Cisco IOS/X12-X15 has default SNMP read/write string of "cable-docsis"

Overview There is a vulnerability that permits unauthorized access to several switch and router products manufactured by Cisco Systems. An attacker who gains access to an affected device can read and modify its configuration, creating a denial-of-service condition, an information leak, or both...

Multiple ftpd implementations contain buffer overflows

Overview A variety of ftp servers incorrectly manage buffers in a way that can lead to remote intruders executing arbitrary code on the FTP server. The incorrect management of buffers centers around the return from the glob function, and may be confused with a related denial-of-service problem...

Check Point FireWall-1 allows fragmented packets through firewall if Fast Mode is enabled

Overview If any rules include the "Fast Mode" option, Check Point Firewall-1 and VPN-1 will incorrectly allow unauthorized connection attempts to hosts that should be restricted. Description A feature called "Fast Mode" or "FASTPATH", included in Check Point FireWall-1 and VPN-1 is designed to...

Casdoor contains Arbitrary File Write vulnerability

Overview Casdoor contains an arbitrary file write vulnerability in the implementation of its "Local File System" storage provider. Due to insufficient sanitization of user-supplied paths, an authenticated user with file upload permissions can escape the intended storage directory and write files...

LibreChat RAG API contains a log-injection vulnerability

Overview A log-injection vulnerability in the LibreChat RAG API, version 0.7.0, is caused by improper sanitization of user-supplied input written to system logs. An authenticated attacker can forge or manipulate log entries by inserting CRLF characters, compromising the integrity of audit records...

A flawed TLS handshake implementation affects Viber Proxy in multiple platforms

Overview The Rakuten Viber messaging app for Android V25.7.2.0g and Windows V25.6.0.0-V25.8.1.0, has a flaw in its TLS handshake implementation when using the Cloak proxy configuration. This flaw allows for easy identification of proxy usage, potentially compromising user anonymity. Description...

Rsync contains six vulnerabilities

Overview Rsync, a versatile file-synchronizing tool, contains six vulnerabilities present within versions 3.3.0 and below. Rsync can be used to sync files between remote and local computers, as well as storage devices. The discovered vulnerabilities include heap-buffer overflow, information leak,...

Subrion CMS vulnerable to SQL injection by an authenticated user

Overview Subrion CMS is vulnerable to SQL injection from authenticated users when a browser cookie is modified in a certain way. Description Subrion is an open source web-based content management system CMS. Subrion is vulnerable to SQL injection due to deserialization of untrusted data from a...

GroundWork Monitor Enterprise contains multiple vulnerabilities

Overview GroundWork Monitor Enterprise 6.7.0 and possibly earlier versions contain multiple vulnerabilities. Description The SEC Consult Vulnerability Lab Security Advisory states:The following vulnerability description has been categorized into the components where the vulnerabilities have been...

Adobe Shockwave player provides vulnerable Flash runtime

Overview Adobe Shockwave Player 12.1.1.151 and earlier versions on the Windows and Macintosh operating systems provide a vulnerable version of the Flash runtime. Description Adobe Macromedia Shockwave Player is software that plays active web content developed in Macromedia and Adobe Director...

HP LoadRunner buffer overflow vulnerability

Overview HP LoadRunner contains a buffer overflow vulnerability when parsing Virtual User script files. Description According to HP's website: HP LoadRunner software is the industry standard for performance validation. It allows you to prevent application performance problems by detecting...

PHP getSymbol vulnerability allows denial of service

Overview PHP fails to properly sanitize input passed to the getSymbol function in a way that could allow and attacker to cause a segmentation fault. Description PHP is a scripting language that is designed for web-based applications and can be embedded directly into HTML. The getSymbol function i...

British Telecommunications Consumer webhelper ActiveX control buffer overflows

Overview The British Telecommunications Consumer webhelper ActiveX control contains multiple buffer overflows, which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description The registration process for British Telecommunications BT internet...

