CVE-2011-1105

Multiple cross-site scripting XSS vulnerabilities in Mutare EVM allow remote attackers to inject arbitrary web script or HTML via 1 a delivery address and possibly 2 a PIN...

CVE-2011-1104

Multiple cross-site request forgery CSRF vulnerabilities in Mutare EVM allow remote attackers to hijack the authentication of arbitrary users for requests that 1 change a PIN, 2 delete messages, 3 add a delivery address, or 4 change a delivery address...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Mutare EVM allow remote attackers to inject arbitrary web script or HTML via 1 a delivery address and possibly 2 a PIN...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Mutare EVM allow remote attackers to hijack the authentication of arbitrary users for requests that 1 change a PIN, 2 delete messages, 3 add a delivery address, or 4 change a delivery address...

CVE-2011-1105

Multiple cross-site scripting XSS vulnerabilities in Mutare EVM allow remote attackers to inject arbitrary web script or HTML via 1 a delivery address and possibly 2 a PIN...

CVE-2011-1104

Mutare EVM is affected by multiple CSRF vulnerabilities that allow remote attackers to hijack user authentication to perform actions such as (1) changing a PIN, (2) deleting messages, (3) adding a delivery address, or (4) changing a delivery address. The provided documents describe these CSRF fla...

CVE-2011-1104

Multiple cross-site request forgery CSRF vulnerabilities in Mutare EVM allow remote attackers to hijack the authentication of arbitrary users for requests that 1 change a PIN, 2 delete messages, 3 add a delivery address, or 4 change a delivery address...

CVE-2011-1105

Summary: CVE-2011-1105 maps to multiple XSS vulnerabilities in Mutare EVM. The issue allows remote attackers to inject arbitrary web script or HTML via (1) a delivery address and possibly (2) a PIN. The available documents confirm the affected product (Mutare EVM) and the vulnerable vectors, but ...

PT-2011-2869

Name of the Vulnerable Software and Affected Versions Mutare EVM affected versions not specified Description The issue concerns multiple cross-site request forgery CSRF vulnerabilities. These vulnerabilities allow remote attackers to hijack the authentication of arbitrary users for specific...

CVE-2011-1104: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in Mutare EVM allow remote attackers to hijack the authentication of arbitrary users for requests that 1 change a PIN, 2 delete messages, 3 add a delivery address, or 4 change a delivery address...

CVE-2011-1105: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Mutare EVM allow remote attackers to inject arbitrary web script or HTML via 1 a delivery address and possibly 2 a PIN...

PT-2011-2870

Name of the Vulnerable Software and Affected Versions Mutare EVM affected versions not specified Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML, potentially via a delivery addres...

CVE-2006-2715

The Administration Console in Secure Elements Class 5 AVR aka C5 EVM before 2.8.1 does not enforce access control, which allows remote attackers to gain access to servers via the console...

Code injection

Secure Elements Class 5 AVR aka C5 EVM before 2.8.1 do not validate the source address of a message, which allows remote attackers to 1 execute arbitrary code on a client or 2 forge messages to the server...

Design/Logic Flaw

The Administration Console in Secure Elements Class 5 AVR aka C5 EVM before 2.8.1 does not enforce access control, which allows remote attackers to gain access to servers via the console...

Information disclosure

Secure Elements Class 5 AVR server aka C5 EVM before 2.8.1 allows remote attackers to cause an unspecified denial of service via a large number of forged client registration messages...

Code injection

Secure Elements Class 5 AVR aka C5 EVM client and server before 2.8.1 do not verify the integrity of a message digest, which allows remote attackers to modify and replay messages...

Information disclosure

Secure Elements Class 5 AVR server and client aka C5 EVM before 2.8.1 send messages in cleartext, which allows remote attackers to read sensitive vulnerability information...

CVE-2006-2713

CVE-2006-2713 affects Secure Elements Class 5 AVR client (aka C5 EVM) prior to version 2.8.1. The vulnerability stems from generating predictable CEIDs, allowing a remote attacker to determine the CEID of a protected asset. This information could be leveraged in subsequent attacks against AVR. Th...

CVE-2006-2711

CVE-2006-2711 affects Secure Elements Class 5 AVR (C5 EVM) version 2.8.1 and earlier (and possibly later 2.8.x), where the same initialization vector (IV) and key are reused for each message session. This is the underlying root cause stated in the CVE description, enabling remote attackers over a...