Vulnerabilities

TI-2011-01807 CVE-2011-2081 · GHSA-w589-59pg-2f6r

MediaCAST 8 and earlier does not properly handle requests for…

LOW 27

MediaCAST 8 and earlier does not properly handle requests for inventivex/isptools/release/metadata/globalIncludeFolders.txt, which allows remote attackers to obtain sensitive information via unspecified vectors related t…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02104 Published 2011-05-10 No fix listed CWE-200

TI-2011-01806 CVE-2011-2080 · GHSA-h52x-wxf4-c2h7

Multiple SQL injection vulnerabilities in MediaCAST 8 and earlier allow remote attackers…

LOW 37

Multiple SQL injection vulnerabilities in MediaCAST 8 and earlier allow remote attackers to execute arbitrary SQL commands via (1) a CP_ENLARGESTYLE cookie to the default URI under inventivex/managetraining/ or (2) unspe…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01848 Published 2011-05-10 No fix listed CWE-89

TI-2011-01805 CVE-2011-2079 · GHSA-vxmr-45jh-86pr

MediaCAST 8 and earlier allows remote attackers to have an unspecified impact via a (1)…

LOW 36

MediaCAST 8 and earlier allows remote attackers to have an unspecified impact via a (1) CP_RIGHTSOURCE or (2) bdclient_Inventive cookie to the default URI under inventivex/managetraining/, related to an "XML injection" i…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01507 Published 2011-05-10 No fix listed CWE-20

TI-2011-01804 CVE-2011-2078 · GHSA-x2f4-vg52-c966

Multiple cross-site scripting (XSS) vulnerabilities in the New Atlanta BlueDragon…

LOW 22

Multiple cross-site scripting (XSS) vulnerabilities in the New Atlanta BlueDragon administrative interface in MediaCAST 8 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.00893 Published 2011-05-10 No fix listed CWE-79

TI-2011-01803 CVE-2011-2077 · GHSA-6mwp-ccwj-v24g

The default configuration of the New Atlanta BlueDragon administrative interface in…

LOW 35

The default configuration of the New Atlanta BlueDragon administrative interface in MediaCAST 8 and earlier enables external TCP connections to port 10000, instead of connections only from 127.0.0.1, which makes it easie…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01312 Published 2011-05-10 No fix listed CWE-16

TI-2011-01802 CVE-2011-2076 · GHSA-75g7-72xf-r837

MediaCAST 8 and earlier stores passwords in cleartext, which makes it easier for…

LOW 25

MediaCAST 8 and earlier stores passwords in cleartext, which makes it easier for context-dependent attackers to obtain sensitive information by reading an unspecified password data store, a different vulnerability than C…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01 Published 2011-05-10 No fix listed CWE-200

TI-2010-00208 CVE-2010-0216 · GHSA-8wvc-qm7p-5pq5

authenticate_ad_setup_finished.cfm in MediaCAST 8 and earlier allows remote attackers to…

LOW 26

authenticate_ad_setup_finished.cfm in MediaCAST 8 and earlier allows remote attackers to discover usernames and cleartext passwords by reading the error messages returned for requests that use the UserID parameter.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01568 Published 2011-05-10 No fix listed CWE-310