CVE-2007-1005: Undefined Security Weakness

Heap-based buffer overflow in SW3eng.exe in the eID Engine service in CA formerly Computer Associates eTrust Intrusion Detection 3.0.5.57 and earlier allows remote attackers to cause a denial of service application crash via a long key length value to the remote administration port 9191/tcp...

CVE-2007-1178

WebAPP before 0.9.9.5 does not check access in certain contexts related to 1 Calendar Administration, 2 Instant Messages Administration, and 3 the Image Uploader, which has unknown impact and attack vectors...

Nullsoft Shoutcast Server crossite scripting

Crossite scripting with web administration log...

CVE-2007-1178: Undefined Security Weakness

WebAPP before 0.9.9.5 does not check access in certain contexts related to 1 Calendar Administration, 2 Instant Messages Administration, and 3 the Image Uploader, which has unknown impact and attack vectors...

Trend Micro OfficeScan client ActiveX control buffer overflow

Added: 02/21/2007 CVE: CVE-2007-0325 BID: 22585 OSVDB: 33040 Background Trend Micro OfficeScan is a centralized virus and security scan management system. Problem The OfficeScan Web-Deployment SetupINICtrl ActiveX control, which is vulnerable to buffer overflows in multiple methods, is...

Trend Micro OfficeScan client ActiveX control buffer overflow

Added: 02/21/2007 CVE: CVE-2007-0325 BID: 22585 OSVDB: 33040 Background Trend Micro OfficeScan is a centralized virus and security scan management system. Problem The OfficeScan Web-Deployment SetupINICtrl ActiveX control, which is vulnerable to buffer overflows in multiple methods, is...

Need ability to limit use of remote API to certain users, or a certain group

The remote API presents opportunities for denial of service attack. For example: RemoveSpace for a space with many pages can take several minutes, and all other users are locked from the wiki until it completes Reading or writing pages too rapidly through the API can impact the responsiveness of...

Need ability to limit use of remote API to certain users, or a certain group

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Cloud. Using Confluence Server? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFSERVER-7913. panel The remote API presents opportunities for denial of service attack. For example: RemoveSpace for a space with many...

Trend Micro OfficeScan Web-Deployment SetupINICtrl ActiveX control buffer overflows

Overview The Trend Micro OfficeScan Web-Deployment SetupINICtrl ActiveX control contains multiple buffer overflows, which could allow a remote attacker to execute arbitrary code on a vulnerable system. Description Trend Micro OfficeScan comes with a web-based administration console that makes use...

IP3 NetAccess directory traversal

Directory traversal in Web administration interface...

syscp1215-exec.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The System Control Panel www.SysCP.org -= Security Advisory =- Advisory: Ability to inject and execute any code as root in SysCP Release Date: 2007/02/02 Last Modified: 2007/02/07 Author: Florian Lippert Application: SysCP and only affects SysCP 1.2.1...

Ability to inject and execute any code as root in SysCP

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The System Control Panel www.SysCP.org -= Security Advisory =- Advisory: Ability to inject and execute any code as root in SysCP Release Date: 2007/02/02 Last Modified: 2007/02/07 Author: Florian Lippert [email protected] Application: SysCP =...

CVE-2006-6973

CVE-2006-6973 affects Headstart Solutions DeskPRO. The vulnerability allows remote attackers to bypass authentication for administrative paths, enabling (1) reinstall via install/index.php, (2) database deletion via a crafted do=delete_database query on a renamed install/index.php, and (3)/(4) un...

EQdkp <= 1.3.1 Referer Spoof to access to SQL Database

Title: EQdkp = 1.3.1 Referer Spoof to access to SQL Database URL: http://www.eqdkp.com Hook: "Powered by EQdkp" Author: Eight10 Contact: [email protected] -------------------------------------------------------------------------------------------------------- Background: EQdkp is the largest DKP...

CVE-2007-0529

Cross-site scripting XSS vulnerability in index.html aka the administration page in PHP Link Directory phpLD 3.0.6 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted link, which is triggered when the administrator uses the "Validate Links" functionality...

ARCserve Backup for Laptops & Desktops Server Admin Service Detection

BrightStor ARCserve Backup for Laptops & Desktops Server formerly BrightStor Mobile Backup Server, an enterprise class backup solution for remote and mobile Windows-based PCs, is installed on the remote host. And the service listening on this port is used by the application's Server Explorer to...

MIT Kerberos 5: Arbitrary Remote Code Execution

Background MIT Kerberos 5 is a suite of applications that implement the Kerberos network protocol. Description The Kerberos administration daemon, and possibly other applications using the GSS-API or RPC libraries, could potentially call a function pointer in a freed heap buffer, or attempt to fr...

Multiple IP Phones unauthorized access

After administrative login it's possible to access administration interface from any IP without password validation...

PHP Link Directory XSS Vulnerability version <= 3.0.6

Smilehouse Oy -= Security Advisory =- Advisory: PHP Link Directory XSS Vulnerability Release Date: 2007/01/21 Last Modified: 2007/01/21 Authors: Jussi Vuokko, CISSP [email protected] Henri Lindberg, Associate of ISCІ [email protected] Application: PHP Link Directory = 3.0.6...

Design/Logic Flaw

Unspecified vulnerability in GONICUS System Administration GOsa before 2.5.8 allows remote authenticated users to modify certain settings, including the admin password, via crafted POST requests...