[scip_Advisory 10847] MobileIron 4.5.4 Device Registration regpin Cross Site Scripting

AG, Zuerich, Switzerland pasc-at-scip.ch http://www.scip.ch The disclosure process has been handled by Marc Ruef. Marc Ruef, scip AG, Zuerich, Switzerland maru-at-scip.ch http://www.scip.ch A1. LEGAL NOTICES Copyright (c) 2002-2013 scip AG, Switzerland. Permission is granted for the re

[scip_Advisory 4143] Shemes Grabbit Malicious NZB Date Denial of Service

://www.shemes.com/index.php?p=download II. DESCRIPTION Marc Ruef at scip AG found a denial of service vulnerability in the current release up to GrabIt 1.7.2 ßeta 4. An attacker is able to provide a malicious nzb file which will cause a freeze of the application. III. EXPLOITATION The attack

[scip_Advisory 4142] Skype Client for Mac Chat Unicode Denial of Service

at the following URL: http://www.skype.com II. DESCRIPTION Marc Ruef at scip AG found a denial of service vulnerability in the current release for Apple MacOS X (version 2.8). The application provides the possibility of sending messages to other Skype users via the embedded chat feature

[scip_Advisory 4021] IBM Lotus Notes 8.5 RSS Widget Privilege Escalation

product web site at the following URL: http://www.ibm.com/software/lotus/products/notes/ II. DESCRIPTION Marc Ruef at scip AG found a design vulnerability in the current Release 8.5. The product provides some widgets which can be added and enabled by the user. One of those widgets provide a simple

[scip_Advisory 3809] Pro2col StingRay FTS login username cross site scripting

the device. More information is available on the official product web site at the following URL: http://pro2col.com/solutions/products/stingray_fts II. DESCRIPTION Marc Ruef at scip AG found an input validation error within the current release. The initial logon script at /login.jsp

[scip_Advisory 3808] D-Link DIR-100 long url filter evasion

at the official product web site (German link): http://www.dlink.de/?go=gNTyP9CgrdFOIC4AStFCF834mptYKO9ZTdvhLPG3yV3oV492gqltbNlwaaFp6DQoHDrpxC5H+40AAdvl II. DESCRIPTION Marc Ruef at scip AG found a possibility to evade url filters of the web proxy to prevent access to web sites. An attacker might add

[scip_Advisory 3807] Dreambox DM500 webserver long URL request denial of service

by German multimedia vendor Dream Multimedia. More information is available at the official product web site at the following URL: http://www.dream-multimedia-tv.de/ II. DESCRIPTION Marc Ruef at scip AG found an input validation error within the web interface of the model DM500C. Other models

[scip_Advisory 3159] SiteScape forum prior 7.3 Cross Site Scripting

. DESCRIPTION Marc Ruef at scip AG found an input validation error within SiteScape Forum prior release 7.3. Some scripts that are not protected by any authentication procedure can be used to run arbitrary script code within a cross site scripting attack. Other parts of the application might

[scip_Advisory 2456] Horde Framework and Horde IMP /index.php cross site referencing

mail client, a groupware and wiki solution. More information is available on the official Horde product web site at the following URL: http://www.horde.org/ II. DESCRIPTION Marc Ruef found several web-based vulnerabilities that were identified in Horde 3.0.4 and verified for all versions

[scip_Advisory 2457] Horde Framework and Horde IMP /horde/imp/search.php cross site scripting

mail client, a groupware and wiki solution. More information is available on the official Horde product web site at the following URL: http://www.horde.org/ II. DESCRIPTION Marc Ruef found several web-based vulnerabilities that were identified in Horde 3.0.4 and verified for all versions prior

[scip_Advisory 2351] Kyberna AG ky2help various form fields SQL Injection

are handled by the pool of registred support people. More Information are available on the official Kyberna AG product web site at the following URLs: http://www.kyberna.com http://www.ky2help.com II. DESCRIPTION Marc Ruef found an SQL injection vulnerability in ky2help. Some

[scip_Advisory 2352] F5 FirePass 4100 prior 6.x multiple Cross Site Scripting

to corporate applications and data is provided using a standard web browser. More Information are available on the official FirePass product web site at the following URL: http://www.f5.com/products/FirePass/ II. DESCRIPTION Marc Ruef found several cross site scripting vulnerabilities in the F5

