Vulnerabilidades

Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en auth/message.php de HIOX Star Rating System Script (HSRS) 1.0 y anteriores permite a atacantes remotos ejecutar secuencias de comandos web o HTML de su elección mediante la cadena de consulta (PHP_SELF). NOTA: la procedencia de esta información es…

Vulnerabilidad de inclusión remota de archivo en PHP en addcode.php de HIOX Star Rating System Script (HSRS) 1.0 y anteriores permite a atacantes remotos ejecutar código PHP de su elección mediante una URL en el parámetro hm.

Engenio/LSI Logic storage controllers, as used in products such as Storagetek D280, and IBM DS4100 (formerly FastT 100) and Brocade SilkWorm Switches, allow remote attackers to cause a denial of service (freeze and possible data corruption) via crafted TCP packets.

Hard link and possibly symbolic link following vulnerabilities in QNX RTOS 4.25 (aka QNX4) allow local users to overwrite arbitrary files via (1) the -f argument to the monitor utility, (2) the -d argument to dumper, (3) the -c argument to crttrap, or (4) using the Watcom sample utility.

The Web interface to Cisco 600 routers running CBOS 2.4.1 and earlier allow remote attackers to cause a denial of service via a URL that does not end in a space character.

Cisco 600 routers running CBOS 2.4.1 and earlier allow remote attackers to cause a denial of service via a large ICMP echo (ping) packet.

CBOS 2.4.1 and earlier in Cisco 600 routers allows remote attackers to cause a denial of service via a slow stream of TCP SYN packets.

The Cisco Web Management interface in routers running CBOS 2.4.1 and earlier does not log invalid logins, which allows remote attackers to guess passwords without detection.