Carsten Eiram

The issue allows remote attackers to obtain access by setting the value of `objresp.authenabled` to 1, due to the device relying on the client to perform authentication.

The issue concerns multiple cross-site request forgery (CSRF) vulnerabilities. These vulnerabilities allow remote attackers to hijack the authentication of arbitrary users.

The issue allows remote attackers to obtain access via the web management interface due to a hardcoded password of `admin` for the `admin` account.

The issue allows remote attackers to conduct man-in-the-middle attacks against HTTPS sessions. This is due to the use of a hardcoded X.509 certificate from an OpenSSL Test Certification Authority, which creates a trust relationship that can be exploited.

The issue allows remote attackers to bypass authentication and change settings via a JSON API call.

The issue allows remote attackers to bypass authentication by making a direct request to a page other than index.html.

The issue is related to a buffer overflow condition that may cause the system to crash or allow remote code execution. Technical details include the exploitation of various components and methods, such as `IVLCControl` `setStreamRecordData`, `RTSPVIDEO.rtspvideoCtrl.1` `Open3`, `IVLCControl` `setRecordPrefix`, `VLCControl` `setUserInfoData` `strIP`, `RTSPVIDEO.rtspvideoCtrl.1` `AudioRecord` method `fullfilename` parameter, `RTSPVIDEO.rtspvideoCtrl.1` `Open` and `Open2`, `VLCPlugin` ActiveX Control `setUserInfoData` `strUserName`, and `IVLCControl` `setConfigPath`.

The issue is related to a buffer overflow condition that may cause the system to crash or allow remote code execution. The `ip` argument in the `AudioRecord` method of `RTSPVIDEO.rtspvideoCtrl.1` is vulnerable to remote code execution.

The issue concerns multiple buffer overflows in the PocketNetNVRMediaClientAxCtrl.NVRMediaViewer.1 control, allowing remote attackers to execute arbitrary code. This can be achieved via a crafted string to various methods, including `StartRecord()`, `StartRecordEx()`, `StartScheduledRecord()`, `SetDisplayText()`, `GetONVIFDeviceInformation()`, `GetONVIFProfiles()`, and `GetONVIFStreamUri()`, or a crafted filename to `SaveCurrentImage()` or `SaveCurrentImageEx()`. No information is provided about the estimated number of potentially affected devices or real-world incidents.

The issue allows remote attackers to execute arbitrary code via a crafted `lModule` parameter that triggers use of an arbitrary memory address as a function pointer. This occurs in the `StopModule` method.

The issue allows remote attackers to execute arbitrary code due to multiple stack-based buffer overflows. This can occur through various methods, including a long `bstrUrl` parameter to the `StartModule` method, a long `bstrParams` parameter to the `Check` method, or a long `bstrUrl` parameter to the `Download` or `DownloadModule` method during the construction of a .ntr pathname or a URL.

A buffer overflow issue exists in the TIFF image converter within the graphics filters of the affected software, allowing remote attackers to execute arbitrary code through a crafted TIFF image in an Office document.

The issue is caused by an array-indexing error when parsing Sorenson Video 3 content, which can lead to memory corruption during decompression via a specially crafted file. This can be exploited to execute arbitrary code or cause a denial of service, resulting in a memory corruption and application crash.

A use-after-free issue allows remote attackers to cause a denial of service or possibly execute arbitrary code via vectors involving the display of a blocked popup window during navigation to a different web site.

Name of the Vulnerable Software and Affected Versions: Mozilla Firefox versions prior to 3.0.11 Description: A race condition in the NPObjWrapper NewResolve function might allow remote attackers to execute arbitrary code via a page transition during Java applet loading, related to a use-after-free vulnerability for memory associated with a destroyed Java object. Recommendations: For versions prior to 3.0.11, update to version 3.0.11 or later to resolve the issue. As a temporary workaround, consider disabling Java applet loading until a patch is available. Restrict access to pages that load Java applets to minimize the risk of exploitation.

The issue allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted movie composed of a Sorenson 3 video file.

Name of the Vulnerable Software and Affected Versions: Microsoft Visual Basic 6.0 Microsoft Visual FoxPro versions 8.0 SP1 through 9.0 SP2 Description: The issue is related to multiple integer overflows in the Hierarchical FlexGrid ActiveX control, which allows remote attackers to execute arbitrary code. This is achieved by crafting specific properties, such as `Rows` and `Cols`, to the `ExpandAll` and `CollapseAll` methods. The exploitation is linked to the access of incorrectly initialized objects and the corruption of the system state. Recommendations: For Microsoft Visual Basic 6.0, update to a version that includes the fix for the Hierarchical FlexGrid Control Memory Corruption issue. For Microsoft Visual FoxPro versions 8.0 SP1 through 9.0 SP2, update to a version that includes the fix for the Hierarchical FlexGrid Control Memory Corruption issue. As a temporary workaround, consider restricting access to the Hierarchical FlexGrid ActiveX control until a patch is available.

Name of the Vulnerable Software and Affected Versions: Novell iPrint Client versions 4.x before 4.38 Novell iPrint Client versions 5.x before 5.08 Description: The issue is related to multiple heap-based buffer overflows in the IppCreateServerRef function. This can be exploited by remote attackers to execute arbitrary code via a long argument to certain functions in the Novell iPrint ActiveX control. The affected functions include `GetPrinterURLList`, `GetPrinterURLList2`, and `GetFileList2`. Recommendations: For Novell iPrint Client versions 4.x before 4.38, update to version 4.38 or later. For Novell iPrint Client versions 5.x before 5.08, update to version 5.08 or later.

A use-after-free issue allows remote attackers to execute arbitrary code via a crafted data stream that triggers memory corruption. This can be achieved by constructing a specially crafted Web page that exploits the way Internet Explorer processes data streams. If successfully exploited, an attacker could gain the same user rights as the logged on user.

A remote code execution issue exists in the way Microsoft Agent handles certain specially crafted URLs, resulting in memory corruption. This allows remote attackers to execute arbitrary code.