CVE-2014-9575

CVE-2014-9575 affects VDG Security SENSE (formerly DIVA) before 2.3.15. A crafted encoded colon in the Authorization header allows remote attackers to bypass authentication and read/modify arbitrary plugin settings. Remediation: upgrade to 2.3.16 (or later) per available changelog. The reports co...

CVE-2014-9452

CVE-2014-9452 affects VDG Security SENSE (formerly DIVA) 2.3.13. The issue is a directory traversal vulnerability allowing remote attackers to read arbitrary files by using a “..” sequence in the default URI to images/. Root cause: insufficient URI path sanitization in the image endpoint. Impact:...

CVE-2014-9577

Affected product/variant: VDG Security SENSE (formerly DIVA) version 2.3.13. Vulnerability type: information disclosure via the login process. Root cause / mechanism: the system sends the user database during login, enabling an authenticated remote user to read the response over TCP port 51410. I...

CVE-2014-9578

CVE-2014-9578 affects VDG Security SENSE (formerly DIVA) 2.3.13. The root cause is authentication performed with a password hash instead of a password, enabling a remote attacker to gain login access by leveraging knowledge of a password hash. Public records in CNVD/NVD describe the affected prod...

CVE-2014-9579

CVE-2014-9579 affects VDG Security SENSE (formerly DIVA) 2.3.13. The vulnerability is an information disclosure where administrator credentials are stored in cleartext and can be obtained by reading the plugin configuration files. The issue stems from storing sensitive credentials in an insecure ...

CVE-2014-9576

CVE-2014-9576 affects VDG Security SENSE (formerly DIVA) version 2.3.13. The vulnerability arises from hardcoded credentials: ArpaRomaWi for the root Postgres account, and !DVService for the postgres and NTP Windows user accounts, enabling remote access for an attacker. Exploitation details are n...

CVE-2014-9451

VDG Security SENSE (formerly DIVA) 2.3.13 web service API /webservice has multiple stack-based buffer overflows in the AuthenticateUser API (user/password), enabling remote code execution. CVSSv2 base score 7.5 (HIGH). Some scanners mark remediation as WillNotFix; no explicit fixes detailed in th...