CVSS: 5.7EPSS: 0%CPEs: 1EXPL: 1CVE-2018-3815 – CommuniGatePro 6.2 Missing XIMSS Tag Validation
https://notcve.org/view.php?id=CVE-2018-3815
The "XML Interface to Messaging, Scheduling, and Signaling" (XIMSS) protocol implementation in CommuniGate Pro (CGP) 6.2 suffers from a Missing XIMSS Protocol Validation attack that leads to an email spoofing attack, allowing a malicious authenticated attacker to send a message from any source email address. The attack uses an HTTP POST request to a /Session URI, and interchanges the XML From and To elements. La implementación en el protocolo XIMSS (XML Interface to Messaging, Scheduling, and Signaling) en CommuniGate Pro (CGP) 6.2 sufre un ataque basado en la ausencia de validación del protocolo XIMSS que conduce a un ataque de suplantación de email, permitiendo a un atacante autenticado malicioso enviar un mensaje desde cualquier dirección de correo. El ataque utiliza una petición HTTP POST a la URI /Session e intercambia los elementos XML "From" y "To". CommunigatePro XML Interface to Messaging, Scheduling, and Signaling protocol ("XIMSS") version 6.2 suffers from a missing XIMSS protocol validation vulnerability that can lead to an email spoofing attack. • https://packetstormsecurity.com/files/145724/communigatepro62-spoof • CWE-287: Improper Authentication •
CVSS: 5.0EPSS: 11%CPEs: 1EXPL: 2CVE-2008-6702 – S.T.A.L.K.E.R. 1.0.06 - Remote Denial of Service
https://notcve.org/view.php?id=CVE-2008-6702
S.T.A.L.K.E.R.: Shadow of Chernobyl 1.0006 and earlier allows remote attackers to cause a denial of service (crash) via a long nickname, which triggers an exception. S.T.A.L.K.E.R.: Shadow of Chernobyl v1.0006 y anteriores, permite a atacantes remotos provocar una denegación de servicio (caída) a través de una nickname largo, lo que provoca una excepción. • https://www.exploit-db.com/exploits/31919 http://aluigi.altervista.org/adv/stalkerboom-adv.txt http://osvdb.org/46432 http://secunia.com/advisories/30707 http://www.securityfocus.com/archive/1/493366/100/0/threaded http://www.securityfocus.com/bid/29723 http://www.securityfocus.com/bid/29997 https://exchange.xforce.ibmcloud.com/vulnerabilities/43132 • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 18%CPEs: 1EXPL: 2CVE-2008-6703 – S.T.A.L.K.E.R Shadow of Chernobyl 1.0006 - Multiple Remote Vulnerabilities
https://notcve.org/view.php?id=CVE-2008-6703
Stack-based buffer overflow in the IPureServer::_Recieve function in S.T.A.L.K.E.R.: Shadow of Chernobyl 1.0006 and earlier allows remote attackers to execute arbitrary code via a compressed 0x39 packet, which is decompressed by the NET_Compressor::Decompress function. Desbordamiento de búfer basado en pila en la función IPureServer::_Recieve en S.T.A.L.K.E.R.: Shadow of Chernobyl v1.0006 y anteriores, permite a atacantes remotos ejecutar código de su elección a través de un paquete 0x39 comprimido, que es descomprimido por la función NET_Compressor::Decompress. • https://www.exploit-db.com/exploits/31998 http://aluigi.altervista.org/adv/stalker39x-adv.txt http://osvdb.org/46626 http://secunia.com/advisories/30891 http://www.securityfocus.com/archive/1/493765 http://www.securityfocus.com/bid/29997 https://exchange.xforce.ibmcloud.com/vulnerabilities/43454 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.0EPSS: 2%CPEs: 1EXPL: 1CVE-2008-6705
https://notcve.org/view.php?id=CVE-2008-6705
The MultipacketReciever::RecievePacket function in S.T.A.L.K.E.R.: Shadow of Chernobyl 1.0006 and earlier allows remote attackers to cause a denial of service (server termination) via a crafted packet without an expected 0xe0 or 0xe1 value, which triggers the INT3 instruction. La función MultipacketReciever::RecievePacket en S.T.A.L.K.E.R.: Shadow of Chernobyl v1.0006 y aanteriores, permiten a atacantes remotos provocar una denegación de servicio (finalización de servicio) a través de paquetes manipulados sin los valores 0xe0 o 0xe1 esperados, lo que provoca la instrucción INT13. • http://aluigi.altervista.org/adv/stalker39x-adv.txt http://osvdb.org/46628 http://secunia.com/advisories/30891 http://www.securityfocus.com/archive/1/493765 http://www.securityfocus.com/bid/29997 https://exchange.xforce.ibmcloud.com/vulnerabilities/43458 •
CVSS: 5.0EPSS: 1%CPEs: 1EXPL: 0CVE-2008-6704
https://notcve.org/view.php?id=CVE-2008-6704
Integer overflow in the NET_Compressor::Decompress function in S.T.A.L.K.E.R.: Shadow of Chernobyl 1.0006 and earlier allows remote attackers to cause a denial of service (server crash) via a crafted packet with a 0xc1 value that contains no compressed data, which triggers a copy of a large amount of memory. Desbordamiento de entero en la función NET_Compressor::Decompress en S.T.A.L.K.E.R.: Shadow of Chernobyl v1.0006 y anteriores, permite a atacantes remotos provocar una denegación de servicio (caída del sistema) a través de un paquete manipulado con un valor 0xc1 que contiene datos no comprimidos, lo que provoca una copia de una gran cantidad de memoria. • http://aluigi.altervista.org/adv/stalker39x-adv.txt http://osvdb.org/46627 http://secunia.com/advisories/30891 http://www.securityfocus.com/archive/1/493765 http://www.securityfocus.com/bid/29997 https://exchange.xforce.ibmcloud.com/vulnerabilities/43456 • CWE-189: Numeric Errors •