ProCheckUp Security Advisory 2009.16

PR09-16: Juniper Secure Access series Juniper IVE XSS Vulnerability found: 12th October 2009 Severity: Medium Script injection Description: There is a Cross-site Scripting vulnerability on Juniper, IVE web interface. Procheckup has found by making a malformed request to the IVE Web interface...

Novell iManager EnteredClassName buffer overflow

Added: 07/12/2010 CVE: CVE-2010-1929 BID: 40480 OSVDB: 65737 Background Novell iManager is a web-based management interface for other Novell products. Problem A buffer overflow vulnerability in jclient.dll allows remote attackers to execute arbitrary commands by sending a specially crafted...

Novell iManager EnteredClassName buffer overflow

Added: 07/12/2010 CVE: CVE-2010-1929 BID: 40480 OSVDB: 65737 Background Novell iManager is a web-based management interface for other Novell products. Problem A buffer overflow vulnerability in jclient.dll allows remote attackers to execute arbitrary commands by sending a specially crafted...

CVE-2010-2594

Multiple cross-site request forgery CSRF vulnerabilities in the web management interface in InterSect Alliance Snare Agent 3.2.3 and earlier on Solaris, Snare Agent 3.1.7 and earlier on Windows, Snare Agent 1.5.0 and earlier on Linux and AIX, Snare Agent 1.4 and earlier on IRIX, Snare Epilog 1.5....

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the web management interface in InterSect Alliance Snare Agent 3.2.3 and earlier on Solaris, Snare Agent 3.1.7 and earlier on Windows, Snare Agent 1.5.0 and earlier on Linux and AIX, Snare Agent 1.4 and earlier on IRIX, Snare Epilog 1.5....

CVE-2010-2594

Multiple cross-site request forgery CSRF vulnerabilities in the web management interface in InterSect Alliance Snare Agent 3.2.3 and earlier on Solaris, Snare Agent 3.1.7 and earlier on Windows, Snare Agent 1.5.0 and earlier on Linux and AIX, Snare Agent 1.4 and earlier on IRIX, Snare Epilog 1.5....

CVE-2009-4658

Xerver 4.32 allows remote authenticated users to cause a denial of service daemon crash via a non-numeric web port assignment in the management interface. NOTE: this can be leveraged by non-authenticated attackers using CVE-2009-4657...

Code injection

Xerver 4.32 allows remote authenticated users to cause a denial of service daemon crash via a non-numeric web port assignment in the management interface. NOTE: this can be leveraged by non-authenticated attackers using CVE-2009-4657...

CVE-2009-4658

Xerver 4.32 allows remote authenticated users to cause a denial of service daemon crash via a non-numeric web port assignment in the management interface. NOTE: this can be leveraged by non-authenticated attackers using CVE-2009-4657...

zeus 4.2 服务器管理接口XSS漏洞

No description provided by source...

Xerver管理界面currentPath参数跨站脚本和目录遍历漏洞

BUGTRAQ ID: 36457 CVE ID: CVE-2009-3562,CVE-2009-3561 Xerver是一个免费的包括Web与FTP的服务器。 当action设置为chooseDirectory时，Xerver HTTP服务器中运行在32123端口上的管理接口没有正确地验证用户提交的currentPath参数便返回给了用户，远程攻击者可以通过提交恶意参数请求执行跨站脚本或目录遍历攻击。 Xerver 4.32 厂商补丁： Xerver ------ 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

Design/Logic Flaw

The management interface on the 2wire Gateway 1700HG, 1701HG, 1800HW, 2071, 2700HG, and 2701HG-T with software before 5.29.52 allows remote attackers to cause a denial of service reboot via a %0d%0a sequence in the page parameter to the xslt program on TCP port 50001, a related issue to...

2wire Remote Denial of Service

======================================== 2WIRE REMOTE DENIAL OF SERVICE ======================================== Device: 2wire Gateway Router/Modem Vulnerable Software: = 5.29.52 Vulnerable Models: 1700HG 1701HG 1800HW 2071 2700HG 2701HG-T Release Date: 2009-10-29 Last Update: 2009-09 Critical:...

2WIRE Router <= 5.29.52 Remote DoS

Exploit for unknown platform in category dos / poc ================================== 2wire Router = 5.29.52 Remote DoS ================================== Title: 2wire Router = 5.29.52 Remote DoS CVE-ID: OSVDB-ID: Author: hkm Published: 2009-10-29 Verified: yes view source print? """...

Alcatel-Lucent OmniPCX Enterprise masterCGI Arbitrary Command Execution

$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'Alcatel-Luce...

TwonkyMedia Server Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== Title: TwonkyMedia Server Multiple Cross-Site Scripting Vulnerabilities Product: TwonkyMedia Server Vendor: TwonkyMedia PacketVideo Corporation, http://www.twonkymedia.com...

TwonkyMedia Server 4.4.175.0.65 - Cross-Site Scripting

TwonkyMedia Server 4.4.175.0.65 - Cross-Site Scripting -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== Title: TwonkyMedia Server Multiple Cross-Site Scripting Vulnerabilities Product: TwonkyMedia Server Vendor: TwonkyMedia...

CVE-2009-2680

Unspecified vulnerability in the Remote Management Interface RMI for MSL Tape Libraries and 1/8 G2 Tape Autoloaders in HP StorageWorks 1/8 G2 Tape Autoloader firmware 2.30 and earlier, MSL2024 Tape Library firmware 4.20 and earlier, MSL4048 Tape Library firmware 6.50 and earlier, and MSL8096 Tape...

Code injection

Unspecified vulnerability in the Remote Management Interface RMI for MSL Tape Libraries and 1/8 G2 Tape Autoloaders in HP StorageWorks 1/8 G2 Tape Autoloader firmware 2.30 and earlier, MSL2024 Tape Library firmware 4.20 and earlier, MSL4048 Tape Library firmware 6.50 and earlier, and MSL8096 Tape...

CVE-2009-2680

Unspecified vulnerability in the Remote Management Interface RMI for MSL Tape Libraries and 1/8 G2 Tape Autoloaders in HP StorageWorks 1/8 G2 Tape Autoloader firmware 2.30 and earlier, MSL2024 Tape Library firmware 4.20 and earlier, MSL4048 Tape Library firmware 6.50 and earlier, and MSL8096 Tape...