[CLOSE] OSVDB ID : 8531 - Disclosed: 2004-08-10

Description:

Web Mail contains a flaw related to file system security that may allow an attacker to create arbitrary directories. A valid user login is required. No further details have been provided.

[CLOSE] OSVDB ID : 8532 - Disclosed: 2004-08-10

Description:

Web Mail contains a flaw related to an information disclosure in that an attacker may view the full install path. This can be performed with guest access. No further details have been provided.

[CLOSE] OSVDB ID : 8533 - Disclosed: 2004-08-10

Description:

Web Mail contains a flaw related to access rights that may allow an attacker to view or download any attachments. No further details have been provided.

[CLOSE] OSVDB ID : 8534 - Disclosed: 2004-08-10

Description:

Web Mail contains a flaw related to access rights that may allow an attacker to delete any file on a victim system. No further details have been provided.

[CLOSE] OSVDB ID : 8535 - Disclosed: 2004-08-10

Description:

Web Mail contains a flaw related to access rights that may allow an attacker to move any file or directory on a victim system. This can be performed with guest access. No further details have been provided.

[CLOSE] OSVDB ID : 8536 - Disclosed: 2004-08-10

Description:

Web Mail contains a flaw related to access rights that may allow an attacker to rename any file or directory on a victim system. A valid user account is required. No further details have been provided.

[CLOSE] OSVDB ID : 8537 - Disclosed: 2004-08-10

Description:

Web Mail contains a flaw related to sql injection that may allow an attacker to compromise Web Mail. No further details have been provided.

[CLOSE] OSVDB ID : 8538 - Disclosed: 2004-08-10

Description:

Web Mail contains a flaw related to XSS that may allow an attacker to manipulate the calendar.html script through multiple variables. No further details have been provided.

[CLOSE] OSVDB ID : 8539 - Disclosed: 2004-08-10

Description:

Web Mail contains a flaw related to the attachment and schedule/calendar that may allow an attacker to execute these modules without a session ID. No further details have been provided.

[CLOSE] OSVDB ID : 8523 - Disclosed: 2004-08-10

Description:

Sygate Enforcer contains a flaw that may allow a remote denial of service. The issue is triggered when a remote attacker sends a specially crafted UDP packet from source port 39999 to destination source port 39999 on the Enforcer system, and will result in loss of availability for the Enforcer system.

[CLOSE] OSVDB ID : 8524 - Disclosed: 2004-08-10

Description:

Sygate Secure Enterprise contains a flaw that may allow a remote denial of service. The issue is a trigged by a lack of replay protection in fields and the use of static encryption keys for communication allowing the possibility of replay attacks. A remote attacker can use this to contiually replay sessions between the SSA and the Secure Enterprise Server and will result in loss of availability for the Server.

[CLOSE] OSVDB ID : 8525 - Disclosed: 2004-08-10

Description:

Sygate Enforcer contains a flaw that may allow a malicious user to bypass authentication and pass broadcast traffic onto hosts. The issue is triggered when a malicious user sends broadcast traffic destined for a host protected by Sygate Enforcer. Sygate Enforcer does not limit and/or stop broadcast traffic prior to authentication. It is possible that the flaw may allow the remote attacker to send malicious broadcast traffic to the protected machine resulting in a loss of availability.

[CLOSE] OSVDB ID : 8405 - Disclosed: 2004-08-10

Description:

GeNUGate contains a flaw that may allow a remote denial of service. The issue is triggered when an unspecified error occurs within the processing of ISAKMP packets allowing an attacker to perform unauthorized deletion of ISAKMP Security Associations, and will result in loss of availability for clients.

[CLOSE] OSVDB ID : 22697 - Disclosed: 2004-08-10

Description:

(Description Provided by CVE) : Drivers for certain display adapters, including (1) an unspecified ATI driver and (2) an unspecified Intel driver, might allow remote attackers to cause a denial of service (system crash) via a large JPEG image, as demonstrated in Internet Explorer using stoopid.jpg with a width and height of 9999999.

[CLOSE] OSVDB ID : 8507 - Disclosed: 2004-08-10

Description:

Symantec Clientless VPN Gateway contains a flaw related to the ActiveX file browser that may allow an attacker to gain unauthenticated access to shares that allow both anonymous and user logins. No further details have been provided.

[CLOSE] OSVDB ID : 8508 - Disclosed: 2004-08-10

Description:

Symantec Clientless VPN Gateway contains a flaw related to the ActiveX file browser. No further details have been provided.

[CLOSE] OSVDB ID : 8509 - Disclosed: 2004-08-10

Description:

Symantec Clientless VPN Gateway contains a flaw related to the end user UI (user interface) that may allow an attacker to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.. No further details have been provided.

[CLOSE] OSVDB ID : 8510 - Disclosed: 2004-08-10

Description:

Symantec Clientless VPN Gateway contains a flaw that may allow an attacker to change the single signon credentials of arbitrary users through the end user UI. No further details have been provided.

[CLOSE] OSVDB ID : 8511 - Disclosed: 2004-08-10

Description:

Symantec Clientless VPN Gateway contains a flaw related to the HTML file browser. No further details have been provided.

[CLOSE] OSVDB ID : 8512 - Disclosed: 2004-08-10

Description:

Symantec Corporation Clientless VPN Gateway contains a flaw related to the ActiveX file browser that may allow an attacker to cause the browser to behave incorrectly when an empty username and password are supplied. No further details have been provided.

