CVE-2008-1154: Improper Authentication

The Disaster Recovery Framework DRF master server in Cisco Unified Communications products, including Unified Communications Manager CUCM 5.x and 6.x, Unified Presence 1.x and 6.x, Emergency Responder 2.x, and Mobility Manager 2.x, does not require authentication for requests received from the...

Authentication flaw

Unspecified vulnerability in the LDAP authentication feature in Aruba Mobility Controller 2.3.6.15, 2.5.2.11, 2.5.4.25, 2.5.5.7, 3.1.1.3, and 2.4.8.11-FIPS or earlier allows remote attackers to bypass authentication mechanisms and obtain management or VPN interface access...

CVE-2008-0150

CVE-2008-0150 affects Aruba Mobility Controller LDAP authentication, with versions 2.3.6.15, 2.5.2.11, 2.5.4.25, 2.5.5.7, 3.1.1.3, and 2.4.8.11-FIPS (or earlier). The issue allows remote attackers to bypass authentication and gain access to management or VPN interfaces. The initial descriptions i...

CVE-2008-0150

Unspecified vulnerability in the LDAP authentication feature in Aruba Mobility Controller 2.3.6.15, 2.5.2.11, 2.5.4.25, 2.5.5.7, 3.1.1.3, and 2.4.8.11-FIPS or earlier allows remote attackers to bypass authentication mechanisms and obtain management or VPN interface access...

CVE-2008-0150: Improper Authentication

Unspecified vulnerability in the LDAP authentication feature in Aruba Mobility Controller 2.3.6.15, 2.5.2.11, 2.5.4.25, 2.5.5.7, 3.1.1.3, and 2.4.8.11-FIPS or earlier allows remote attackers to bypass authentication mechanisms and obtain management or VPN interface access...

Aruba Mobility Controller unauthorized access

Unauthorized access without password if LDAP authentication module enabled...

Design/Logic Flaw

Unspecified vulnerability in the Image Converter functionality in BEA WebLogic Mobility Server 3.3, 3.5, and 3.6 through 3.6 SP1 allows remote attackers to obtain application file and resource access via unspecified vectors...

CVE-2007-6384

Unspecified vulnerability in the Image Converter functionality in BEA WebLogic Mobility Server 3.3, 3.5, and 3.6 through 3.6 SP1 allows remote attackers to obtain application file and resource access via unspecified vectors...

CVE-2007-6384

The CVE-2007-6384 entry affects BEA WebLogic Mobility Server (3.3, 3.5, 3.6 through 3.6 SP1) in the Image Converter functionality. The vulnerability allows remote attackers to obtain application file and resource access via unspecified vectors; CVSS v2 base score 7.5 (HIGH) with network attack ve...

CVE-2007-6384

Unspecified vulnerability in the Image Converter functionality in BEA WebLogic Mobility Server 3.3, 3.5, and 3.6 through 3.6 SP1 allows remote attackers to obtain application file and resource access via unspecified vectors...

BEA WebLogic Mobility Server图象转换未明未授权访问漏洞

BEA WebLogic Mobility Server是一款为Web和移动访问提供统一的软件解决方案。 BEA WebLogic Mobility Server图象转换存在未明问题，远程攻击者可以利用漏洞绕过访问限制获取WEB应用程序的文件。 目前没有详细漏洞细节提供。 BEA Systems WebLogic Mobility Server 3.6 SP1 BEA Systems WebLogic Mobility Server 3.6 BEA Systems WebLogic Mobility Server 3.5 BEA Systems WebLogic Mobility...

CVE-2007-6384: Improper Authentication

Unspecified vulnerability in the Image Converter functionality in BEA WebLogic Mobility Server 3.3, 3.5, and 3.6 through 3.6 SP1 allows remote attackers to obtain application file and resource access via unspecified vectors...

Design/Logic Flaw

The HTTP daemon in the Cisco Unified IP Phone, when the Extension Mobility feature is enabled, allows remote authenticated users of other phones associated with the same CUCM server to eavesdrop on the physical environment via a CiscoIPPhoneExecute message containing a URL attribute of an...

CVE-2007-6190: Exposure of Sensitive Information to an Unauthorized Actor

The HTTP daemon in the Cisco Unified IP Phone, when the Extension Mobility feature is enabled, allows remote authenticated users of other phones associated with the same CUCM server to eavesdrop on the physical environment via a CiscoIPPhoneExecute message containing a URL attribute of an...

Cisco Unified IP Phone Extension Mobility Monitoring Vulnerability

Cisco Unified IP Phone devices contain a vulnerability that could allow an authenticated, remote attacker to eavesdrop on ongoing conversations around an affected device, potentially resulting in a disclosure of sensitive information. The vulnerability exists due to insecure handling of the...

CVE-2007-6054

Cross-site scripting XSS vulnerability in the login page in the management interface in the Aruba 800 Mobility Controller 2.5.4.18 and earlier, and 2.4.8.6-FIPS and earlier, allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to the /screens URI, related to the url...

CVE-2007-6054

The CVE-2007-6054 entry describes an XSS vulnerability in the login page of Aruba 800 Mobility Controller (versions 2.5.4.18 and earlier; 2.4.8.6-FIPS and earlier). The issue occurs in the management interface via PATH_INFO to the /screens URI, related to the url variable, allowing remote attacke...

CVE-2007-6054: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the login page in the management interface in the Aruba 800 Mobility Controller 2.5.4.18 and earlier, and 2.4.8.6-FIPS and earlier, allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to the /screens URI, related to the url...

Aruba Mobility Controller crossite scripting

Crossite scripting in administration interface...

CVE-2007-4023

Cross-site scripting XSS vulnerability in the login CGI program in Aruba Mobility Controller 2.5.4.18 and earlier, and 2.4.8.6-FIPS and earlier FIPS versions, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...