EUVD-2006-2711

Malware in sbrugna...

EUVD-2006-2706

Malware in sbrugna...

EUVD-2006-2703

Malware in sbrugna...

EUVD-2006-2708

Malware in sbrugna...

EUVD-2006-2712

Malware in sbrugna...

EUVD-2006-2710

Malware in sbrugna...

Sipwise C5 NGCP CSC Cross Site Request Forgery

Sipwise C5 NGCP CSC CSRF Click2Dial Exploit Vendor: Sipwise GmbH Product web page: https://www.sipwise.com Affected version: =CEm39.3.1 NGCP wwwadmin version 3.6.7 Summary: Sipwise C5 also known as NGCP - the Next Generation Communication Platform is a SIP-based Open Source Class 5 VoIP soft-swit...

CVE-2006-2707

Secure Elements Class 5 AVR server aka C5 EVM before 2.8.1 does not validate the peer certificate when obtaining an update, which could allow remote attackers to distribute malicious updates to clients...

CVE-2006-2717

Unspecified vulnerability in Secure Elements Class 5 AVR client and server aka C5 EVM before 2.8.1 allows authenticated attackers to overwrite arbitrary files 1 on a server during an update or 2 on a client via modified pathnames, possibly due to a directory traversal issue...

Code injection

Secure Elements Class 5 AVR aka C5 EVM 2.8.1 and earlier, and possibly later 2.8.x releases, uses the same initialization vector and key for each message session, which allows remote attackers to obtain potentially sensitive information about messages...

Design/Logic Flaw

Secure Elements Class 5 AVR aka C5 EVM before 2.8.1 uses the same invariant RSA key for all installations, which allows remote attackers with the key to decrypt communications...

Hardcoded credentials

Secure Elements Class 5 AVR server aka C5 EVM before 2.8.1 uses a hard-coded user ID and password, which allows remote attackers to gain access to the server...

Directory traversal

Unspecified vulnerability in Secure Elements Class 5 AVR client and server aka C5 EVM before 2.8.1 allows authenticated attackers to overwrite arbitrary files 1 on a server during an update or 2 on a client via modified pathnames, possibly due to a directory traversal issue...

Code injection

Secure Elements Class 5 AVR server aka C5 EVM before 2.8.1 does not validate the peer certificate when obtaining an update, which could allow remote attackers to distribute malicious updates to clients...

CVE-2006-2704

Secure Elements Class 5 AVR server and client aka C5 EVM before 2.8.1 send messages in cleartext, which allows remote attackers to read sensitive vulnerability information...

CVE-2006-2717

Affected software: Secure Elements Class 5 AVR client and server (C5 EVM) prior to 2.8.1. Vulnerability: authenticated attackers can overwrite arbitrary files (1) on a server during an update, or (2) on a client via modified pathnames, likely due to a directory traversal issue. Impact: potential ...

CVE-2006-2709

CVE-2006-2709 affects Secure Elements Class 5 AVR (aka C5 EVM ) before version 2.8.1. The issue: messages’ source address is not validated, enabling a remote attacker to execute arbitrary code on a client or forge messages to the server . The connected documents provide the product and impact det...

CVE-2006-2706

CVE-2006-2706 affects the Secure Elements Class 5 AVR server (aka C5 EVM) prior to version 2.8.1. The issue allows remote attackers to trigger a denial of service by sending forged "session start" messages that cause the AVR server to connect to arbitrary hosts. The vulnerability description in t...

CVE-2006-2707

The CVE-2006-2707 entry affects the Secure Elements Class 5 AVR server (aka C5 EVM) prior to version 2.8.1. The root cause is that the server does not validate the peer certificate when obtaining updates, which could allow remote attackers to distribute malicious updates to clients. The available...

CVE-2006-2712

The CVE affects Secure Elements Class 5 AVR (C5 EVM) client and server prior to version 2.8.1. Root cause: lack of verification of the message digest integrity, enabling remote attackers to modify and replay messages. Exploitation stated as remote over a network; no further exploit details or fix...