MS Windows NT Terminal Server 4.0 buffer overflow in regapi.dll allows remote code execution or DoS

Overview Microsoft Windows NT 4.0 Terminal Server contains a buffer overflow that could allow an intruder to execute arbitrary code with the privileges of an administrator. Description There is a buffer overflow in the code that processes the username specifically in RegAPI.DLL in Microsoft Windo...

ACTi cameras models from the D, B, I, and E series contain multiple security vulnerabilities

Overview According to the reporter, ACTi devices including D, B, I, and E series models using firmware version A1D-500-V6.11.31-AC are vulnerable to several issues. Description According to the reporter, multiple ACTi devices, including the D, B, I, and E series models, that use firmware version...

Netgear D6000 and D3600 contain hard-coded cryptographic keys and are vulnerable to authentication bypass

Overview The Netgear D6000 and D3600 routers are vulnerable to authentication bypass and contain hard-coded cryptographic keys embedded in their firmware. Description CWE-321: Use of Hard-coded Cryptographic Key -- CVE-2015-8288The firmware for these devices contains a hard-coded RSA private key,...

MobaXterm server may allow arbitrary command injection due to missing X11 authentication

Overview The MobaXterm server prior to verion 8.3 is vulnerable to arbitrary command injection over port 6000 when using default X11 settings. Description CWE-306: Missing Authentication for Critical Function - CVE-2015-7244MobaXterm server prior to version 8.3 includes an X11 server listening on...

F5 Networks BIG-IP Edge Client information leakage vulnerability

Overview F5 Networks has reported a flaw in the BIG-IP APM and the FirePass client-side F5-signed Edge Client components. The components may leak information from memory. CWE-200 Description F5 Networks has reported a flaw in the BIG-IP APM and the FirePass client-side F5-signed Edge Client...

MarkAny ContentSAFER MASetupCaller ActiveX control arbitrary download and execution

Overview The MarkAny ContentSAFER MASetupCaller ActiveX control fails to restrict access to dangerous methods, which can allow a remote unauthenticated attacker to download and execute arbitrary code on a vulnerable system. Description MarkAny ContentSAFER is a DRM and watermarking product that i...

Zenprise Device Manager CSRF vulnerability

Overview The Zenprise Device Manager software is susceptible to a cross-site request forgery CSRF vulnerability that may result in the compromise of the fleet of mobile devices managed by the product. Description Zenprise Device Manager is a mobile device management MDM software package that can ...

SAP BusinessObjects Axis2 Default Admin Password

Overview The Axis2 component of SAP BusinessObjects contains a default administrator account and password. Description The SAP BusinessObjects product contains a module dswsbobje.war which deploys Axis2 with an administrator account which is configured with a static password. As a result, anyone...

Oracle Sun Java fails to properly validate Java applet signatures

Overview Oracle Sun Java fails to properly validate Java applet signatures, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Signed Java applets have the ability to perform actions outside of the traditional Java sandbox, including...

Cisco WebEx Meeting Manager WebexUCFObject ActiveX Control stack buffer overflow

Overview The WebexUCFObject ActiveX control, which comes with Cisco WebEx Meeting Manager, contains a stack buffer overflow, which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Cisco WebEx is an online meeting and collaboration software...

Liferay Portal fails to protect against CSRF

Overview Liferay Portal fails to properly protect against Cross-Site Request Forgery CSRF. This may allow a remote attacker to be able to forge requests that Liferay Portal takes action upon. Description Liferay Portal is an enterprise portal solution that uses Java technologies. Liferay Portal...

RSA Keon cross-site scripting vulnerabilities

Overview The RSA KEON Registration Authority web interface contains multiple cross-site scripting XSS vulnerabilities. Description The RSA Keon Certificate Authority CA software is a digital certificate management system. The RSA KEON Registration Authority allows the CA to handle large numbers o...

Sun Java JRE vulnerable to unauthorized network access

Overview The Sun Java Runtime Environment JRE contains a vulnerability that may allow unintended access to network resources. Description The Sun Java Runtime Environment JRE allows users to run Java applications in a browser or as standalone programs. Sun has made the JRE available for multiple...

