CVE-2005-4840

The CVE-2005-4840 issue affects the Outlook Express Address Book control when used with Internet Explorer 6. The vulnerability arises from exploiting the OutlookExpress.AddressBook COM object in IE, leading to a NULL dereference and a browser crash (denial of service). Connected advisories corrob...

CVE-2005-4840

The Outlook Express Address Book control, when using Internet Explorer 6, allows remote attackers to cause a denial of service NULL dereference and browser crash by creating the OutlookExpress.AddressBook COM object, which is not intended for use within Internet Explorer...

CVE-2005-4840: Improper Restriction of Operations within the Bounds of a Memory Buffer

The Outlook Express Address Book control, when using Internet Explorer 6, allows remote attackers to cause a denial of service NULL dereference and browser crash by creating the OutlookExpress.AddressBook COM object, which is not intended for use within Internet Explorer...

CVE-2007-2697

The embedded LDAP server in BEA WebLogic Express and WebLogic Server 7.0 through SP6, 8.1 through SP5, 9.0, and 9.1, when in certain configurations, does not limit or audit failed authentication attempts, which allows remote attackers to more easily conduct brute-force attacks against the...

CVE-2007-2694

CVE-2007-2694 concerns multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Express and WebLogic Server. Affected products span BEA WebLogic Express and WebLogic Server versions 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0 GA, and 9.1 GA. The root cause is improper handli...

CVE-2007-2699: Undefined Security Weakness

The Administration Console in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not properly enforce certain Domain Security Policies, which allows remote administrative users in the Deployer role to upload arbitrary files...

CVE-2007-2697: Undefined Security Weakness

The embedded LDAP server in BEA WebLogic Express and WebLogic Server 7.0 through SP6, 8.1 through SP5, 9.0, and 9.1, when in certain configurations, does not limit or audit failed authentication attempts, which allows remote attackers to more easily conduct brute-force attacks against the...

CVE-2007-2695: Undefined Security Weakness

The HttpClusterServlet and HttpProxyServlet in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0, and 9.1, when SecureProxy is enabled, may process "external requests on behalf of a system identity," which allows remote attackers to access...

CVE-2007-2700: Undefined Security Weakness

The WLST script generated by the configToScript command in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not encrypt certain attributes in configuration files when creating a new domain, which allows remote authenticated users to obtain sensitive information...

CVE-2007-2694: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0 GA, and 9.1 GA allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Nokia Intellisync Mobile Suite 6.4.31.2, 6.6.0.107, and 6.6.2.2, possibly involving Novell Groupwise Mobile Server and Nokia Intellisync Wireless Email Express, allow remote attackers to inject arbitrary web script or HTML via the 1 username...

CVE-2007-2590

The CVE-2007-2590 entry affects Nokia Intellisync Mobile Suite versions 6.4.31.2, 6.6.0.107, and 6.6.2.2, with possible involvement of Novell Groupwise Mobile Server and Nokia Intellisync Wireless Email Express. Affected component/pages are the direct requests to usrmgr/userList.asp and usrmgr/us...

CVE-2007-2590

Nokia Intellisync Mobile Suite 6.4.31.2, 6.6.0.107, and 6.6.2.2, possibly involving Novell Groupwise Mobile Server and Nokia Intellisync Wireless Email Express, allows remote attackers to obtain user names and other sensitive information via a direct request to 1 usrmgr/userList.asp or 2...

CVE-2007-2592

Multiple cross-site scripting XSS vulnerabilities in Nokia Intellisync Mobile Suite 6.4.31.2, 6.6.0.107, and 6.6.2.2, possibly involving Novell Groupwise Mobile Server and Nokia Intellisync Wireless Email Express, allow remote attackers to inject arbitrary web script or HTML via the 1 username...

CVE-2007-2592: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Nokia Intellisync Mobile Suite 6.4.31.2, 6.6.0.107, and 6.6.2.2, possibly involving Novell Groupwise Mobile Server and Nokia Intellisync Wireless Email Express, allow remote attackers to inject arbitrary web script or HTML via the 1 username...

SA-20070509-0.txt

SEC Consult Security Advisory ======================================================================= title: Multiple vulnerabilites in Nokia Intellisync Mobile Suite & Wireless Email Express Information / Source Code Disclosure, Cross Site Scripting, Denial of Service program: Nokia Intellisync...

CVE-2007-2137

IBM Tivoli Monitoring Express 6.1 (including Universal Agent, Windows OS Monitoring Agent, and Enterprise Portal Server) is affected by a heap-based buffer overflow in kde.dll caused by processing oversized input. The vulnerability exists in three services: Universal Agent Primary Service (TCP 10...

CVE-2007-2137: Undefined Security Weakness

Heap-based buffer overflow in kde.dll in IBM Tivoli Monitoring Express 6.1.0 before Fix Pack 2, as used in Tivoli Universal Agent, Windows OS Monitoring agent, and Enterprise Portal Server, allows remote attackers to execute arbitrary code by sending a long string to a certain TCP port...

IBM Tivoli Monitoring Express通用代理多个堆溢出漏洞

IBM Tivoli Monitoring Express用于帮助用户监控和管理操作系统、数据库及应用。 Tivoli Monitoring Express的Tivoli Universal Agent Primary Service（TCP 10110）、Monitoring Agent for Windows OS - Primary（TCP 6014）和Tivoli Enterprise Portal Server（TCP 14206）服务中存在堆溢出漏洞，如果向这些服务发送了超长字符串的话，就会在调用kde.dll中有漏洞函数期间触发堆溢出，导致执行任意指令。 IBM Tivol...

ZDI-07-018: IBM Tivoli Monitoring Express Universal Agent Heap Overflow Vunlerability

ZDI-07-018: IBM Tivoli Monitoring Express Universal Agent Heap Overflow Vunlerability http://www.zerodayinitiative.com/advisories/ZDI-07-018.html April 18, 2007 -- CVE ID: CVE-2007-2137 -- Affected Vendor: IBM -- Affected Products: IBM Tivoli Monitoring Express 6.1 -- Vulnerability Details: This...