Media Technology Group CDPass ActiveX control stack buffer overflows

Overview The Media Technology Group CDPass ActiveX control contains several stack buffer overflows, which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Media Technology Group CDPass is software that provides bonus content for music CDs...

HP-UX sendmail vulnerable to denial of service

Overview HP-UX contains an unspecified vulnerability in sendmail, which may allow a remote, unauthenticated attacker to cause a denial of service. Description HP-UX systems running sendmail are vulnerable to an unspecified denial of service. According to HP technical document c00841370, the...

Symantec Mail Security for SMTP arbitrary code execution vulnerability

Overview Symantec Mail Security for SMTP contains a vulnerability that may allow an attacker to execute arbitrary code, or create a denial of service condition. Description Symantec Mail Security for SMTP is an antispam, antivirus, and content filtering software package that scans email. Symantec...

Cisco IOS fails to properly process certain packets containing a crafted IP option

Overview Cisco IOS software contains a vulnerablity that may allow an attacker to execute arbitrary code or create a denial of service condition. Description Cisco IOS is an operating system that is used on Cisco network devices. The Internet Control Message Protocol ICMP is a protocol commonly...

Oracle SYS.DBMS_AQ package vulnerable to PL/SQL injection

Overview The Oracle SYS.DBMSAQ package is vulnerable to PL/SQL injection. This vulnerability may allow a remote, authenticated attacker to execute arbitrary PL/SQL commands on a vulnerable Oracle installation. Description The Oracle SYS.DBMSAQ package fails to properly sanitize user input.This ma...

Mozilla products fail to properly handle JavaScript regular expressions

Overview Mozilla products fail to properly handle certain JavaScript regular expressions. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary code or cause a denial-of-service condition. Description According to Mozilla Foundation Security Advisory 2006-57: ...a...

Secure Elements Class 5 AVR server fails to properly enforce access controls on console operations

Overview The Secure Elements Class 5 AVR server fails to properly enforce access controls on console operations. This may allow a remote attacker to gain unauthorized administrative access to a server. Description Class 5 AVR Secure Elements Class 5 AVR Automated Vulnerability Remediation is a...

Secure Elements Class 5 AVR client fails to enforce integrity of message digests

Overview The Secure Elements Class 5 AVR client fails to enforce integrity of message digests. This may allow an attacker to replay modified messages to a vulnerable client. Description Class 5 AVR Secure Elements Class 5 AVR Automated Vulnerability Remediation is a security product that monitors...

Multiple vulnerabilities in DNS implementations

Overview Numerous vulnerabilities have been reported in various Domain Name System DNS implementations. The impacts of these vulnerabilities may allow an attacker to execute arbitrary code, cause a denial-of-service condition, or cause a DNS implementation to behave in an unstable/unpredictable...

Oracle Export component SQL injection vulnerability

Overview An SQL injection vulnerability in the Oracle Export component may allow a remote attacker to execute arbitrary SQL commands on a vulnerable Oracle installation. Description Oracle Export component contains a SQL injection vulnerability.The details of this vulnerability are not clear. We...

Oracle Diagnostics Interfaces vulnerability

Overview An unspecified vulnerability in Oracle Diagnostics Interfaces may allow a remote, unauthenticated attacker to compromise system confidentiality and integrity. Description Oracle Diagnostics Interfaces contains a vulnerability. The details of this vulnerability are not clear. However,...

Oracle Order Capture vulnerability

Overview An unspecified vulnerability in Oracle Order Capture may allow a remote, unauthenticated attacker to compromise system confidentiality. Description Oracle Order Capture contains a vulnerability. The details of this vulnerability are not clear. However, Oracle states this issue can allow ...

PAM-MySQL contains a double-free vulnerability

Overview PAM-MySQL contains a double-free vulnerability that may allow a remote attacker to execute arbitrary code or cause a denial-of-service condition. Description PAM-MySQL provides a Pluggable Authentication Module PAM interface to a MySQL database. PAM-MySQL does not securely handle a point...

