CVE-2010-4591

The Connection Manager in IBM Lotus Mobile Connect LMC before 6.1.4, when HTTP Access Services HTTP-AS is enabled, does not delete LTPA tokens in response to use of the iNotes Logoff button, which might allow physically proximate attackers to obtain access via an unattended client, related to a...

CVE-2010-4593

The Connection Manager in IBM Lotus Mobile Connect before 6.1.4 does not properly maintain a certain reference count, which allows remote authenticated users to cause a denial of service IP address exhaustion by making invalid attempts to establish sessions with the same VPN ID from multiple...

Design/Logic Flaw

The Connection Manager in IBM Lotus Mobile Connect before 6.1.4, when HTTP Access Services HTTP-AS is enabled, does not properly process TCP connection requests, which allows remote attackers to cause a denial of service memory consumption and HTTP-AS hang by making many connection requests that...

Cross site scripting

Cross-site scripting XSS vulnerability in HTTP Access Services HTTP-AS in the Connection Manager in IBM Lotus Mobile Connect LMC before 6.1.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Design/Logic Flaw

The Connection Manager in IBM Lotus Mobile Connect before 6.1.4 disables the http.device.stanza blacklisting functionality for HTTP Access Services HTTP-AS, which allows remote attackers to bypass intended access restrictions via an HTTP request that contains a disallowed User-Agent header...

CVE-2010-4592

The CVE-2010-4592 issue affects IBM Lotus Mobile Connect (Connection Manager) prior to version 6.1.4 when HTTP Access Services is enabled. The vulnerability stems from improper handling of failed HTTP-TCP session establishment, which allows remote attackers to trigger memory consumption leading t...

CVE-2010-4592

The Mobile Network Connections functionality in the Connection Manager in IBM Lotus Mobile Connect before 6.1.4, when HTTP Access Services HTTP-AS is enabled, does not properly handle failed attempts at establishing HTTP-TCP sessions, which allows remote attackers to cause a denial of service...

CVE-2010-4593

The Connection Manager in IBM Lotus Mobile Connect before 6.1.4 does not properly maintain a certain reference count, which allows remote authenticated users to cause a denial of service IP address exhaustion by making invalid attempts to establish sessions with the same VPN ID from multiple...

CVE-2010-4590

CVE-2010-4590 describes a Cross-site scripting (XSS) vulnerability in the HTTP Access Services (HTTP-AS) component of IBM Lotus Mobile Connect (LMC) prior to version 6.1.4. The flaw affects the Connection Manager and allows remote attackers to inject arbitrary web script or HTML via unspecified v...

CVE-2010-4593: Undefined Security Weakness

The Connection Manager in IBM Lotus Mobile Connect before 6.1.4 does not properly maintain a certain reference count, which allows remote authenticated users to cause a denial of service IP address exhaustion by making invalid attempts to establish sessions with the same VPN ID from multiple...

CVE-2010-4590: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in HTTP Access Services HTTP-AS in the Connection Manager in IBM Lotus Mobile Connect LMC before 6.1.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2010-4592: Undefined Security Weakness

The Mobile Network Connections functionality in the Connection Manager in IBM Lotus Mobile Connect before 6.1.4, when HTTP Access Services HTTP-AS is enabled, does not properly handle failed attempts at establishing HTTP-TCP sessions, which allows remote attackers to cause a denial of service...

CVE-2010-4595: Undefined Security Weakness

The Connection Manager in IBM Lotus Mobile Connect before 6.1.4 disables the http.device.stanza blacklisting functionality for HTTP Access Services HTTP-AS, which allows remote attackers to bypass intended access restrictions via an HTTP request that contains a disallowed User-Agent header...

CVE-2010-4591: Improper Authentication

The Connection Manager in IBM Lotus Mobile Connect LMC before 6.1.4, when HTTP Access Services HTTP-AS is enabled, does not delete LTPA tokens in response to use of the iNotes Logoff button, which might allow physically proximate attackers to obtain access via an unattended client, related to a...

CVE-2010-4594: Undefined Security Weakness

The Connection Manager in IBM Lotus Mobile Connect before 6.1.4, when HTTP Access Services HTTP-AS is enabled, does not properly process TCP connection requests, which allows remote attackers to cause a denial of service memory consumption and HTTP-AS hang by making many connection requests that...

[ GLSA 200804-26 ] Openfire: Denial of Service

Gentoo Linux Security Advisory GLSA 200804-26 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...

Windows RASMAN registry corruption vulnerability

Added: 07/28/2006 CVE: CVE-2006-2371 BID: 18358 OSVDB: 26436 Background The Routing and Remote Access Service RRAS allows a Windows computer to act as a router, dial-up access server, VPN server, or network address translator. The Remote Access Connection Manager RASMAN service handles the detail...

Windows RRAS memory corruption vulnerability

Added: 06/30/2006 CVE: CVE-2006-2370 BID: 18325 OSVDB: 26437 Background The Routing and Remote Access Service RRAS allows a Windows computer to act as a router, dial-up access server, VPN server, or network address translator. Problem A buffer overflow in RRAS allows remote attackers to execute...

Windows RRAS memory corruption vulnerability

Added: 06/30/2006 CVE: CVE-2006-2370 BID: 18325 OSVDB: 26437 Background The Routing and Remote Access Service RRAS allows a Windows computer to act as a router, dial-up access server, VPN server, or network address translator. Problem A buffer overflow in RRAS allows remote attackers to execute...

CVE-2006-2371

Buffer overflow in the Remote Access Connection Manager service RASMAN service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote unauthenticated or authenticated attackers to execute arbitrary code via certain crafted "RPC related requests," that lead to...