CA BrightStor ARCserve Backup Tape Engine RPC buffer overflow

Overview The Computer Associates BrightStor ARCserve Backup Tape Engine RPC service contains a buffer overflow vulnerability. If successfully exploited, this vulnerability may allow a remote attacker to execute arbitrary code. Description BrightStor ARCserve Backup is a backup and data retention...

X.509 certificate verification may be vulnerable to resource exhaustion

Overview Some applications that perform X.509 certificate verification may be vulnerable to signature processing problems that lead to resource exhaustion. This vulnerability may cause a denial of service. Description Included in X.509 certificates are public keys used for digital signature...

Microsoft Server Service Mailslot vulnerable to heap overflow

Overview A buffer overflow vulnerability in the Microsoft mailslot server service may allow a remote attacker to execute arbitrary code on a vulnerable system. Description Mailslot A mailslot is a temporary mechanism that can facilitate data transfer between hosts. Mailslots messages are limited ...

Microsoft Graphics Rendering Engine fails to properly handle WMF images

Overview Microsoft Windows Graphics Rendering Engine contains a vulnerability that may allow a remote attacker to execute arbitrary code on a vulnerable system. Description The Microsoft Windows Graphics Rendering Engine supports a number of image formats including Windows Metafile WMF. An...

Oracle PL/SQL Gateway fails to properly validate HTTP requests

Overview The Oracle PL/SQL Gateway fails to properly validate HTTP requests. This may allow a remote attacker to execute SQL commands on an Oracle database. Description Oracle uses the Oracle PL/SQL Gateway to access Oracle databases over HTTP. A lack of validation in the Oracle PL/SQL Gateway ma...

Oracle Database SYS.DBMS_METADATA_UTIL package SQL injection vulnerability

Overview Oracle Database SYS.DBMSMETADATAUTIL package vulnerable to SQL injection. Description The Oracle Database SYS.DBMSMETADATAUTIL package fails to properly filter user-supplied input. This may allow a remote attacker to insert arbitrary SQL commands, which may be executed by the database. W...

JVIEW Profiler (javaprxy.dll) COM object contains an unspecified vulnerability

Overview The JVIEW Profiler COM object contains an unspecified vulnerability, which may allow a remote attacker to execute arbitrary code on a vulnerable system. Description Microsoft COMMicrosoft COM is a technology that allows programmers to create reusable software components that can be...

TCP/IP implementations do not adequately validate ICMP error messages

Overview Multiple TCP/IP implementations do not adequately validate ICMP error messages. A remote attacker could cause TCP connections to drop or be degraded using spoofed ICMP error messages. Description A number of widely accepted Internet standards describe different aspects of the relationshi...

InnerMedia DynaZip library vulnerable to buffer overflow via long file names

Overview Releases prior to version 5.00.04 of the InnerMedia DynaZip compression library contain a buffer overflow that may allow a remote attacker to execute arbitrary code. Description DynaZip is a popular compression library for the Microsoft Windows platform. A bounds checking deficiency in...

Microsoft Internet Explorer does not properly handle cached HTTPS contents

Overview Microsoft Internet Explorer fails to properly validate cached HTTPS contents, allowing an attacker to obtain information or spoof information on a secure web site. Description The HTTPS protocol is used to provide authentication, encryption, integrity, and non-repudiation services to web...

Microsoft Windows contains vulnerability in Window Management API

Overview A vulnerability in the Microsoft Windows window application programming interfaces APIs could allow a local attacker to gain elevated privileges on a vulnerable system. Description Microsoft Windows contains a vulnerability in the window management application programming interface API...

Oracle9i Database contains buffer overflow in NUMTOYMINTERVAL() function

Overview Oracle9i Database contains a buffer overflow in the NUMTOYMINTERVAL function which could allow anyone who can query the server to execute arbitrary code or access data with the privileges of the vulnerable process. Description A buffer overflow exists in the NUMTOYMINTERVAL function. Thi...

OpenSSL contains integer overflow handling ASN.1 tags (1)

Overview A vulnerability in the way OpenSSL handles ASN.1 tags could allow a remote attacker to cause a denial of service. Description OpenSSL implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols and includes a general purpose cryptographic library. SSL and TLS are...

