Internet Explorer EPM Sandbox Escape CVE-2014-6350

Posted by James Forshaw This month Microsoft fixed 3 different Internet Explorer Enhanced Protected Mode EPM sandbox escapes which I disclosed in August. Sandboxes are one of the main areas of interest for Project Zero and me in particular as they are choke points for an attacker successfully...

CVE-2014-4203

Technical details for CVE-2014-4203 are not publicly available in the provided documents. Monitor for updates; the dataset contains only high-level descriptions with no product/version specifics or exploit information.

CVE-2013-5635

Media Encryption EPM Explorer in Check Point Endpoint Security through E80.50 does not properly maintain the state of password failures, which makes it easier for physically proximate attackers to bypass the device-locking protection mechanism by entering password guesses within multiple Unlock.e...

CVE-2013-5636

Unlock.exe in Media Encryption EPM Explorer in Check Point Endpoint Security through E80.50 does not associate password failures with a device ID, which makes it easier for physically proximate attackers to bypass the device-locking protection mechanism by overwriting DVREM.EPM with a copy of...

Design/Logic Flaw

Unlock.exe in Media Encryption EPM Explorer in Check Point Endpoint Security through E80.50 does not associate password failures with a device ID, which makes it easier for physically proximate attackers to bypass the device-locking protection mechanism by overwriting DVREM.EPM with a copy of...

Design/Logic Flaw

Media Encryption EPM Explorer in Check Point Endpoint Security through E80.50 does not properly maintain the state of password failures, which makes it easier for physically proximate attackers to bypass the device-locking protection mechanism by entering password guesses within multiple Unlock.e...

CVE-2013-5636

Unlock.exe in Media Encryption EPM Explorer in Check Point Endpoint Security through E80.50 does not associate password failures with a device ID, which makes it easier for physically proximate attackers to bypass the device-locking protection mechanism by overwriting DVREM.EPM with a copy of...

CVE-2013-5635

Media Encryption EPM Explorer in Check Point Endpoint Security through E80.50 does not properly maintain the state of password failures, which makes it easier for physically proximate attackers to bypass the device-locking protection mechanism by entering password guesses within multiple Unlock.e...

CVE-2013-5635

Affected software : Media Encryption EPM Explorer in Check Point Endpoint Security (through E80.50). Issue : a weakness in how password failure state is maintained, enabling bypass of the device-lock protection by running multiple Unlock.exe processes concurrently. Impact : local, physically prox...

CVE-2013-5636

The CVE-2013-5636 issue affects Check Point Endpoint Security (E80.50) with Media Encryption EPM Explorer’s Unlock.exe. The root cause is that password failure events are not associated with a device ID, enabling physically proximate attackers to bypass device-lock protection by overwriting DVREM...

Check Point response to Media Encryption EPM Explorer lockout bypass (CVE-2013-5635 and CVE-2013-5636)

...

CVE-2013-3583

Cross-site request forgery CSRF vulnerability in saveProperties.html in Corporater EPM Suite allows remote attackers to hijack the authentication of arbitrary users for requests that change passwords...

CVE-2013-3584

Cross-site scripting XSS vulnerability in Corporater EPM Suite allows remote attackers to inject arbitrary web script or HTML via the customerId parameter to an unspecified component...

CVE-2013-3584

The CVE-2013-3584 entry refers to a reflected Cross‑Site Scripting vulnerability in Corporater EPM Suite, exploitable via the vulnerable query string parameter customerId in an unspecified component. The CERT doc confirms this as part of CVE-2013-3584 and notes that injected HTML/script could be ...

CVE-2013-3584

Cross-site scripting XSS vulnerability in Corporater EPM Suite allows remote attackers to inject arbitrary web script or HTML via the customerId parameter to an unspecified component...

CVE-2013-3583

Cross-site request forgery CSRF vulnerability in saveProperties.html in Corporater EPM Suite allows remote attackers to hijack the authentication of arbitrary users for requests that change passwords...

CVE-2013-3583

The CVE-2013-3583 issue affects Corporater EPM Suite, specifically the saveProperties.html endpoint. It is a Cross-site Request Forgery (CSRF) vulnerability that enables an attacker to hijack an authenticated user’s session to perform password-change requests. The NVD entry lists a CVSS v2 base s...

Corporater EPM Suite is vulnerable to cross-site request forgery and cross-site scripting

Overview Corporater EPM Suite contains cross-site request forgery CSRF CWE-352 and reflected cross-site scripting XSS CWE-79 vulnerabilities. Description CWE-352: Cross-Site Request Forgery CSRF- CVE-2013-3583Corporater EPM Suite contains a cross-site request forgery vulnerability on the...

Oracle Hyperion Financial Management TList6 - ActiveX Control Remote Code Execution

Oracle Hyperion Financial Management TList6 ActiveX Control Remote Code Execution Vulnerability tested against: Internet Explorer 8 Microsoft Windows Server 2003 r2 sp2 download url: http://www.oracle.com/technetwork/middleware/epm/downloads/index.html files tested: SystemInstaller-11121-win32.zi...

Oracle Hyperion Enterprise Performance Management arsqls24.dll缓冲区溢出漏洞

Oracle Hyperion Enterprise Performance Management是性能管理软件。 Oracle Hyperion Enterprise Performance Management在实现上存在安全漏洞，可被恶意用户利用控制用户系统。 在解析数据库连接字符串时，arsqls24.dll中存在边界错误。通过诱使用户打开特制的Hyperion Interactive Reporting Studio .oce文件造成栈缓冲区溢出。 Oracle Hyperion Enterprise Performance Management EPM 11.x 厂商补丁：...