Luca Carettoni

The issue allows XXE (XML External Entity) attacks, which can provide access to potentially sensitive information on the filesystem of the Hudson master server. This is due to a flaw in the XML API processing.

The issue allows remote attackers to bypass the httpOnly flag on cookies, potentially obtaining sensitive information. This is due to improper validation of cookie name and value characters.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

The issue allows remote attackers to cause a denial of service, leading to file-descriptor exhaustion and potentially causing the broker to crash or hang. This is achieved by sending many openwire failover:tcp:// connection requests.

The issue is related to a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML. This is achieved through vectors related to the loading of modules from different domains.

A stack-based buffer overflow issue allows remote attackers to execute arbitrary code via a long control hostname to TCP port 5405.

Name of the Vulnerable Software and Affected Versions: DFLabs PTK versions 0.1 through 1.0 Description: The issue allows remote attackers to execute arbitrary commands via shell metacharacters after an arg1= sequence in a filename within a forensic image. This is due to a problem in the get file type function in lib/file content.php. Recommendations: For DFLabs PTK versions 0.1 through 1.0, consider restricting access to the get file type function in lib/file content.php until a patch is available. As a temporary workaround, avoid using filenames with shell metacharacters after an arg1= sequence in a forensic image.

The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the `type` parameter in a NoAuthREQ x509List action, specifically targeting the "cgi-bin/kerbynet" endpoint.

A cross-site scripting (XSS) issue exists in the web server component, allowing remote attackers to inject arbitrary web script or HTML via the request URL. This occurs because the web server does not properly handle the request URL in a 404 web error page.

The issue allows remote authenticated users to read arbitrary files via a .. (dot dot) in a GET request to API endpoints such as `/` or other unspecified endpoints, by manipulating the `file path` variable. This can potentially expose sensitive files, including `save.dat` and `apply.log`, which may contain credentials like the Skype username and password.

The issue concerns a back door "service" account with a predefined password, making it easier for remote attackers to gain access.

Name of the Vulnerable Software and Affected Versions: Boa version 0.93.15 Description: The issue allows remote attackers to change the admin password stored in memory by sending a long username in an HTTP Basic Authentication request. This is due to the failure of the Intersil isl3893 extensions to prevent stack writes from entering memory locations used for string constants. Recommendations: For Boa version 0.93.15, consider restricting access to the HTTP Basic Authentication endpoint until a fix is available. As a temporary workaround, avoid using the `username` variable in the affected API endpoint, such as "/api/v1/login", to minimize the risk of exploitation.

The issue allows remote attackers to obtain sensitive information, including intranet IP addresses and enumerations of valid parameter values, by making a direct request to `hc`. This sensitive information is revealed in an error message or a cookie.

The issue allows remote attackers to access the Telnet port without authentication by sending certain packets to the web interface, causing it to freeze. This could potentially affect other products, including Ericsson HN294dp and Dynalink RTA300W.