Blahz-DNS does not properly authenticate users before granting access to various configuration pages

Overview Blahz-DNS does not properly authenticate users. Description Blahz-DNS does not properly authenticate users. As a result, an attacker can gain access to various configuration pages. For more detailed information, please see the ppp-design advisory. --- Impact An attacker can gain access t...

Microsoft Word and Excel documents allow local file reading by via embedded fields

Overview Microsoft Word and Excel contain special encoding tags for formatting and updating content. An attacker may be able to use these tags to exploit an information disclosure vulnerability. Description Microsoft Word and Microsoft Excel are applications that ship as part of the Microsoft...

Microsoft SQLXML ISAPI filter vulnerable to buffer overflow via contenttype parameter

Overview A buffer overflow vulnerability exists in the Microsoft SQLXML Internet Services Application Programming Interface ISAPI extension for Internet Information Server IIS. This vulnerability could allow a remote attacker to cause a denial of service or execute arbitrary code with LocalSystem...

IBM AIX line printer daemon contains a buffer overflow in send_status()

Overview The Line Printer daemon lpd shipped with AIX systems contains a buffer overflow in sendstatus that potentially allow a malicious remote user to gain root privileges. Description A buffer overflow exists in the sendstatus function of the line printer daemon lpd on AIX systems. An intruder...

Solaris Line Printer Daemon (in.lpd) vulnerable to buffer overflow via transfer job routine

Overview A buffer overflow exists in the Solaris line printer daemon in.lpd that may allow a remote intruder to execute arbitrary code with the privileges of the running in.lpd. This daemon runs with root privileges by default on all recent versions of Solaris. Description The Solaris in.lpd...

Microsoft Internet Explorer (IE) permits modification of URL displayed in address bar

Overview A vulnerability exists in Microsoft Internet Explorer which could could enable an attacker to spoof trusted web sites. Description A vulnerability exists in Microsoft Internet Explorer. This vulnerability could enable a web page to display the URL from a different web site in the IE...

Microsoft Windows 2000/Internet Information Server (IIS) 5.0 Internet Printing Protocol (IPP) ISAPI contains buffer overflow (MS01-023)

Overview A vulnerability exists in Microsoft IIS 5.0 running on Windows 2000 that allows a remote intruder to run arbitrary code on the victim machine. Description Windows 2000 includes support for the Internet Printing Protocol IPP via an ISAPI extension. According to Microsoft, this extension i...

Chocolatey Boxstarter is vulnerable to privilege escalation due to weak ACLs

Overview Chocolatey Boxstarter fails to properly set ACLs, which can allow an unprivileged Windows user to be able to run arbitrary code with SYSTEM privileges. Description CVE-2020-15264 The Chocolatey Boxstarter installer fails to set a secure access-control list ACL on the...

Think Mutual Bank Mobile Banking App for iPhone fails to properly validate SSL certificates

Overview Think Mutual Bank mobile banking app for iOS, version 3.1.5 and earlier, fails to properly validate SSL certificates provided by HTTPS connections, which may enable an attacker to conduct man-in-the-middle MITM attacks. Description CWE-295: Improper Certificate Validation -...

Lantronix xPrintServer contains multiple vulnerabilities

Overview The Lantronix xPrintServer and its accompanying cloud storage API contains several vulnerabilities. Description CWE-77: Improper Neutralization of Special Elements used in a Command 'Command Injection' - CVE-2014-9002An unauthenticated attacker can include a shell command inside the 'c'...

Netgear Management System NMS300 contains arbitrary file upload and path traversal vulnerabilities

Overview Netgear Management System NMS300, version 1.5.0.11 and earlier, is vulnerable to arbitrary file upload, which may be leveraged by unauthenticated users to execute arbitrary code with SYSTEM privileges. A directory traversal vulnerability enables authenticated users to download arbitrary...

uIP and lwIP DNS resolver vulnerable to cache poisoning

Overview The DNS resolver implemented in uIP and lwIP is vulnerable to cache poisoning due to non-randomized transaction IDs TXIDs and source port reuse. Description CWE-330: Use of Insufficiently Random Values - CVE-2014-4883The DNS resolver implemented in all versions of uIP, as well as lwIP...

