CVE-2007-5384

Multiple cross-site request forgery CSRF vulnerabilities in the Thomson/Alcatel SpeedTouch 7G router, as used for the BT Home Hub 6.2.6.B and earlier, allow remote attackers to perform actions as administrators via unspecified POST requests, as demonstrated by enabling an inbound remote-assistanc...

CVE-2007-5385

Multiple cross-site scripting XSS vulnerabilities in the Thomson/Alcatel SpeedTouch 7G router, as used for the BT Home Hub 6.2.6.B and earlier, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2007-5383

The Thomson/Alcatel SpeedTouch 7G router, as used for the BT Home Hub 6.2.6.B and earlier, allows remote attackers on an intranet to bypass authentication and gain administrative access via vectors including a '/' slash character at the end of the PATHINFO to cgi/b, aka "double-slash auth bypass....

CVE-2007-5385

Technical details about CVE-2007-5385 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2007-5383

The CVE-2007-5383 entry concerns Thomson/Alcatel SpeedTouch 7G routers (as used with BT Home Hub 6.2.6.B and earlier). The vulnerability allows remote attackers on an intranet to bypass authentication and gain administrative access by manipulating the PATH_INFO end character (notably a trailing s...

CVE-2007-5384

Multiple cross-site request forgery CSRF vulnerabilities in the Thomson/Alcatel SpeedTouch 7G router, as used for the BT Home Hub 6.2.6.B and earlier, allow remote attackers to perform actions as administrators via unspecified POST requests, as demonstrated by enabling an inbound remote-assistanc...

CVE-2007-5384

CVE-2007-5384 involves CSRF flaws in the Thomson/Alcatel SpeedTouch 7G router (used by BT Home Hub 6.2.6.B and earlier). The vulnerabilities allow remote attackers to perform administrator actions via unspecified POST requests, demonstrated by enabling an inbound remote‑assistance HTTPS session o...

CVE-2007-5383

The Thomson/Alcatel SpeedTouch 7G router, as used for the BT Home Hub 6.2.6.B and earlier, allows remote attackers on an intranet to bypass authentication and gain administrative access via vectors including a '/' slash character at the end of the PATHINFO to cgi/b, aka "double-slash auth bypass....

CVE-2007-5385

Multiple cross-site scripting XSS vulnerabilities in the Thomson/Alcatel SpeedTouch 7G router, as used for the BT Home Hub 6.2.6.B and earlier, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Alcatel-Lucent OmniPCX code execution

Code execution in Web interface...

Alcatel-Lucent OmniPCX Remote Command Execution

Advisory: Alcatel-Lucent OmniPCX Remote Command Execution RedTeam Pentesting discovered a remote command execution in the Alcatel-Lucent OmniPCX during a penetration test. The masterCGI script of the OmniPXC integrated communication solution web interface is vulnerable to a remote command...

CVE-2007-3010

masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the user parameter during a ping action...

Design/Logic Flaw

masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the user parameter during a ping action...

CVE-2007-3010

CVE-2007-3010 affects Alcatel-Lucent OmniPCX Enterprise Communication Server (R7.1 and earlier). The web-based masterCGI script in the Unified Maintenance Tool allows remote arbitrary command execution via shell metacharacters in the user parameter during a ping action, enabling an attacker to ru...

CVE-2007-3010

masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the user parameter during a ping action...

CVE-2007-3010

masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the user parameter during a ping action...

rt-sa-2007-001.txt

Advisory: Alcatel-Lucent OmniPCX Remote Command Execution RedTeam Pentesting discovered a remote command execution in the Alcatel-Lucent OmniPCX during a penetration test. The masterCGI script of the OmniPXC integrated communication solution web interface is vulnerable to a remote command...

CVE-2007-3010

masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the user parameter during a ping action. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker...

Alcatel-Lucent OmniPCX Enterprise 7.1 - Remote Command Execution

Alcatel-Lucent OmniPCX Enterprise 7.1 - Remote Command Execution source: https://www.securityfocus.com/bid/25694/info Alcatel-Lucent OmniPCX Enterprise is prone to a remote command-execution vulnerability because it fails to adequately sanitize user-supplied data. Attackers can exploit this issue...

Alcatel-Lucent OmniPCX Enterprise Communication Server 7.1 - masterCGI Command Injection (Metasploit)

Alcatel-Lucent OmniPCX Enterprise Communication Server 7.1 - masterCGI Command Injection Metasploit $Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing a...