CVE-2005-2282

Multiple cross-site scripting XSS vulnerabilities in WebEOC before 6.0.2 allow remote attackers to inject arbitrary web script and HTML via unknown vectors...

CVE-2005-2286

WebEOC before 6.0.2 does not properly check user authorization, which allows remote attackers to gain privileges via a direct request to a resource...

CVE-2005-2281

WebEOC before 6.0.2 uses a weak encryption scheme for passwords, which makes it easier for attackers to crack passwords...

CVE-2005-2283

WebEOC before 6.0.2 does not properly restrict the size of an uploaded file, which allows remote authenticated users to cause a denial of service system and database resource consumption via a large file...

CVE-2005-2284

Multiple SQL injection vulnerabilities in WebEOC before 6.0.2 allow remote attackers to modify SQL statements via unknown attack vectors...

CVE-2005-2285

WebEOC before 6.0.2 stores sensitive information in locations such as URIs, web pages, and configuration files, which allows remote attackers to obtain information such as Usernames, Passwords, Emergency information, medical information, and system configuration...

CVE-2005-2282

Multiple cross-site scripting XSS vulnerabilities in WebEOC before 6.0.2 allow remote attackers to inject arbitrary web script and HTML via unknown vectors...

CVE-2005-2286

WebEOC before 6.0.2 does not properly check user authorization, which allows remote attackers to gain privileges via a direct request to a resource...

CVE-2005-2282

WebEOC (before 6.0.2) contains multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary script/HTML via unknown vectors. The issue is addressed in version 6.0.2, which adds validation checks to vulnerable input fields. The CVE references come from multip...

CVE-2005-2285

CVE-2005-2285 concerns WebEOC prior to version 6.0.2, where sensitive information was stored in insecure locations such as URIs, web pages, and configuration files. This could allow remote attackers to obtain credentials and other sensitive data (e.g., usernames, passwords, emergency and medical ...

CVE-2005-2286

CVE-2005-2286 affects WebEOC prior to 6.0.2. The issue is improper authorization checks, allowing remote attackers to gain privileges by directly requesting a resource. Public sources in the connected documents confirm that privileges/authorizations are tied to client-side resources and that dire...

CVE-2005-2284

WebEOC prior to version 6.0.2 contains multiple SQL injection vulnerabilities that allow remote attackers to modify SQL statements, potentially viewing or modifying data or issuing database commands. Affected component is the WebEOC web application; the underlying issue is improper input filterin...

CVE-2005-2285

WebEOC before 6.0.2 stores sensitive information in locations such as URIs, web pages, and configuration files, which allows remote attackers to obtain information such as Usernames, Passwords, Emergency information, medical information, and system configuration...

CVE-2005-2281

CVE-2005-2281 affects WebEOC prior to version 6.0.2. The issue is a weak encryption scheme used for passwords, which could enable attackers to crack passwords. Red Hat and CVE aggregations, as well as CERT/PTSecurity references, confirm the scope to WebEOC with versions before 6.0.2. The remediat...

CVE-2005-2283

WebEOC before 6.0.2 does not properly restrict uploaded file sizes, allowing authenticated users to cause a denial of service through large uploads. Affected product: WebEOC (before 6.0.2); vulnerability affects the upload handling that stores file data in the database, consuming system/database ...

CVE-2005-2283

WebEOC before 6.0.2 does not properly restrict the size of an uploaded file, which allows remote authenticated users to cause a denial of service system and database resource consumption via a large file...

CVE-2005-2284

Multiple SQL injection vulnerabilities in WebEOC before 6.0.2 allow remote attackers to modify SQL statements via unknown attack vectors...

CVE-2005-2281

WebEOC before 6.0.2 uses a weak encryption scheme for passwords, which makes it easier for attackers to crack passwords...

[SA16075] WebEOC Multiple Vulnerabilities

---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secuniavacancies/...

WebEOC handles sensitive information in an insecure manner

Overview WebEOC handles sensitive information in an insecure manor. As a result, sensitive information may be exposed to untrusted parties. Description WebEOC is a web-based crisis information management application that provides functions to gather, coordinate, and disseminate information betwee...