Cobham thraneLINK improper verification of firmware updates vulnerability

Overview Cobham's thraneLINK protocol does not verify cryptographic signatures for firmware updates before installing them. This may allow an attacker to deploy a malicious firmware update to the device. Description CWE-347: Improper Verification of Cryptographic Signature IOActive reports that...

Thomson Reuters Velocity Analytics Vhayu Analytic Server version 6.9.4 build 2995 contains a code injection vulnerability

Overview Thomson Reuters Velocity Analytics Vhayu Analytic Server version 6.94 build 2995 and possibly earlier versions contain a code injection vulnerability CWE-94. Description CWE-94:Improper Control of Generation of Code 'Code Injection' Thomson Reuters Velocity Analytics Vhayu Analytic Serve...

DrayTek Vigor 2700 ADSL router contains a command injection vulnerability

Overview DrayTek Vigor 2700 ADSL router version 2.8.3 and possibly earlier versions contain a command injection vulnerability via malicious SSID CWE-77. Description CWE-77: Improper Neutralization of Special Elements used in a Command 'Command Injection' DrayTek Vigor 2700 ADSL router version 2.8...

Baramundi Management Suite transmits data and stores keys and credentials insecurely

Overview Baramundi Management Suite versions 7.5 to 8.9 contains multiple vulnerabilities related to clear-text credential storage and transmission. Description CWE-319: Cleartext Transmission of Sensitive Information - CVE-2013-3593Baramundi Mangement Suite versions 7.5 to 8.9 transfers data in...

Plesk Panel 11.0.9 privilege escalation vulnerabilities

Overview Plesk Panel 11.0.9 and possibly earlier versions contains multiple privilege escalation vulnerabilities. Description Plesk Panel contains multiple privilege escalation vulnerabilities which may allow an attacker to run arbitrary code as the root user. Special-case rules in Plesk's custom...

Quagga BGP OPEN denial of service vulnerability

Overview Quagga, a routing software suite, contains a BGP OPEN vulnerability that result in a denial-of-service condition. Description CVE-2012-1820: Quagga version 0.99.20.1 and before contains a bug in BGP OPEN message handling. Program Impacted: bgpd: fix DoS in bgpcapabilityorf Description: I...

JasPer memory corruption vulnerabilities

Overview Some versions of JasPer contain multiple vulnerabilities that may allow a remote, unauthenticated attacker to execute arbitrary code. Description JasPer fails to properly decode marker segments and other sections in malformed JPEG2000 files. Malformed inputs can cause heap buffer overflo...

NetGear WNAP210 remote password disclosure and password bypass vulnerability

Overview NetGear WNAP210 is vulnerable to remote administrator password disclosure and administrative web page login bypass. Description Netgear's ProSafe Wireless-N Access Point WNAP210 contains a vulnerability which may allow a remote unauthenticated attacker to recover the device's administrat...

iseemedia / Roxio / MGI Software LPViewer ActiveX control stack buffer overflows

Overview The iseemedia LPViewer ActiveX control contains multiple stack buffer overflows, which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description The iseemedia LPViewer ActiveX control, which is provided by the file LPControl.dll, is a...

Wonderware SuiteLink null pointer dereference

Overview A vulnerability in the way Wonderware SuiteLink handles malformed TCP packets could result in a denial of service. Description Wonderware SuiteLink is a protocol based on TCP/IP that runs as a service listening for connections on port 5413/tcp on Microsoft Windows operating systems. A...

Yahoo! Webcam view utilities ActiveX control vulnerable to arbitrary code execution

Overview The Yahoo! Webcam view utilities ActiveX control contains a stack buffer overflow, which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Yahoo! Webcam is a component of Yahoo! Messenger that allows users to chat via webcams over ...

Apple Mac OS X ImageIO integer overflow vulnerability

Overview Apple's ImageIO framework contains an integer overflow vulnerability that may allow an attacker to execute code on a vulnerable system. Description Graphics Interchange Format GIF is a popular image format supported by many Apple Mac OS X applications. The ImageIO framework allows...