EUVD-2003-0393

Malware in sbrugna...

EUVD-2003-0395

Malware in sbrugna...

EUVD-2003-0398

Malware in sbrugna...

EUVD-2003-0397

Malware in sbrugna...

EUVD-2003-0399

Malware in sbrugna...

EUVD-2003-0392

Malware in sbrugna...

EUVD-2003-0396

Malware in sbrugna...

EUVD-2003-0394

Malware in sbrugna...

Vignette StoryServer 4.1 Sensitive Stack Memory Information Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/7296/info It has been reported that Vignette StoryServer, under some circumstances may reveal stack memory content. If a specially crafted request is made for a page that accepts user-supplied data an error state may be...

Vignette StoryServer Cross-user Session Information Disclosure

Binary data 1458.prm...

Vignette StoryServer Information Disclosure

Binary data 1566.prm...

CVE-2003-0399

Vignette StoryServer 4 and 5, Vignette V/5, and possibly other versions allows remote attackers to perform unauthorized SELECT queries by setting the vgncreds cookie to an arbitrary value and directly accessing the save template...

CVE-2003-0398

Vignette StoryServer 4 and 5, and Vignette V/5 and V/6, with the SSI EXEC feature enabled, allows remote attackers to execute arbitrary code via a text variable to a Vignette Application that is later displayed...

CVE-2003-0401

Vignette StoryServer and Vignette V/5 allows remote attackers to obtain sensitive information via a request for the /vgn/style template...

CVE-2003-0403

Vignette StoryServer 5 and Vignette V/5 allows remote attackers to read and modify license information, and cause a denial of service service halt by directly accessing the /vgn/license template...

CVE-2003-0404

Multiple Cross Site Scripting XSS vulnerabilities in Vignette StoryServer 4 and 5, and Vignette V/5 and V/6, allow remote attackers to insert arbitrary HTML and script via text variables, as demonstrated using the errInfo parameter of the default login template...

CVE-2003-0400

Vignette StoryServer and Vignette V/5 does not properly calculate the size of text variables, which causes Vignette to return unauthorized portions of memory, as demonstrated using the "--" string in a CookieName argument to the login template, referred to as a "memory leak" in some reports...

CVE-2003-0402

The default login template /vgn/login in Vignette StoryServer 5 and Vignette V/5 generates different responses whether a user exists or not, which allows remote attackers to identify valid usernames via brute force attacks...

CVE-2003-0405

Vignette StoryServer 5 and Vignette V/6 allows remote attackers to execute arbitrary TCL code via 1 an HTTP query or cookie which is processed in the NEEDS command, or 2 an HTTP Referrer that is processed in the VALIDPATHS command...

Vignette StoryServer < 6.0.4 Arbitrary TCL Code Execution

The remote host is running Vignette StoryServer v6, a web interface to Vignette's Content Management suite. A flaw in this product may allow an attacker to inject arbitrary code in this server. Nessus could not determine the existence of this vulnerability so this might be a false positive...