Massive Panda

**Name of the Vulnerable Software and Affected Versions** Memcached versions 1.4.5 and earlier Memcached versions prior to 1.4.17 **Description** The issue involves multiple integer signedness errors in certain functions, including `process bin sasl auth`, `process bin complete sasl auth`, `process bin update`, and `process bin append prepend`. These errors can be exploited by remote attackers to cause a denial of service, specifically a crash, by sending a packet with a large body length value. Additionally, the vulnerabilities may lead to breaches of confidentiality, integrity, and availability of protected information. **Recommendations** For Memcached versions 1.4.5 and earlier, consider updating to a version later than 1.4.17 to resolve the issue. For Memcached versions prior to 1.4.17, update to version 1.4.17 or later to fix the vulnerabilities. As a temporary workaround, consider restricting access to the `process bin sasl auth`, `process bin complete sasl auth`, `process bin update`, and `process bin append prepend` functions until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Mavili Guestbook (affected versions not specified) **Description** The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the `id` parameter to several API endpoints: "approve.asp", "delete.asp", "edit.asp", or "edit2.asp". **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mavili Guestbook (affected versions not specified) **Description** The issue allows remote attackers to execute arbitrary SQL commands via the `id` parameter in the "edit.asp" file. This enables attackers to manipulate the database by injecting malicious SQL code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mavili Guestbook version as released in November 2007 **Description** The issue concerns insufficient access control to the guestbook.mdb database. This allows remote attackers to read the database by making a direct request to it. **Recommendations** For the version as released in November 2007, consider restricting access to the guestbook.mdb file to prevent remote reading of the database.

**Name of the Vulnerable Software and Affected Versions** Mavili Guestbook version released in November 2007 **Description** The issue allows remote attackers to edit, delete, and approve arbitrary messages. This can be achieved by making a direct request to API endpoints such as "edit.asp", "delete.asp", or "approve.asp". **Recommendations** For the version released in November 2007, consider restricting access to the "edit.asp", "delete.asp", and "approve.asp" API endpoints to prevent unauthorized message editing, deletion, and approval. At the moment, there is no information about a newer version that contains a fix for this issue.