VERITAS StorageCentral DCOM servers contain multiple buffer overflows

Overview VERITAS StorageCentral DCOM servers contains several buffer overflows, which may allow a remote attacker to execute arbitrary code on a vulnerable system. Description VERITAS StorageCentral is software package that performs storage management. Multiple DCOM server components provided by...

Reflection for Secure IT Windows Server 6.0 changed case sensitivity of allow and deny lists

Overview Reflection for Secure IT Windows Server version 6.0 uses different case-sensitivity in evaluating the allow and deny lists as previous versions, potentionally allowing unintended access. Description Reflection for Secure IT Windows Server version 6.0, an SSH server from WRQ formerly know...

WebEOC account lock-out policy may allow a denial-of-service

Overview WebEOC account lock out policy may allow a remote attacker to disable user and system accounts resulting in a denial-of-service condition. Description WebEOC is a web-based crisis information management application that provides functions to gather, coordinate, and disseminate informatio...

paFileDB fails to properly sanitize "query" parameter in "pafiledb.php"

Overview paFileDB works around the default "off" state for the "registerglobals" security directive in PHP and then fails to initialize the "query" variable, which can be used to inject arbitrary SQL queries. Description "paFileDB is designed to allow webmasters have a database of files for...

Groove Mobile Workspace vulnerable to script injection via SharePoint replicated menus

Overview A vulnerability in the way that Groove Mobile Workspace handles SharePoint lists may allow an attacker to execute an arbitrary script. Description Groove Virtual Office provides a collaborative working environment that includes shared documents, databases, and applications among other...

Groove Virtual Office may not correctly display file names

Overview Groove Virtual Office may not correctly display the names of attached or embedded files. A remote attacker may be able to trick a user into executing arbitrary code. Description Groove Virtual Office provides a collaborative working environment that includes shared documents, databases,...

Sun Java Plugin may create temporary files with predictable names

Overview The Sun Java Plugin may allow remote users to create files with arbitrary content in a specific location. Description From the Sun Java Plugin page:Java Plug-in technology, included as part of the Java 2 Runtime Environment, Standard Edition JRE, establishes a connection between popular...

QNX PPPoEd vulnerable to buffer overflow

Overview QNX PPPoEd contains a buffer overflow that may allow an attacker to execute arbitrary commands. Description QNX is an RTOS Real-time Operating System. QNX is used in many different devices and industries, including, but not limited to routers manufacturing and processing medical equipmen...

Microsoft Internet Explorer execCommand() method SaveAs command uses misleading "Save HTML Document" dialog

Overview Microsoft Internet Explorer contains a vulnerability in the way that it presents a Save As dialog. By invoking the SaveAs command with execCommand, an attacker could display a dialog that could trick a user into saving arbitrary content. Description Microsoft Internet Explorer IE support...

Anti-virus software may not properly scan malformed zip archives

Overview Anti-virus software may rely on corrupted headers to determine if a zip archive is valid. As a result, anti-virus software may fail to detect malicious content within a zip archive. Description Information about a zip archive, such as the size of the compressed data, is placed in headers...

Macromedia JRun Server contains an information disclosure vulnerability

Overview An information disclosure vulnerability exists in the Macromedia JRun that may allow an attacker to view the source code of files in the web root directory. Description Macromedia JRun is an application server that works with most popular web servers such as Apache and IIS. Macromedia...

Mozilla allows signed scripts calling "enablePrivilege" to change contents of a "grant" dialog

Overview A vulnerability in the way Mozilla and its derived programs display dialogs in some circumstances could allow a remote attacker to install and run software on a vulnerable system. Description The Mozilla web browser and related Mozilla products support the ability to run signed scripts...

