MS00-094 Microsoft IIS Phone Book Service Overflow

This is an exploit for the Phone Book Service /pbserver/pbserver.dll described in MS00-094. By sending an overly long URL argument for phone book updates, it is possible to overwrite the stack. This module has only been tested against Windows 2000 SP1. This module requires Metasploit:...

false vulnerability report

Hi As the author, I would like to request a removal of one of my vulnerability articles. http://securityvulns.com/Udocument99.html The reason for this is because I've recently tested the "exploit" on other palm centro phones, and the exploit would not work for them. It seems to only work on my...

Yayoi Kaikei improper handling of credential information

Overview Yayoi Kaikei Quick Navigator sends user credentials unencrypted. Yayoi Kaikei Quick Navigator makes the user log into the vendor's server, and sends the user credentials unencrypted. Impact By monitoring the communication between Quick Navigator and the vendor's server, an attacker can...

Code injection

Linksys SPA-2102 Phone Adapter 3.3.6 allows remote attackers to cause a denial of service crash via a long ping packet "ping of death". NOTE: the severity of this issue has been disputed since there are limited attack scenarios...

CVE-2008-2092

The CVE-2008-2092 issue affects the Linksys SPA-2102 Phone Adapter with firmware 3.3.6, where a remote attacker can cause a denial-of-service (crash) by sending a long ping packet (ping of death) over the network. The available records state this is a network-facing flaw with high impact (CVSS v2...

Linksys SPA-2102 wireless IP phones DoS

Large ICMP packets cause device to crash...

CVE-2008-1248

The web interface on the central phone server for the Snom 320 SIP Phone allows remote attackers to make arbitrary phone calls via the "Call a number" field. NOTE: this might overlap CVE-2007-3440...

CVE-2008-1250

Multiple cross-site request forgery CSRF vulnerabilities in the web interface on the central phone server for the Snom 320 SIP Phone allow remote attackers to perform actions as the phone user, as demonstrated by inserting an address-book entry containing an XSS sequence...

CVE-2008-1251

Cross-site scripting XSS vulnerability in the web interface on the central phone server for the Snom 320 SIP Phone allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the web interface on the central phone server for the Snom 320 SIP Phone allow remote attackers to perform actions as the phone user, as demonstrated by inserting an address-book entry containing an XSS sequence...

Cross site scripting

Cross-site scripting XSS vulnerability in the web interface on the central phone server for the Snom 320 SIP Phone allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2008-1249

snomControl.swf in the central phone server for the Snom 320 SIP Phone allows remote attackers to cause a denial of service application crash and corruption of call logs via a "'; double quote, quote, close parenthesis, semicolon sequence in the "Call a number" field...

Design/Logic Flaw

The web interface on the central phone server for the Snom 320 SIP Phone allows remote attackers to make arbitrary phone calls via the "Call a number" field. NOTE: this might overlap CVE-2007-3440...

Memory corruption

snomControl.swf in the central phone server for the Snom 320 SIP Phone allows remote attackers to cause a denial of service application crash and corruption of call logs via a "'; double quote, quote, close parenthesis, semicolon sequence in the "Call a number" field...

CVE-2008-1248

The web interface on the central phone server for the Snom 320 SIP Phone allows remote attackers to make arbitrary phone calls via the "Call a number" field. NOTE: this might overlap CVE-2007-3440...

CVE-2008-1248

The affected product is the Snom 320 SIP Phone. The vulnerability exists in the web interface (web server on port 1800) that allows remote attackers to place calls to arbitrary numbers via the "Call a number" field. Root cause details are not explicitly provided in the documents beyond this behav...

CVE-2008-1250

The CVE-2008-1250 case concerns the web interface of the central phone server in the Snom 320 SIP Phone. It describes multiple CSRF vulnerabilities that allow remote attackers to perform actions as the phone user, demonstrated by inserting an address-book entry containing an XSS sequence. The ava...

CVE-2008-1251

Cross-site scripting XSS vulnerability in the web interface on the central phone server for the Snom 320 SIP Phone allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2008-1249

CVE-2008-1249 affects snomControl.swf in the central phone server of the Snom 320 SIP Phone. A crafted input sequence in the "Call a number" field ("'); (double quote, quote, close parenthesis, semicolon)) can cause remote denial of service, resulting in an application crash and corruption of cal...

CVE-2008-1250

Multiple cross-site request forgery CSRF vulnerabilities in the web interface on the central phone server for the Snom 320 SIP Phone allow remote attackers to perform actions as the phone user, as demonstrated by inserting an address-book entry containing an XSS sequence...