[VulnWatch] Corsaire Security Advisory - Mitel 3300 ICP web interface session hijacking issue

-- Corsaire Security Advisory -- Title: Mitel 3300 ICP web interface session hijacking issue Date: 17.08.04 Application: Mitel Web Management Interface Environment: Mitel 3300 ICP prior to 4.2.2.11 Author: Stephen de Vries [email protected] Audience: General distribution Reference: c040817-002...

CVE-2004-0944: Undefined Security Weakness

The web management interface for Mitel 3300 Integrated Communications Platform ICP before 4.2.2.11 generates easily predictable web session IDs, which allows remote attackers to hijack other sessions via the parentsessionid cookie...

CVE-2004-0945: Undefined Security Weakness

The web management interface for Mitel 3300 Integrated Communications Platform ICP before 4.2.2.11 allows remote authenticated users to cause a denial of service resource exhaustion via a large number of active sessions, which exceeds ICP's maximum...

CVE-2004-2691

Unspecified vulnerability in 3Com SuperStack 3 4400 switches with firmware version before 3.31 allows remote attackers to cause a denial of service device reset via a crafted request to the web management interface. NOTE: the provenance of this information is unknown; details are obtained from...

CVE-2004-1789

Cross-site scripting XSS vulnerability in the web management interface in ZyWALL 10 4.07 allows remote attackers to inject arbitrary web script or HTML via the rpAuth1 page...

CVE-2002-0396

The web management server for Red-M 1050 Bluetooth Access Point does not use session-based credentials to authenticate users, which allows attackers to connect to the server from the same IP address as a user who has already established a session...

CVE-2002-0396: Undefined Security Weakness

The web management server for Red-M 1050 Bluetooth Access Point does not use session-based credentials to authenticate users, which allows attackers to connect to the server from the same IP address as a user who has already established a session...

Compaq Web Managment spoofed certificate unauthorized access

User can upload his certificate to server for getting unauthorized access...

CVE-2004-0944

The web management interface for Mitel 3300 Integrated Communications Platform ICP before 4.2.2.11 generates easily predictable web session IDs, which allows remote attackers to hijack other sessions via the parentsessionid cookie...

Symantec Gateway Security crossite scripting

Crossite scripting in web managment...

APC 9606 SmartSlot Web/SNMP management card "backdoor"

Background: APC American Power Conversion SmartSwitch and UPS uninterruptible power supply products have a Web and SNMP management card installed that permits local serial console, TELNET, web and SNMP management, monitoring and mains power control of attached devices. The Problem: APC SmartSlot...

ZYXEL ZyWALL 10 Management Interface - Cross-Site Scripting

source: https://www.securityfocus.com/bid/9373/info ZyWALL 10 firewalls are prone to cross-site scripting attacks via the web management interface of affected devices. An attacker could exploit this issue by enticing a victim user to follow a malicious link to a site hosting the software that...

CVE-2003-1363

The remote web management interface of Aprelium Technologies Abyss Web Server 1.1.2 and earlier does not log connection attempts to the web management port 9999, which allows remote attackers to mount brute force attacks on the administration console without detection...

CVE-2003-1341

The default installation of Trend Micro OfficeScan 3.0 through 3.54 and 5.x allows remote attackers to bypass authentication from cgiChkMasterPasswd.exe and gain access to the web management console via a direct request to cgiMasterPwd.exe...

CVE-2003-1343

Trend Micro ScanMail for Exchange SMEX before 3.81 and before 6.1 might install a back door account in smgSmxcfg30.exe, which allows remote attackers to gain access to the web management interface via the vcc parameter, possibly "3560121183d3"...

IBM Directory Server crossite scripting

Crossite scripting in web managment interface...

NSFOCUS SA2003-04 : Remote Buffer Overflow Vulnerability in Web Management Interface of Cisco Secure ACS

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 NSFOCUS Security AdvisorySA2003-04 Topic: Remote Buffer Overflow Vulnerability in Web Management Interface of Cisco Secure ACS Release Date: 2003-04-24 CVE CAN ID: CAN-2003-0210 Affected system: =================== Cisco Secure ACS 2.6.4 for Windows a...

CVE-2002-0870

The original patch for the Cisco Content Service Switch 11000 Series authentication bypass vulnerability CVE-2001-0622 was incomplete, which still allows remote attackers to gain additional privileges by directly requesting the web management URL instead of navigating through the interface,...

CVE-2002-0870: Undefined Security Weakness

The original patch for the Cisco Content Service Switch 11000 Series authentication bypass vulnerability CVE-2001-0622 was incomplete, which still allows remote attackers to gain additional privileges by directly requesting the web management URL instead of navigating through the interface,...

Security Advisory: Cisco Content Service Switch 11000 Series Web Management Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco Content Service Switch 11000 Series Web Management Vulnerability Revision 2.0 For Public Re-release 2002 August 14 at 1500 UTC For Public Release 2001 May 31 at 1500 UTC...