Catatonic

**Name of the Vulnerable Software and Affected Versions** Arial Software Campaign Enterprise version 11.0.551 **Description** A security issue exists in the activate.asp page, allowing a remote malicious user to modify the `SerialNumber` field. **Recommendations** For version 11.0.551, consider restricting access to the activate.asp page until a fix is available. As a temporary workaround, avoid using the `SerialNumber` field in the affected page to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Arial Campaign Enterprise versions prior to 11.0.551 **Description** The issue allows remote attackers to enumerate users' credentials due to unauthorized access to the User-Edit.asp page. **Recommendations** For versions prior to 11.0.551, update to version 11.0.551 or later to resolve the issue. As a temporary workaround, consider restricting access to the User-Edit.asp page until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Arial Campaign Enterprise versions prior to 11.0.551 **Description** The issue concerns the storage of passwords in clear text, which can be retrieved. **Recommendations** For versions prior to 11.0.551, update to version 11.0.551 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Arial Campaign Enterprise versions prior to 11.0.551 **Description** The issue allows multiple pages to be accessible without proper authentication or authorization, potentially leading to unauthorized access to sensitive information. **Recommendations** For versions prior to 11.0.551, update to version 11.0.551 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive pages until the update can be applied.

**Name of the Vulnerable Software and Affected Versions** Campaign Enterprise versions prior to 11.0.551 **Description** The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the `SerialNumber` field to "activate.asp" or the `UID` field to "User-Edit.asp". **Recommendations** For versions prior to 11.0.551, update to version 11.0.551 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Cerberus FTP Server versions prior to 5.0.6.0 **Description** The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the administrative web interface. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via a log entry that is not properly handled within the Log Manager component. Additionally, remote authenticated administrators might be able to inject arbitrary web script or HTML via a Messages field to the servermanager program. **Recommendations** For versions prior to 5.0.6.0, update to version 5.0.6.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Log Manager component and limiting the ability of administrators to inject content via the Messages field until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Dart PowerTCP WebServer for ActiveX versions 1.9 and earlier **Description** The issue is related to a stack consumption vulnerability in the dartwebserver.dll, which can be exploited by remote attackers to cause a denial of service. This is achieved by sending a long request, resulting in a daemon crash. **Recommendations** For versions 1.9 and earlier, consider updating to a newer version to mitigate the risk of a denial of service attack. As a temporary workaround, restrict access to the dartwebserver.dll to minimize the risk of exploitation.