CVE-2006-0485

The TCL shell in Cisco IOS 12.214S before 12.214S16, 12.218S before 12.218S11, and certain other releases before 25 January 2006 does not perform Authentication, Authorization, and Accounting AAA command authorization checks, which may allow local users to execute IOS EXEC commands that were...

Authorization

The TCL shell in Cisco IOS 12.214S before 12.214S16, 12.218S before 12.218S11, and certain other releases before 25 January 2006 does not perform Authentication, Authorization, and Accounting AAA command authorization checks, which may allow local users to execute IOS EXEC commands that were...

CVE-2006-0486

Certain Cisco IOS releases in 12.2S based trains with maintenance release number 25 and later, 12.3T based trains, and 12.4 based trains reuse a Tcl Shell process across login sessions of different local users on the same terminal if the first user does not use tclquit before exiting, which may...

Authorization

Certain Cisco IOS releases in 12.2S based trains with maintenance release number 25 and later, 12.3T based trains, and 12.4 based trains reuse a Tcl Shell process across login sessions of different local users on the same terminal if the first user does not use tclquit before exiting, which may...

CVE-2006-0485

CVE-2006-0485 affects Cisco IOS TCL/CLI: the TCL shell does not perform AAA command authorization checks, potentially allowing local users to bypass AAA and execute IOS EXEC commands prohibited by configuration (Bug CSCeh73049). Affected Cisco IOS versions include 12.2(14)S before 12.2(14)S16 and...

CVE-2006-0486

CVE-2006-0486 affects Cisco IOS releases, specifically 12.2S trains (MR 25+), 12.3T, and 12.4, where a Tcl Shell process can be reused across login sessions for different local users if tclquit isn’t issued. This could allow subsequent users to run unintended commands or bypass AAA checks. The is...

CVE-2006-0485

The TCL shell in Cisco IOS 12.214S before 12.214S16, 12.218S before 12.218S11, and certain other releases before 25 January 2006 does not perform Authentication, Authorization, and Accounting AAA command authorization checks, which may allow local users to execute IOS EXEC commands that were...

CVE-2006-0486: Undefined Security Weakness

Certain Cisco IOS releases in 12.2S based trains with maintenance release number 25 and later, 12.3T based trains, and 12.4 based trains reuse a Tcl Shell process across login sessions of different local users on the same terminal if the first user does not use tclquit before exiting, which may...

CVE-2006-0485: Undefined Security Weakness

The TCL shell in Cisco IOS 12.214S before 12.214S16, 12.218S before 12.218S11, and certain other releases before 25 January 2006 does not perform Authentication, Authorization, and Accounting AAA command authorization checks, which may allow local users to execute IOS EXEC commands that were...

Cisco routers IOS TCL privilege escalation

User can execute any command by switching to TCL Tool Command Language mode...

[SA18613] Cisco IOS AAA Command Authentication Bypass Vulnerability

TITLE: Cisco IOS AAA Command Authentication Bypass Vulnerability SECUNIA ADVISORY ID: SA18613 VERIFY ADVISORY: http://secunia.com/advisories/18613/ CRITICAL: Less critical IMPACT: Security Bypass WHERE: Local system OPERATING SYSTEM: Cisco IOS R12.x http://secunia.com/product/50/ Cisco IOS 12.x...

Cisco IOS TCLSH AAA Command Authorization Bypass (CSCeh73049)

The remote host is a CISCO router containing a version of IOS that is vulnerable to a remote AAA command authorization bypass attack. The remote version of IOS does not enforce AAA command authorization checks for commands etnered in the TCL shell. An attacker with a shell access on the remote...

CVE-2004-2471

SQL injection vulnerability in the sloth TCL script in QuoteEngine before 1.2.0 allow remote attackers to execute arbitrary SQL commands via unknown vectors...

CVE-2004-2471

The CVE-2004-2471 entry describes an SQL injection in the sloth TCL script of QuoteEngine prior to 1.2.0, enabling remote attackers to execute arbitrary SQL via unknown vectors. The vulnerability affects the QuoteEngine component and is documented with a high impact score (base 7.5; Confidentiali...

CVE-2004-2471: Undefined Security Weakness

SQL injection vulnerability in the sloth TCL script in QuoteEngine before 1.2.0 allow remote attackers to execute arbitrary SQL commands via unknown vectors...

xpvm symbolic links problem

Symbolic links problem in xpvm.tcl during temporary files creation...

CVE-2004-0015

The CVE concerns vbox3:0.1.8 and earlier where root privileges were not properly relinquished before executing a user-supplied TCL script, enabling a local user to gain privileges. Affected: vbox3 (ISDN4Linux vocal system); root privilege leak via privilege drop failure. Debian DSAs confirm fixes...

CVE-2004-0015: Undefined Security Weakness

vbox3 0.1.8 and earlier does not properly drop privileges before executing a user-provided TCL script, which allows local users to gain privileges...

Mandrake Linux Security Advisory : tcltk (MDKSA-2002:060)

Some problems were discovered with the Tcl/Tk development environment. The expect application would search for its libraries in /var/tmp prior to searching in other directories, which could allow a local user to gain root privilege by writing a trojan library and waiting for the root user to run...

CVE-2002-0385

Vignette Story Server 4.1 and 6.0 allows remote attackers to obtain sensitive information via a request that contains a large number of '"' double quote and and '' characters, which causes the TCL interpreter to crash and include stack data in the output...