Vulnerabilidades

Computer Associates (CA) Message Queuing (CAM / CAFT) 1.05, 1.07 before Build 220_13, and 1.11 before Build 29_13 allows remote attackers to execute arbitrary commands via spoofed CAFT packets.

Los rúter inalámbricos Belkin 54g no fijan adecuadamente el password de administración, lo que permite que atacantes remotos ganen acceso mediante las interfaces de administración de Telnet o de web.

Multiple TCP implementations with Protection Against Wrapped Sequence Numbers (PAWS) with the timestamps option enabled allow remote attackers to cause a denial of service (connection loss) via a spoofed packet with a large timer value, which causes the host to discard later packets because they appear to be too old.

Belkin 54G (F5D7130) wireless router allows remote attackers to access restricted resources by sniffing URIs from UPNP datagrams, then accessing those URIs, which do not require authentication.

diatheke.pl in Sword 1.5.7a allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.

The SNMP service in the Belkin 54G (F5D7130) wireless router allows remote attackers to cause a denial of service via unknown vectors.

Directory traversal vulnerability in LimeWire 3.9.6 through 4.6.0 allows remote attackers to read arbitrary files via a .. (dot dot) in a magnet request.

LimeWire 4.1.2 through 4.5.6 allows remote attackers to read arbitrary files by specifying the full pathname in a Gnutella GET request.

A design error in the IEEE1394 specification allows attackers with physical access to a device to read and write to sensitive memory using a modified FireWire/IEEE 1394 client, thus bypassing intended restrictions that would normally require greater degrees of physical access to exploit. NOTE: this was reported in…

vsdatant.sys in Zone Lab ZoneAlarm before 5.5.062.011, ZoneAlarm Wireless before 5.5.080.000, Check Point Integrity Client 4.x before 4.5.122.000 and 5.x before 5.1.556.166 do not properly verify that the ServerPortName argument to the NtConnectPort function is a valid memory address, which allows local users to cause…

SQL injection vulnerability in IP3 Networks NetAccess Appliance before firmware 3.1.18b13 allows remote attackers to bypass authentication via the (1) login or (2) password. NOTE: this issue was later reported to also affect firmware 4.0.34.

Sweex Wireless Broadband Router/Accesspoint 802.11g (LC000060) allows remote attackers to obtain sensitive information and gain privileges by using TFTP to download the nvram file, then extracting the username, password, and other data from the file.

Directory traversal vulnerability in wra/public/wralogin in 2Wire Gateway, possibly as used in HomePortal and other product lines, allows remote attackers to read arbitrary files via a .. (dot dot) in the return parameter. NOTE: this issue was reported as XSS, but this might be a terminology error.

The NAT implementation in Zonet ZSR1104WE Wireless Router Runtime Code Version 2.41 converts IP addresses of inbound connections to the IP address of the router, which allows remote attackers to bypass intended security restrictions.

El interfaz de administración Web de Microsoft MN-500 Wireless Router permite a atacantes remotos causar una denegación de servicio (rechazo de conexión) mediante un número largo de conexiones HTTP.

El encaminador ADSL inalámbrico BT Voyager 2000 tiene un nombre de comunidad SNMP público por defecto, lo que permite a atacantes remotos obtener información sensible, como la contraseña, que se almacena en texto claro.

Vulnerabildad de cadena de formato en Tripwire commercial 4.0.1 y anteriores, incluyendo 2.4, y open source 2.3.1 y anteriores permite a usuarios locales ganar privilegios mediante especificadores de cadena de formato en el nombre del ficheros, que es usado para la generación de un informe de correo electrónico.

WpQuiz 2.60b1 through 2.60b8 allows remote attackers to gain privileges via a direct request to adminrestore.php in the extras directory.

El algoritmo de identificicación de canal vacio (Clear Channel Assessment - CCA) en el protocolo inalámbrico IEEE 802.11, cuando usa codificación de trasmisión de codificación DSSS, permite a atacantes remotos causar una denegación de servicio mediante ciertas señales de RF que causan que el canel aparezca ocupado…

Cisco Wireless LAN Solution Engine (WLSE) 2.0 through 2.5 and Hosting Solution Engine (HSE) 1.7 through 1.7.3 have a hardcoded username and password, which allows remote attackers to add new users, modify existing users, and change configuration.

Múltiples vulnerabilidades en la implementación del protocolo H.323 en Nortel Networks Communications Manager (BCM), Succession 1000 IP Trunk and IP Peer Networking, y 802.11 Wireless IP Gateway permite a atacantes remotos causar una denegación de servicio y posiblemente ejecutar código arbitrario, como se demostró…

The backup configuration file for Microsoft MN-500 wireless base station stores administrative passwords in plaintext, which allows local users to gain access.

TFTP server in Longshine Wireless Access Point (WAP) LCS-883R-AC-B, and in D-Link DI-614+ 2.0 which is based on it, allows remote attackers to obtain the WEP secret and gain administrator privileges by downloading the configuration file (config.img) and other files without authentication.

Desbordamiento de búfer en iwconfig (cuando tiene instalado un setuid ) permite que usuarios locales ejecuten código arbitrario mediante una variable de entorno OUT muy larga.

Desbordamiento de búfer en iwconfig permite que usuarios locales ejecuten código arbitrario mediante una variable de entorno HOME demasiado larga.