-2007-4150: Use of a Broken or Risky Cryptographic Algorithm

The Visionsoft Audit on Demand Service VSAOD in Visionsoft Audit 12.4.0.0 uses weak cryptography XOR when 1 transmitting passwords, which allows remote attackers to obtain sensitive information by sniffing the network; and 2 storing passwords in the configuration file, which allows local users to...

CVE-2007-4149: Undefined Security Weakness

The Visionsoft Audit on Demand Service VSAOD in Visionsoft Audit 12.4.0.0 does not require authentication for 1 the "LOG." command, which allows remote attackers to create or overwrite arbitrary files; 2 the SETTINGSFILE command, which allows remote attackers to overwrite the ini file, and...

CVE-2007-4148: Undefined Security Weakness

Heap-based buffer overflow in the Visionsoft Audit on Demand Service VSAOD in Visionsoft Audit 12.4.0.0 allows remote attackers to cause a denial of service persistent daemon crashes or execute arbitrary code via a long filename in a "LOG." command...

CVE-2007-4151: Undefined Security Weakness

The Visionsoft Audit on Demand Service VSAOD in Visionsoft Audit 12.4.0.0 allows remote attackers to obtain sensitive information via 1 a LOG.ON command, which reveals the logging pathname in the server response; 2 a VER command, which reveals the version number in the server response; and 3 a...

CVE-2007-4152: Undefined Security Weakness

The Visionsoft Audit on Demand Service VSAOD in Visionsoft Audit 12.4.0.0 allows remote attackers to conduct replay attacks by capturing and resending data from the DETAILS and PROCESS sections of a session that schedules an audit...

PT-2007-5346 · Visionsoft · Visionsoft Audit

Name of the Vulnerable Software and Affected Versions: Visionsoft Audit version 12.4.0.0 Description: The issue concerns the use of weak cryptography, specifically XOR, in two areas: transmitting passwords over the network and storing passwords in a configuration file. This weakness allows remote...

CAL-20070730-1.txt

CAL-20070730-1 BlueSkyCat ActiveX Remote Heap Overflow vulnerability BACKGROUND: =========== BlueSkychat is a professional voice and video chat software widely used by large chat websites in china. DESCRIPTION: ============ Code Audit Labs Code Audit for BlueSkyCat ActiveX Control and discovered ...

[Full-disclosure] CAL-20070730-1 BlueSkyCat ActiveX Remote Heap Overflow vulnerability

CAL-20070730-1 BlueSkyCat ActiveX Remote Heap Overflow vulnerability BACKGROUND: =========== BlueSkychat is a professional voice and video chat software widely used by large chat websites in china. DESCRIPTION: ============ Code Audit Labs Code Audit for BlueSkyCat ActiveX Control and discovered ...

MOSEB-07 Bonus: Vulnerabilities in Yandex.Server

New bonus vulnerabilities in Yandex. In this case vulnerabilities not directly at Yandex’s site, like at MOSEB-07: Vulnerability at blogs.yandex.ru, but in local search engine made by Yandex. The holes are in Yandex.Server Яndex.Server, local search engine from Yandex, which used by a lot of site...

MOSEB-15 Bonus: Vulnerability in Google Custom Search Engine

MOSEB-15 Bonus: Vulnerability in Google Custom Search Engine 22:57 15.06.2007 New bonus vulnerability in Google. In this case vulnerability not directly at Google’s site, like at MOSEB-15: Vulnerabilities at images.google.com, but in his search engine called Google Custom Search Engine also known...

MOSEB-12 Bonus: Vulnerability in AltaVista

MOSEB-12 Bonus: Vulnerability in AltaVista 22:40 12.06.2007 New bonus vulnerability in AltaVista. In this case vulnerability not directly at AltaVista’s site, like at MOSEB-12: Vulnerabilities at www.altavista.com, but in local search engine made by AltaVista. The hole are in AltaVista local sear...