Design/Logic Flaw

MediaCAST 8 and earlier does not properly handle requests for inventivex/isptools/release/metadata/globalIncludeFolders.txt, which allows remote attackers to obtain sensitive information via unspecified vectors related to the Public/ directory tree...

Sql injection

Multiple SQL injection vulnerabilities in MediaCAST 8 and earlier allow remote attackers to execute arbitrary SQL commands via 1 a CPENLARGESTYLE cookie to the default URI under inventivex/managetraining/ or 2 unspecified input to authenticateadsetupfinished.cfm...

CVE-2011-2077

The CVE-2011-2077 entry concerns the default configuration of the New Atlanta BlueDragon administrative interface in MediaCAST 8 and earlier, which allows external TCP connections to port 10000 instead of restricting to 127.0.0.1. This misconfiguration enables remote TCP sessions and is described...

CVE-2011-2081

MediaCAST 8 and earlier versions are affected by CVE-2011-2081 due to improper handling of requests for inventivex/isptools/release/metadata/globalIncludeFolders.txt. This can allow remote attackers to obtain sensitive information via unspecified vectors related to the Public/ directory tree. The...

CVE-2011-2078

Multiple cross-site scripting XSS vulnerabilities in the New Atlanta BlueDragon administrative interface in MediaCAST 8 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-2076

MediaCAST 8 and earlier stores passwords in cleartext, which makes it easier for context-dependent attackers to obtain sensitive information by reading an unspecified password data store, a different vulnerability than CVE-2010-0216...

CVE-2011-2079

MediaCAST 8 and earlier allows remote attackers to have an unspecified impact via a 1 CPRIGHTSOURCE or 2 bdclientInventive cookie to the default URI under inventivex/managetraining/, related to an "XML injection" issue...

CVE-2011-2080

Multiple SQL injection vulnerabilities in MediaCAST 8 and earlier allow remote attackers to execute arbitrary SQL commands via 1 a CPENLARGESTYLE cookie to the default URI under inventivex/managetraining/ or 2 unspecified input to authenticateadsetupfinished.cfm...

CVE-2011-2081

MediaCAST 8 and earlier does not properly handle requests for inventivex/isptools/release/metadata/globalIncludeFolders.txt, which allows remote attackers to obtain sensitive information via unspecified vectors related to the Public/ directory tree...

CVE-2010-0216

Summary of CVE-2010-0216 (MediaCAST) Affected software: MediaCAST 8 and earlier. Issue: authenticate_ad_setup_finished.cfm reveals usernames and cleartext passwords by returning verbose error messages when using the UserID parameter, enabling an attacker to enumerate valid usernames and obtain cl...

CVE-2011-2078

Technical details (affected product/versions, root cause, exploitability) are not publicly provided in the supplied documents. Monitor for updates from these sources.

CVE-2011-2079

MediaCAST 8 and earlier are affected by an XML injection vulnerability that allows remote attackers to impact the system via the default URI under inventivex/managetraining/ using either the CP_RIGHTSOURCE or bdclient_Inventive cookie. The issue is described in CVE-2011-2079 with a base CVSS v2 s...

CVE-2010-0216

authenticateadsetupfinished.cfm in MediaCAST 8 and earlier allows remote attackers to discover usernames and cleartext passwords by reading the error messages returned for requests that use the UserID parameter...

CVE-2011-2077

The default configuration of the New Atlanta BlueDragon administrative interface in MediaCAST 8 and earlier enables external TCP connections to port 10000, instead of connections only from 127.0.0.1, which makes it easier for remote attackers to have an unspecified impact via a TCP session...

CVE-2011-2080

CVE-2011-2080 affects MediaCAST 8 and earlier. The vulnerability is a SQL injection in two entry points: (1) a CP_ENLARGESTYLE cookie to the default URI under inventivex/managetraining/ and (2) unspecified input to authenticate_ad_setup_finished.cfm. This allows remote attackers to execute arbitr...

CVE-2011-2076

MediaCAST 8 and earlier store passwords in cleartext, exposing sensitive credentials to attackers who can read the password data store. The description ties this to CVE-2011-2076 and distinguishes it from CVE-2010-0216. The documents do not specify the exact vulnerable component, root cause detai...

CVE-2011-2076: Exposure of Sensitive Information to an Unauthorized Actor

MediaCAST 8 and earlier stores passwords in cleartext, which makes it easier for context-dependent attackers to obtain sensitive information by reading an unspecified password data store, a different vulnerability than CVE-2010-0216...

CVE-2011-2077: Undefined Security Weakness

The default configuration of the New Atlanta BlueDragon administrative interface in MediaCAST 8 and earlier enables external TCP connections to port 10000, instead of connections only from 127.0.0.1, which makes it easier for remote attackers to have an unspecified impact via a TCP session...

CVE-2011-2080: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in MediaCAST 8 and earlier allow remote attackers to execute arbitrary SQL commands via 1 a CPENLARGESTYLE cookie to the default URI under inventivex/managetraining/ or 2 unspecified input to authenticateadsetupfinished.cfm...

CVE-2011-2078: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the New Atlanta BlueDragon administrative interface in MediaCAST 8 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...