EyeOS <= 0.8.9 Command Execution Vulnerability

The installed version of EyeOS does not initialize user sessions properly, allowing unauthenticated attackers to execute arbitrary commands with the privileges of the webserver. SPDX-FileCopyrightText: 2008 Ferdy Riphagen Some text descriptions might be excerpted from a referenced sources, and ar...

EyeOS <= 0.8.9 Command Execution Vulnerability

The remote system contains a PHP application that is prone to command execution flaws. Description : The remote system is running a vulnerable version of eyeOS. EyeOS is a web based operating system, which makes it possible to access data and applications remote by using a web-browser. The...

eyeOS cross-site scripting vulnerability

Overview eyeOS, an open source web desktop environment Web OS, contains a cross-site scripting vulnerability. This vulnerability has been addressed in eyeOS 0.9.0 and later. Other vulnerabilities are also addressed in the latest version. We recommend that the users upgrade to the latest version...

Design/Logic Flaw

eyeOS uses predictable checksum values in the checknum parameter for access control, which allows remote attackers to register many accounts via doCreateUser actions, add many eyeBoard messages via addMsg actions, and cause a denial of service or conduct certain unauthorized activities, by guessi...

CVE-2007-4609

eyeOS uses predictable checksum values in the checknum parameter for access control, which allows remote attackers to register many accounts via doCreateUser actions, add many eyeBoard messages via addMsg actions, and cause a denial of service or conduct certain unauthorized activities, by guessi...

CVE-2007-4609

eyeOS is affected by CVE-2007-4609 due to predictable checksum values in the checknum parameter used for access control. This allows remote attackers to abuse doCreateUser to register many accounts and add many eyeBoard messages via addMsg, potentially causing denial of service or enabling unauth...

CVE-2007-4609

eyeOS uses predictable checksum values in the checknum parameter for access control, which allows remote attackers to register many accounts via doCreateUser actions, add many eyeBoard messages via addMsg actions, and cause a denial of service or conduct certain unauthorized activities, by guessi...

CVE-2007-4609: Undefined Security Weakness

eyeOS uses predictable checksum values in the checknum parameter for access control, which allows remote attackers to register many accounts via doCreateUser actions, add many eyeBoard messages via addMsg actions, and cause a denial of service or conduct certain unauthorized activities, by guessi...

eyeOS checksum prediction

Subject: eyeOS checksum prediction Author: Andrej Komarov [email protected] eyeOS operates with special intermediate checksums in plaintext. Without its validation it is impossible to make new actions to login, start new services. There is way to predict eyeOS checksum. If it is automated from...

[SA23388] eyeOS File Upload Vulnerability

TITLE: eyeOS File Upload Vulnerability SECUNIA ADVISORY ID: SA23388 VERIFY ADVISORY: http://secunia.com/advisories/23388/ CRITICAL: Highly critical IMPACT: System access WHERE: From remote SOFTWARE: eyeOS 0.x http://secunia.com/product/5902/ DESCRIPTION: A vulnerability has been discovered in...

CVE-2006-6556

The eyeHome function in apps/eyeHome.eyeapp/aplic.php in EyeOS before 0.9.3-3 allows remote attackers to upload and execute arbitrary code via dangerous file extensions that are not all lowercase, which bypasses a cleansing operation...

CVE-2006-6556

The CVE-2006-6556 entry affects EyeOS (EyeHome function in apps/eyeHome.eyeapp/aplic.php) prior to 0.9.3-3. An attacker can remotely upload and execute arbitrary code by using dangerous file extensions that are not all lowercase, which bypasses the input cleansing step. This results in remote cod...

CVE-2006-6556

The eyeHome function in apps/eyeHome.eyeapp/aplic.php in EyeOS before 0.9.3-3 allows remote attackers to upload and execute arbitrary code via dangerous file extensions that are not all lowercase, which bypasses a cleansing operation...

CVE-2006-6556: Undefined Security Weakness

The eyeHome function in apps/eyeHome.eyeapp/aplic.php in EyeOS before 0.9.3-3 allows remote attackers to upload and execute arbitrary code via dangerous file extensions that are not all lowercase, which bypasses a cleansing operation...

JVN#46244305 eyeOS cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. Web pages could be spoofed as a result. Solution Products Affected eyeOS version 0.8.10 - 0.8.15...

CVE-2006-5071

Multiple cross-site scripting XSS vulnerabilities in eyeOS before 0.9.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving 1 eyeNav and 2 system/baixar.php...

CVE-2006-5071: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in eyeOS before 0.9.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving 1 eyeNav and 2 system/baixar.php...

CVE-2006-5071

CVE-2006-5071 corresponds to multiple XSS vulnerabilities in eyeOS prior to 0.9.1. The affected component set includes eyeNav and system/baixar.php, enabling remote attackers to inject arbitrary web script or HTML. The issue is documented across NVD and related advisories, with eyeOS 0.9.1 cited ...

CVE-2006-5071

Multiple cross-site scripting XSS vulnerabilities in eyeOS before 0.9.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving 1 eyeNav and 2 system/baixar.php...

FreeBSD : eyeOS -- multiple XSS security bugs (d3527663-4ccb-11db-b48d-00508d6a62df)

eyeOS team reports : EyeOS 0.9.1 release fixes two XSS security bugs, so we recommend all users to upgrade to this new version in order to have the best security. These two bugs were discovered by Jose Carlos Norte, who is a new eyeOS developer. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...