Core Security Technologies Advisory 2009.0227

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ Real Helix DNA RTSP and SETUP request handler vulnerabilities 1. Advisory Information Title: Real Helix DNA RTSP and SETUP request handler vulnerabilities Advisory ID...

Buffer overflow

Multiple buffer overflows in RealNetworks Helix Server and Helix Mobile Server 11.x before 11.1.8 and 12.x before 12.0.1 allow remote attackers to 1 cause a denial of service via three crafted RTSP SETUP commands, or execute arbitrary code via 2 an NTLM authentication request with malformed...

CVE-2008-5911

Multiple buffer overflows in RealNetworks Helix Server and Helix Mobile Server 11.x before 11.1.8 and 12.x before 12.0.1 allow remote attackers to 1 cause a denial of service via three crafted RTSP SETUP commands, or execute arbitrary code via 2 an NTLM authentication request with malformed...

CVE-2008-5911

RealNetworks Helix Server (and Helix Mobile Server) versions 11.x before 11.1.8 and 12.x before 12.0.1 are affected by multiple buffer overflow vulnerabilities triggered by RTSP requests. The CVE-2008-5911 entry covers issues including heap overflow via RTSP SETUP, DESCRIBE, and NTLM authenticati...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Nokia Intellisync Mobile Suite 6.4.31.2, 6.6.0.107, and 6.6.2.2, possibly involving Novell Groupwise Mobile Server and Nokia Intellisync Wireless Email Express, allow remote attackers to inject arbitrary web script or HTML via the 1 username...

CVE-2007-2592

Multiple cross-site scripting XSS vulnerabilities in Nokia Intellisync Mobile Suite 6.4.31.2, 6.6.0.107, and 6.6.2.2, possibly involving Novell Groupwise Mobile Server and Nokia Intellisync Wireless Email Express, allow remote attackers to inject arbitrary web script or HTML via the 1 username...

CVE-2007-2590

Nokia Intellisync Mobile Suite 6.4.31.2, 6.6.0.107, and 6.6.2.2, possibly involving Novell Groupwise Mobile Server and Nokia Intellisync Wireless Email Express, allows remote attackers to obtain user names and other sensitive information via a direct request to 1 usrmgr/userList.asp or 2...

CVE-2007-2590

Nokia Intellisync Mobile Suite 6.4.31.2, 6.6.0.107, and 6.6.2.2, possibly involving Novell Groupwise Mobile Server and Nokia Intellisync Wireless Email Express, allows remote attackers to obtain user names and other sensitive information via a direct request to 1 usrmgr/userList.asp or 2...

CVE-2007-2592

CVE-2007-2592 describes multiple cross-site scripting (XSS) vulnerabilities in Nokia Intellisync Mobile Suite, potentially involving Novell GroupWise Mobile Server and Nokia Intellisync Wireless Email Express. The affected software versions are 6.4.31.2, 6.6.0.107, and 6.6.2.2. The flaws allow re...

CVE-2007-2590

The CVE-2007-2590 entry affects Nokia Intellisync Mobile Suite versions 6.4.31.2, 6.6.0.107, and 6.6.2.2, with possible involvement of Novell Groupwise Mobile Server and Nokia Intellisync Wireless Email Express. Affected component/pages are the direct requests to usrmgr/userList.asp and usrmgr/us...

CVE-2007-2592

Multiple cross-site scripting XSS vulnerabilities in Nokia Intellisync Mobile Suite 6.4.31.2, 6.6.0.107, and 6.6.2.2, possibly involving Novell Groupwise Mobile Server and Nokia Intellisync Wireless Email Express, allow remote attackers to inject arbitrary web script or HTML via the 1 username...

CVE-2006-6026

Heap-based buffer overflow in Real Networks Helix Server and Helix Mobile Server before 11.1.3, and Helix DNA Server 11.0 and 11.1, allows remote attackers to cause a denial of service application crash or execute arbitrary code via a DESCRIBE request that contains an invalid LoadTestPassword fie...

CVE-2006-6026

CVE-2006-6026 : RealNetworks Helix Server/Helix Mobile Server (pre-11.1.3) and Helix DNA Server (11.0 and 11.1) suffer a heap-based buffer overflow via a DESCRIBE request containing an invalid LoadTestPassword field. An unauthenticated, remote attacker could crash the server or execute arbitrary ...

Apache Tomcat 5 - Information Disclosure

Apache Tomcat 5 - Information Disclosure source: https://www.securityfocus.com/bid/19106/info Apache Tomcat is prone to an information-disclosure vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to reveal a complete directory listing from...

CVE-2004-2229

Technical details about CVE-2004-2229 are not available in the provided documents. The records show a generic description of multiple unknown vulnerabilities in Oracle 9i Lite Mobile Server with remote privilege gain, but no concrete specifics are provided. Monitor for updates.

CVE-2004-2229

Multiple unknown vulnerabilities in Oracle 9i Lite Mobile Server 5.0.0.0.0 through 5.0.2.9.0 allow remote authenticated users to gain privileges...

CVE-2004-0049

RealNetworks Helix Server/Proxy 9 and Helix Mobile Server 10 are affected by a buffer overflow in the Administration Interface over HTTP. An authenticated user can submit malformed HTTP POST requests to trigger code execution on the server. Affected versions include Helix Universal Server/Gateway...

CVE-2004-0049

Helix Universal Server/Proxy 9 and Mobile Server 10 allow remote attackers to cause a denial of service via certain HTTP POST messages to the Administration System port...

CVE-2004-0049

Helix Universal Server/Proxy 9 and Mobile Server 10 allow remote attackers to cause a denial of service via certain HTTP POST messages to the Administration System port...