CVE-2002-1574

CVE-2002-1574 describes a buffer overflow in the ixj telephony card driver of Linux kernels prior to 2.4.20. Connected sources confirm the issue affects the ixj driver in Linux, and Red Hat advisories (RHSA-2004:044, RHSA-2004:106) reference this and indicate that updated kernel packages contain ...

Solaris 8 (sparc) : 108909-13

CDE 1.4: Smart Card Administration GUI patch. Date this patch was last updated by Sun : Feb/26/03 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if...

Cisco 6000/6500/7600 series systems fail to properly process layer 2 frames

Overview Cisco 6000/6500/7600 series systems with Multilayer Switch Feature Card 2 MSFC2 fail to properly process layer 2 frames. Description Cisco 6000/6500/7600 series systems with MSFC2 contain a vulnerability in the way layer 2 frames are processed in software. By sending a specially crafted...

CVE-2004-0244

Cisco 6000, 6500, and 7600 series systems with Multilayer Switch Feature Card 2 MSFC2 and a FlexWAN or OSM module allow local users to cause a denial of service hang or reset by sending a layer 2 frame packet that encapsulates a layer 3 packet, but has inconsistent length values with that packet...

CVE-2004-0311

American Power Conversion APC Web/SNMP Management SmartSlot Card 3.0 through 3.0.3 and 3.21 are shipped with a default password of TENmanUFactOryPOWER, which allows remote attackers to gain unauthorized access...

CVE-2004-0311

CVE-2004-0311 affects APC Web/SNMP Management SmartSlot Card, specifically versions 3.0 through 3.0.3 and 3.21. The issue is a default password vulnerability: the device ships with the password TENmanUFactOryPOWER, allowing remote attackers to gain unauthorized access. Connected documents corrobo...

CVE-2004-0244

Cisco 6000/6500/7600 series systems with Multilayer Switch Feature Card 2 (MSFC2) and a FlexWAN or Optical Services Module (OSM) are affected by a crafted layer-2 frame vulnerability. A layer-2 frame that encapsulates a layer-3 packet with inconsistent length can cause the device to freeze or res...

CVE-2002-1574

Buffer overflow in the ixj telephony card driver in Linux before 2.4.20 has unknown impact and attack vectors...

APC SmartSlot Web/SNMP Management Card Default Password

The remote APC Smartslot Web/SNMP Management card ships with a default username and password. An attacker can use this information to access the remote APC device with any username and the factory password 'TENmanUFactOryPOWER'. C Tenable Network Security, Inc. Refs: Subject: APC 9606 SmartSlot...

Possible XSS vuln in VCard4J

Timberlake Advisory 2004010109h. Program: http://sourceforge.net/projects/vcard4j/ vCard4J is a complete toolkit to manipulate vCards RFC 2426 in Java. It contains a parser to read vCard files. It is strange and fearsome to touch. It also includes a compiler to extend the library. And it contains...

VP-ASP shopexd.asp catalogid Parameter SQL Injection

The remote host is using the VP-ASP software suite. This set of CGIs is vulnerable to a SQL injection bug which may allow an attacker to take the control of the server as an administrator. From there, he can obtain the list of customers, steal their credit card information and more. In addition t...

Xpressions Interactive Multiple Products login.asp SQL Injection

The remote host appears to be running a software suite truConnect, FlowerLink, eVision, or Website Integration from Xpressions Software. The software in question has multiple SQL injection vulnerabilities that could allow an attacker to gain administrative access. This could lead to the exposure ...

StockMan Shopping Cart shop.plx page Parameter Arbitrary Command Execution

The remote host is running the StockMan shopping cart. According to the version number of the CGI shop.plx, there is a flaw in this installation that could allow an attacker to execute arbitrary commands on this host, and which could also allow him to obtain your list of customers or their credit...

Unauthorized ACER Travelmate access

If smart card protection is used it's still possible to access system for short time...

CVE-2002-0952

Cisco ONS15454 optical transport platform running ONS 3.1.0 to 3.2.0 allows remote attackers to cause a denial of service reset by sending IP packets with non-zero Type of Service TOS bits to the Timing Control Card TCC LAN interface...

Remote Exploit in Business::OnlinePayment::WorldPay::Junior

Business::OnlinePayment::WorldPay::Junior is a perl module providing a backend for perl scripts to manage credit/debit card payments through the WorldPay Select Junior service. I am the author of the module. There is a bug in all version of Business::OnlinePayment::WorldPay::Junior prior to 1.05...

CVE-2003-0001

Multiple ethernet Network Interface Card NIC device drivers do not pad frames with null bytes, which allows remote attackers to obtain information from previous packets or kernel memory by using malformed packets, as demonstrated by Etherleak...

More information regarding Etherleak

This e-mail's purpose is to clear several issues surrounding the Etherleak paper: - Who is Vulnerable? - Why this vulnerability is so wide spread? - Why the examples are only with Linux device drivers? - Why we have contacted CERT? - Are Device Drivers under Microsoft-based OSs are vulnerable? -...

Etherleak: Ethernet frame padding information leakage (A010603-1)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 @stake, Inc. www.atstake.com Security Advisory Advisory Name: Etherleak: Ethernet frame padding information leakage Release Date: 01/06/2003 Application: Ethernet device driver software Platform: Multiple Severity: Information disclosure Authors: Ofir...

Network device drivers reuse old frame buffer data to pad packets

Overview Many network device drivers reuse old frame buffer data to pad packets, resulting in an information leakage vulnerability that may allow remote attackers to harvest sensitive information from affected devices. Description The Ethernet standard IEEE 802.3 specifies a minimum data field si...