Juniper Networks NetScreen firewall contains a DoS vulnerability in the SSHv1 service

Overview A vulnerability in the SSHv1 service of NetScreen firewalls could allow an attacker to cause a denial-of-service condition. Description Juniper Networks NetScreen firewall products include a Secure Shell version 1 SSHv1 implementation called Secure Command Shell SCS. The SSHv1 service...

mod_ssl contains a format string vulnerability in the ssl_log() function

Overview There is a format string vulnerability in the ssllog function of the modssl module that could allow an attacker to potentially execute arbitrary code. Description modssl is an Apache module that provides Secure Sockets Layer SSL v2/v3 and Transport Layer Security TLS v1 protocol support...

Ethereal crashes when processing malformed RADIUS packets

Overview Ethereal contains a vulnerability in the way it processes Remote Authentication Dial In User Service RADIUS packets. Description Ethereal is a network traffic analysis package. It includes the ability to decode packets containing RADIUS data. There is a vulnerability that causes Ethereal...

cPanel fails to verify input passed to the "user" parameter

Overview A remotely exploitable vulnerability in CPanel's password reset and login scripts may allow a remote attacker to gain control of the vulnerable system. Description Cpanel is an application that provides the ability to manage accounts and provides an interface to the end users of web...

PostgreSQL VACUUM command allows unprivileged user to remove database transaction log data

Overview The PostgreSQL VACUUM command contains a vulnerability that allows an unprivileged user to remove database transaction log data. This may result in unrecoverable data loss. Description PostgreSQL is a database management system. The PostgreSQL VACUUM command is used to clean out records...

Avaya Argent Office uses weak SNMP authentication mechanism

Overview The Avaya Argent Office does not properly enforce SNMP community string values, resulting in a weakened access control mechanism. Description The Avaya Argent Office does not properly enforce SNMP community string values. It will accept a null string i.e. as a valid community string and...

KaZaA Media Desktop discloses username to remote users

Overview The usernames disclosed by the KaZaA Media Desktop peer-to-peer file sharing application do not present a security vulnerability. Description The KaZaA Media Desktop is a peer-to-peer file sharing application that allows users to search for and download files from other KaZaA users. This...

Hummingbird CyberDOCS contains multiple cross-site scripting vulnerabilities

Overview Hummingbird CyberDOCS contains cross site scripting vulnerabilities that could allow an attacker to obtain sensitive information and possibly impersonate legitimate users. Description Hummingbird CyberDOCS Hummingbird DM is a web-based enterprise document management solution that runs on...

Utah Raster Toolkit contains multiple vulnerabilities

Overview The Utah Raster Toolkit is a graphics library/utility. Several vulnerabilities have been reported in the Utah Raster Toolkit. Description The Utah Raster Toolkit is a graphics library/utility. Several vulnerabilities have been reported in the Utah Raster Toolkit. --- Impact The complete...

Automatic File Content Type Recognition Tool vulnerable to stack overflow

Overview A buffer overflow vulnerability exists in the "Automatic File Content Type Recognition Tool" versions of the file1 package prior to 3.41. Description The file1 package is used to examine files on the system. According to an OpenPKG advisory, a stack overflow vulnerability exists in the...

Oracle9i Database contains remotely exploitable buffer overflow in "TZ_OFFSET" function

Overview A remotely exploitable buffer overflow vulnerability exists in Oracle9i Database. Description A buffer overflow vulnerability exists on all platforms in the following versions of Oracle9i Database: Oracle9i Database Release 2 9i Release 1 8i 8.1.7 8.0.6 A buffer overflow vulnerability...

HP-UX XServer contains privilege escalation vulnerability

Overview A privilege escalation vulnerability exists in the HP-UX 11.22 XServer. Description A privilege escalation vulnerability in the HP-UX 11.22 XServer may allow an attacker to gain elevated privileges. For more details, please see HPSBUX0301-238. --- Impact An attacker may be able to gain...