EATON MGE Office Protection Systems Network Shutdown Module unauthorized access

Authentication bypass and code execution...

n.runs-SA-2008.009 - Eaton MGE OPS Network Shutdown Module - authentication bypass vulnerability and remote code execution

n.runs AG http://www.nruns.com/ securityatnruns.com n.runs-SA-2008.009 27-October-2008 Vendor: Eaton MGE office protection systems Affected Products: Network Shutdown Module version 3.10 Vulnerability: authentication bypass vulnerability and remote code execution Risk: High Vendor communication:...

Eaton Network Shutdown Module绕过认证漏洞

BUGTRAQ ID: 31933 Network Shutdown Module是EATON公司MGE办公保护系统中用于安全关机的软件。 用户无需认证便可以向Network Shutdown Module的MGE前端（paneactionbutton.php）添加自定义操作，包括执行任意命令。 Eaton Network Shutdown Module 3.10 Eaton ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://download.mgeops.com/explore/eng/network/netsol.htm...

Eaton Network Shutdown Module < 3.20 Authentication Bypass / Command Execution

According to its version number, the Network Shutdown Module install on the remote host is earlier than 3.20. It therefore reportedly fails to require authentication before allowing a remote attacker to add custom actions through the 'paneactionbutton.php' script and then execute them via the...

CVE-2008-4722

Unspecified vulnerability in Sun Integrated Lights-Out Manager ILOM 2.0.1.5 through 2.0.4.26 allows remote authenticated users to 1 access the service processor SP and cause a denial of service shutdown or reboot, or 2 access the host operating system and have an unspecified impact, via unknown...

CVE-2008-1601

Stack-based buffer overflow in the reboot program on IBM AIX 5.2 and 5.3 allows local users in the shutdown group to gain privileges...

SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 4935)

This kernel update fixes the following security problems : - Insufficient range checks in certain fault handlers could be used by local attackers to potentially read or write kernel memory. CVE-2008-0007 - Incorrect access mode checks could be used by local attackers to corrupt directory contents...

CVE-2008-0182

Cross-site request forgery CSRF vulnerability in the Admin portlet in Liferay Portal before 4.4.0 allows remote authenticated users to perform unspecified actions as unspecified other authenticated users via the Shutdown message...

Cross site scripting

Cross-site scripting XSS vulnerability in the Admin portlet in Liferay Portal 4.3.6 allows remote authenticated users to inject arbitrary web script or HTML via the Shutdown message...

CVE-2008-0181

Cross-site scripting XSS vulnerability in the Admin portlet in Liferay Portal 4.3.6 allows remote authenticated users to inject arbitrary web script or HTML via the Shutdown message...

CVE-2008-0182

CVE-2008-0182 is a CSRF vulnerability in the Liferay Portal Admin portlet (pre-4.4.0). Remote authenticated users could cause actions as other authenticated users through the Shutdown message. Impact is partial integrity compromise; CVSS base score from NVD is 4.3 (Medium). The vulnerability is m...

Two vulnerabilities for PatchLink Update Client for Unix.

PatchLink Update Unix Client File clobbering vulnerability Larry W. Cashdollar Vapid Labs 1/17/2008 Overview From the vendor: “PatchLink Update™ provides rapid, accurate and secure patch management, allowing you to proactively manage threats by automating the collection, analysis and delivery of...

[Full-disclosure] Nokia N95 cellphone remote DoS using the SIP Stack

Nokia N95 cellphone remote DoS using the SIP Stack Severity: High – Denial of Service Hardware: Nokia N95 Firmware: Tested version: Nokia RM-159 V 12.0.013 Notification: Vulnerability found: 11 September 2007 Contact Nokia Support: 12 September 2007 / None reply Contact Nokia Security Support: 19...

Double free

Double free vulnerability in the Networking component in Apple Mac OS X 10.4 through 10.4.10 allows remote attackers to cause a denial of service system shutdown or execute arbitrary code via crafted IPV6 packets...

GLSA-200710-15 : KDM: Local privilege escalation

The remote host is affected by the vulnerability described in GLSA-200710-15 KDM: Local privilege escalation Kees Huijgen discovered an error when checking the credentials which can lead to a login without specifying a password. This only occurs when auto login is configured for at least one user...

KDM: Local privilege escalation

Background KDM is the Display Manager for the graphical desktop environment KDE. It is part of the kdebase package. Description Kees Huijgen discovered an error when checking the credentials which can lead to a login without specifying a password. This only occurs when auto login is configured fo...

kdm password-less login vulnerability

backend/session.c in KDM in KDE 3.3.0 through 3.5.7, when autologin is configured and "shutdown with password" is enabled, allows remote attackers to bypass the password requirement and login to arbitrary accounts via unspecified vectors...

Design/Logic Flaw

backend/session.c in KDM in KDE 3.3.0 through 3.5.7, when autologin is configured and "shutdown with password" is enabled, allows remote attackers to bypass the password requirement and login to arbitrary accounts via unspecified vectors...

kdm -- passwordless login vulnerability

The KDE development team reports: KDM can be tricked into performing a password-less login even for accounts with a password set under certain circumstances, namely autologin to be configured and "shutdown with password" enabled...

APC PowerChute Network Shutdown directory traversal

Directory traversal in Acme.Serve embedded web server with 5c and 2e...