Gleb Gritsay

The issue concerns the remote-management module in certain Siemens products, where credentials are not properly encrypted in transit. This makes it easier for remote attackers to determine cleartext credentials by sniffing the network and conducting a decryption attack.

The issue is related to the use of a weak hash algorithm for passwords, making it easier for remote attackers to obtain access via a brute-force attack. This weakness allows an attacker to potentially elevate their privileges using a full brute-force method.

The issue allows remote authenticated users to gain privileges via a request to the TCP port 1433. It is related to errors that occur when processing a specially crafted command on the database server. This can be exploited by authorized users to elevate their privileges in the database.

The issue allows remote attackers to execute arbitrary code or cause a denial of service due to unrestricted size and amount values.

A SQL injection issue allows remote attackers to execute arbitrary SQL commands.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

The issue is related to the improper representation of WebNavigator credentials in a database. This makes it easier for remote authenticated users to obtain sensitive information via a SQL query.

The issue is related to a buffer overflow in the RegReader ActiveX control. This allows remote attackers to execute arbitrary code via a long parameter.

A cross-site scripting (XSS) issue exists in the SIP implementation, allowing remote attackers to inject arbitrary web script or HTML via the `FROM` field of an INVITE message.