CVE-2008-2333

The CVE-2008-2333 entry concerns a reflected Cross-Site Scripting (XSS) vulnerability in Barracuda Spam Firewall (BSF) via the ldap_test.cgi script. According to the sources, the vulnerability arises because the script does not properly validate the email parameter, enabling an attacker to inject...

CVE-2005-2847

The Barracuda Spam Firewall running firmware versions 3.1.16 and 3.1.17 is vulnerable to a remote command execution flaw in the img.pl component. An attacker can execute arbitrary commands by providing shell metacharacters in the f parameter. Versions prior to 3.1.18 are confirmed as vulnerable. ...

CVE-2007-1673

CVE-2007-1673 concerns unzoo.c (used in AMaViS 2.4.1 and older) where a ZOO archive direntry can reference a previously processed file, causing an infinite loop DoS. The root cause is a mismanaged traversal of direntries (next pointers) that may loop, leading to 100% CPU or blocking behavior when...

CVE-2006-4000

The Barracuda Spam Firewall (BSF) versions 3.3.01.001 through 3.3.03.055 are vulnerable to a directory traversal flaw in the cgi-bin/preview_email.cgi script. The root cause is the failure to properly filter user-supplied input in the file parameter, allowing remote authenticated users to read ar...

CVE-2008-0971

CVE-2008-0971 covers multiple XSS flaws in Barracuda Spam Firewall suite. Affected are: Barracuda Spam Firewall (BSF) , Message Archiver , Web Filter , IM Firewall , and Load Balancer with XSS via various inputs (Policy Name field, UI/search inputs, error messages, hidden form fields). Root cause...

CVE-2006-4001

CVE-2006-4001 concerns Barracuda Spam Firewall (BSF): affected firmware versions 3.3.01.001–3.3.03.053 contain a hard-coded password for the guest account, enabling remote attackers to read sensitive data such as e-mail logs and potentially e-mail contents and the admin password. Related connecte...

CVE-2006-4082

Barracuda Spam Firewall (BSF) is affected by CVE-2006-4082. Concrete details from connected sources indicate default credentials in affected BSF firmware: versions 3.3.01.001 to 3.3.02.053 expose a guest account and a fixed admin password that cannot be modified by an administrator, enabling a re...

CVE-2008-1094

CVE-2008-1094 affects Barracuda Spam Firewall (BSF) before 3.5.12.007. A SQL injection exists in index.cgi (Account View) where the pattern_x parameter can be used with search_count_equals to inject arbitrary SQL, reportedly exploitable by remote authenticated administrators. Potential impacts in...

CVE-2005-2848

The Barracuda Spam Firewall running firmware versions 3.1.16 and 3.1.17 is vulnerable to a directory traversal flaw in the img.pl component. This vulnerability allows remote attackers to read arbitrary files by using a .. (dot dot) sequence in the f parameter. A related exploit (EDB-ID:1236) exis...

CVE-2007-5058

The CVE-2007-5058 issue affects the Barracuda Spam Firewall web administration interface. Affected component: login handling in the Web UI where the username field can inject arbitrary script/HTML when the Monitor Web Syslog screen is open. Root cause: improper handling of input in the login cont...

CVE-2005-0431

CVE-2005-0431 : Barracuda Spam Firewall 3.1.10 and earlier allows white-listed domains to relay mail to arbitrary destinations, creating an open relay. Root cause: insufficient restriction on destination domains for white-listed senders. Impact: enables spam relaying; CVSS from NVD lists base sco...

CVE-2005-2849

CVE-2005-2849 affects Barracuda Spam Firewall firmware 3.1.16 and 3.1.17. The vulnerability is an argument injection in CGI scripts that grant attackers the following capabilities: read portions of source code via the -f option to Dig (dig_device.cgi); determine file existence via the -r option t...

CVE-2006-4081

CVE-2006-4081 affects Barracuda Spam Firewall (BSF) versions 3.3.01.001–3.3.03.053 . The vulnerability in preview_email.cgi allows remote attackers to execute commands via shell metacharacters in the file parameter, yielding remote command execution with likely limited privileges. The exploit can...