FreeNAS contains a flaw in the exec_raw.php script related to the improper validation of input passed via the 'cmd' parameter. With a specially crafted request, a remote attacker may be able to execute arbitrary commands.
Research Advisory
A vulnerability has been identified in HP Systems Insight Manager (SIM) for HP-UX, Linux, and Windows. The issue is due to the 'logfile' parameter in switchFWInstallStatus.jsp not properly sanitizing user-supplied input. With a crafted HEAD request, a remote unauthenticated attacker can disclose arbitrary files with SYSTEM or root privileges.
Research Advisory
During the analysis of PMASA-2010-5 and developing a Nesuss plugin, it was discovered that the 'Verbose server name' field in /setup/index.php does not properly sanitize user-supplied input before being passed to setup/frames/index.inc.php, leading to a stored cross-site scripting issue.
Research Advisory
HP Mercury LoadRunner contains a flaw within the process magentproc.exe that binds to TCP port 54345. A specially crafted packet will allow unauthenticated users to execute local commands. When a state of 0 or 4 is passed after the parameters, mchan.dll will process the commands on the host. This allows for remote code execution under the context of the SYSTEM user.
Research Advisory
Stack-based buffer overflow in OmniInet.exe (aka the backup client service daemon) in the Application Recovery Manager component in HP OpenView Storage Data Protector 5.50 and 6.0 allows remote attackers to execute arbitrary code via an MSG_PROTOCOL command with long arguments, a different vulnerability than CVE-2009-3844.
Research Advisory
The Movable Type installation on the remote web server is leaking information via mt-check.cgi. This CGI determines if the Perl modules required by Movable Type are installed, and is only intended to be used prior to installation. It discloses path information, operating system type, Perl version, and the versions of several Perl modules.
Research Advisory
This was originally disclosed via a vendor advisory that did not make it clear that two distinct vulnerabilities were present. CVE described it as one flaw calling it a "static code injection vulnerability in the getConfigFile function in setup/lib/ConfigFile.class.php ...
Research Advisory
A buffer overflow exists in Acrobat and Reader. The getIcon() method fails to validate string arguments resulting in a stack overflow. With a specially crafted PDF file, a context-dependent attacker can cause arbitrary code execution resulting in a loss of integrity.
Research Advisory
The management console in the Volume Manager Scheduler Service (aka VxSchedService.exe) in Symantec Veritas Storage Foundation for Windows (SFW) 5.0, 5.0 RP1a, and 5.1 accepts NULL NTLMSSP authentication, which allows remote attackers to execute arbitrary code via requests to the service socket that create "snapshots schedules" registry values specifying future command execution.
Research Advisory
Buffer overflow in the sw_rpc_agent_init function in swagentd in Software Distributor (SD), and possibly other DCE applications, in HP HP-UX B.11.11 and B.11.23 allows remote attackers to execute arbitrary code or cause a denial of service via malformed arguments in an opcode 0x04 DCE RPC request.