[CLOSE] OSVDB ID : 8430 - Disclosed: 2004-08-10

Description:

Apple Safari contains a flaw that may lead to an unauthorized information disclosure.  The issue is triggered when a web form is sent to a server using a POST method which issues an HTTP redirect to a GET method url. If the user uses the back/forward buttons in the browser safari will re-post the form data to get the URL which will disclose the form information resulting in a loss of confidentiality.

[CLOSE] OSVDB ID : 8431 - Disclosed: 2004-08-10

Description:

The implementation of the TCP/IP stack of multiple vendors contains a flaw that may allow a remote denial of service. The issue is triggered when sending a specially crafted sequence of fragmented ICMP packets which will cause the system to consume all available CPU resources during the defragmentation process (a.k.a. the 'rose attack'), which will result in loss of availability for the platform.

[CLOSE] OSVDB ID : 9530 - Disclosed: 2004-08-09

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 8411 - Disclosed: 2004-08-09

Description:

IBM Tivoli Access Manager contains a flaw related to HTTP Response that may allow an attacker to conduct a cross site scripting attack. No further details have been provided.

[CLOSE] OSVDB ID : 8410 - Disclosed: 2004-08-09

Description:

HP Process Resource Manager (PRM) contains a flaw that may allow a local attacker to corrupt files. No further details have been provided.

[CLOSE] OSVDB ID : 8398 - Disclosed: 2004-08-09

Description:

A remote overflow exists in AOL Instant Messenger. Instant Messenger fails to correctly limit the size of the value passed to the goaway function in the away feature resulting in a buffer overflow. A malicous user can create a specially crafted URI link that uses the 'aim:' handler and a long message value for the goaway parameter and post the link to a webpage or email. When a victim clicks on this link, or views an html document that invokes this link (such as <iframe>), the code included in the malicious URI may overwrite a Structured Exception Handler pointer which may be used to insert arbitrary code onto the stack. Once on the stack, the arbitrary code could then be executed resulting in a loss of integrity.

[CLOSE] OSVDB ID : 8412 - Disclosed: 2004-08-09

Description:

Simple Form contains a flaw that may allow a malicious user to use the server as an open mail relay. The issue is triggered when input passed to "admin_email_to" and "admin_email_from" is not properly verified prior to submission. It is possible that the flaw may allow the server to act as an open relay resulting in a loss of availability.

[CLOSE] OSVDB ID : 8404 - Disclosed: 2004-08-09

Description:

Solaris X Display Manager contains a flaw that may allow a remote denial of service. The issue is triggered when a malicious user issues an invalid X Display Manager Control Protocol (XDMCP) request via a UDP packet to port 177, and will result in loss of availability for the service.

[CLOSE] OSVDB ID : 8406 - Disclosed: 2004-08-09

Description:

Cfengine contains a flaw that may allow a remote denial of service. The problem is that the 'AuthenticationDialogue()' function does not properly check the return value of the 'ReceiveTransaction()' function. With a specially crafted request, a remote attacker could crash the daemon resulting in a loss of availability.

[CLOSE] OSVDB ID : 9273 - Disclosed: 2004-08-09

Description:

(Description Provided by CVE) : Certain USB drivers in the Linux 2.4 kernel use the copy_to_user function on uninitialized structures, which could allow local users to obtain sensitive information by reading memory that was not cleared from previous usage.

[CLOSE] OSVDB ID : 14664 - Disclosed: 2004-08-09

Description:

A remote overflow exists in Cfengine. The 'AuthenticationDialogue()' function fails to perform proper bounds checking resulting in a buffer overflow. With an overly long 'SAUTH' command during RSA authentication, a remote attacker can cause arbitrary code execution resulting in a loss of integrity.

[CLOSE] OSVDB ID : 61196 - Disclosed: 2004-08-09

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 5070 - Disclosed: 2004-08-08

Description:

(Description Provided by CVE) : Buffer overflow in Sun ONE / iPlanet Web Server 4.1 and 6.0 allows remote attackers to execute arbitrary code via an HTTP request using chunked transfer encoding.

[CLOSE] OSVDB ID : 26538 - Disclosed: 2004-08-08

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 10910 - Disclosed: 2004-08-08

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 43165 - Disclosed: 2004-08-08

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 8937 - Disclosed: 2004-08-08

Description:

Gyach Enhanced contains several flaws. No further details have been provided.

[CLOSE] OSVDB ID : 8938 - Disclosed: 2004-08-08

Description:

Gyach Enhanced contains a flaw related to the handling of conference packets containing error messages that may allow an attacker to crash the application. No further details have been provided.

[CLOSE] OSVDB ID : 8409 - Disclosed: 2004-08-08

Description:

(Description Provided by CVE) : Stack-based buffer overflow in Xine-lib-rc5 in xine-lib 1_rc5-r2 and earlier allows remote attackers to execute arbitrary code via crafted playlists that result in a long vcd:// URL.

[CLOSE] OSVDB ID : 8936 - Disclosed: 2004-08-08

Description:

According to the adivsory, the 'page.cgi' script apparently contains a flaw that may allow an attacker to execute arbitrary commands. However, the flaw could not confirmed.