JVN#76370393 FORM2MAIL from CGI RESCUE allows unauthorized email transmission

FORM2MAIL from CGI RESCUE is a software that sends emails with contents that are input into a HTML form. FORM2MAIL contains a vulnerability which allows unauthorized email transmission regardless of the configuration. Impact A remote attacker may send emails to arbitrary addresses. Solution Updat...

FreeBSD : leafnode fetchnews denial-of-service triggered by truncated transmission (a051a4ec-3aa1-4dd1-9bdc-a61eb5700153)

When a downloaded news article ends prematurely, i. e. when the server sends CRLF.CRLF before sending a blank line, fetchnews may wait indefinitely for data that never arrives. Workaround: configure 'minlines=1' or use a bigger value in the configuration file. Found by Toni Viemero. %NASLMINLEVEL...

Ubuntu 6.06 LTS / 7.10 / 8.04 LTS : linux, linux-source-2.6.15/22 vulnerabilities (USN-659-1)

It was discovered that the direct-IO subsystem did not correctly validate certain structures. A local attacker could exploit this to cause a system crash, leading to a denial of service. CVE-2007-6716 It was discovered that the disabling of the ZEROPAGE optimization could lead to large memory...

Mandriva Update for madwifi-source MDKSA-2007:082 (madwifi-source)

Check for the Version of madwifi-source OpenVAS Vulnerability Test Mandriva Update for madwifi-source MDKSA-2007:082 madwifi-source Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it...

Ubuntu Update for linux, linux-source-2.6.15/22 vulnerabilities USN-659-1

Ubuntu Update for Linux kernel vulnerabilities USN-659-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN6591.nasl 7969 2017-12-01 09:23:16Z santu $ Ubuntu Update for linux, linux-source-2.6.15/22 vulnerabilities USN-659-1 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks...

CVE-2009-0632

The IP Phone Personal Address Book PAB Synchronizer feature in Cisco Unified Communications Manager aka CUCM, formerly CallManager 4.1, 4.2 before 4.23SR4b, 4.3 before 4.32SR1b, 5.x before 5.13e, 6.x before 6.13, and 7.0 before 7.02 sends privileged directory-service account credentials to the...

CVE-2008-3059

member/settingsaccount.php in Octeth Oempro 3.5.5.1, and possibly other versions before 4, uses cleartext to transmit a password entered in the FormValuePassword field, which makes it easier for remote attackers to obtain sensitive information by sniffing the network, related to the "Settings -...

Code injection

member/settingsaccount.php in Octeth Oempro 3.5.5.1, and possibly other versions before 4, uses cleartext to transmit a password entered in the FormValuePassword field, which makes it easier for remote attackers to obtain sensitive information by sniffing the network, related to the "Settings -...

CVE-2008-3059

CVE-2008-3059 affects Octeth OEMpro 3.5.5.1 and possibly earlier versions before 4. The Settings - Account Information form transmits the password in plaintext (cleartext), potentially allowing remote attackers to obtain credentials by sniffing network traffic. The documents do not specify exact ...

Web Server Uses Basic Authentication Without HTTPS

The remote web server contains web pages that are protected by 'Basic' authentication over cleartext. An attacker eavesdropping the traffic might obtain logins and passwords of valid users. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid34850; scriptversion"$Revision...

CVE-2008-4618

The Stream Control Transmission Protocol sctp implementation in the Linux kernel before 2.6.27 does not properly handle a protocol violation in which a parameter has an invalid length, which allows attackers to cause a denial of service panic via unspecified vectors, related to...

AZL-6513 CVE-2008-4609 affecting package kernel for versions less than 5.10.78.1-1

The TCP implementation in 1 Linux, 2 platforms based on BSD Unix, 3 Microsoft Windows, 4 Cisco products, and probably other operating systems allows remote attackers to cause a denial of service connection queue exhaustion via multiple vectors that manipulate information in the TCP state table, a...

DEBIAN-CVE-2008-4609

The TCP implementation in 1 Linux, 2 platforms based on BSD Unix, 3 Microsoft Windows, 4 Cisco products, and probably other operating systems allows remote attackers to cause a denial of service connection queue exhaustion via multiple vectors that manipulate information in the TCP state table, a...

kernel: sctp: fix potential panics in the SCTP-AUTH API

net/sctp/socket.c in the Stream Control Transmission Protocol sctp implementation in the Linux kernel before 2.6.26.4 does not verify that the SCTP-AUTH extension is enabled before proceeding with SCTP-AUTH API functions, which allows attackers to cause a denial of service NULL pointer dereferenc...

CVE-2008-4445

The sctpauthepsethmacs function in net/sctp/auth.c in the Stream Control Transmission Protocol sctp implementation in the Linux kernel before 2.6.26.4, when the SCTP-AUTH extension is enabled, does not verify that the identifier index is within the bounds established by SCTPAUTHHMACIDMAX, which...

Design/Logic Flaw

The mailto aka commailto component in Joomla! 1.5 before 1.5.7 sends e-mail messages without validating the URL, which allows remote attackers to transmit spam...

Hitachi JP1/File Transmission Server/FTP Unauthorized File Permission Change Vulnerability

Overview Hitachi JP1/File Transmission Server/FTP has a vulnerability which allows unauthorized users to change file permissions. Impact An unauthorized user could change file permissions. Solution Please refer to the 'Vendor Information' section for the official countermeasure and take appropria...

Hitachi JP1/File Transmission Server/FTP Transmission Failure Problem

Overview Hitachi JP1/File Transmission Server/FTP has a problem where file transmission fails due to the termination of the connection or failure of getting a response from the server when executing FTP commands with certain arguments. Impact When executing FTP commands with certain arguments, fi...

FreeBSD Ports: gnutls

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

kernel: sctp: sctp_getsockopt_local_addrs_old() potential overflow

Integer overflow in the sctpgetsockoptlocaladdrsold function in net/sctp/socket.c in the Stream Control Transmission Protocol sctp functionality in the Linux kernel before 2.6.25.9 allows local users to cause a denial of service resource consumption and system outage via vectors involving a large...