[scip_Advisory] NetGear RP114 Flooding Denial of Service

products is RP114, a hub device with additional routing, packet and simple content filtering functionality. More Information are available at the official NetGear web site: http://www.netgear.com II. DESCRIPTION Marc Ruef found an old fashioned denial of service flaw in this device. By starting

[scip_Advisory] e107 v0.6 rate.php manipulation

. More Information are available at the official project web site: http://e107.org II. DESCRIPTION Marc Ruef detected two flaws in rate.php. This file is responsible for the votes of the users to rate content (e.g. the downloads). This voting is served by default with an option combobox

Netscape Communicator 4.x sensitive informations in configuration file

Hi! It seems that I'm one of the last Netscape 4.x users. During my research for using roaming profiles I've checked a file named prefs.js in my netscape folder (C:\Program Files\Netscape\Users\mruef). The following paste shows the IMAP mail part of this configuration file. You can see that the

Re: Riched20.DLL attribute label buffer overflow vulnerability

In-Reply-To: [EMAIL PROTECTED] Hi! Can't reproduce it on riched20.dll v.3.0 (5.30.23.1200) under NT. It seems that my Windows XP Professional with riched20.dll v3.0 5.30.23.1211 is not vulnerable too. In http://www.securityfocus.com/bid/6874/discussion/ the following remark can be found:

Denial of service against Kazaa Media Desktop v2

Hi! It is possible to cause a remote denial of service attack against Kazaa Media Desktop v2. If you can inject a malicous response for the automated ad download of the client, you can cause a bufferoverflow and the denial of service. It may be possible to run arbitary code with this

Missing admin sql password in Okena StormWatch

Hi! I was working with Okena StormWatch[1] - a really interesting commercial intrusion prevention product - and saw that there is the SQL password for the admin account (sa) missing. With a SQL client and a blank password it's possible for everyone who can connect to the manager to compromise

Bypassing website filter in SonicWall

Hi! I found a little weakness in SonicWall: I turn on the blocking mechanism for websites (e.g. www.google.com). Now I can't reach the website using the domainname. But if I choose the IP address of the host (e.g. http://216.239.53.101/), I can contact the forbidden website. The same issue I've

Directory traversal in Daniel Arenz' Mini Server

Hi! There is a directory traversal flaw in Daniel Arenz' Mini Server 2.1.6 (tested on Windows XP Professional). It could be that prior versions are also affected. It's possible to show every by the web server readable file on the target system by using one of the following URLs:

Long URL causes TelCondex SimpleWebServer to crash

Hi! I've found a vulnerability in TelCondex SimpleWebServer 2.06.20817 Build 3128 (tested on Windows XP Professional). It could be that prior versions are also affected. It's possible to crash the web server application with a long URL (starting from 539 Chars)[1]. You'll see a popup message on

Long URL crashes My Web Server 1.0.2

Hi! I found a security bug in the My Web Server 1.0.2 [Build 03.27.02] (tested on Windows XP Professional). It could be that prior version are also affected. It's possible to crash the webserver with a very long request like this[1]: http://192.168.0.2/AAA...(approx. Ax994)...AAA Sometimes the

TCP flood against NetGear FM114P

Hi! I've got a lot of availability trouble with my NetGear FM114P. After asking the support and no good answer I started doing some test for myself. It seems possible to crash the NetGear FM114P with many TCP connects. I did some tests on my FM114P firmware Version 1.3 Release 05 and these are

Plain text DDNS password in NetGear FM114P backups

Hi! I was checking the vulnerability NETGEAR FVS318 Firewall Router Username/Password Disclosure[1] on my NetGear FM114P. My little box doesn't store the web login username and password in plain text. But the DDNS (DynDNS) account data is stored in plaintext; this problem seems to be existent

Bypassing the Finjan SurfinGate URL filter

Hi! I've found two possibilities to bypass the Finjan SurfinGate URL filter - Tested with Finjan SurfinGate 6.0x on Windows NT 4.0 and 2000. 1. IP Tunnel Normally humans use domain- and hostnames instead of IP addresses. Most users will add entries like www.computec.ch in the URL list of