GCVE - cpe:2.3:a:consona:consona_live_assistance:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:consona:consona_live_assistance:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Consona (`4ed9ad89-e260-52a4-8564-39bb9b68db88`)
Product	Consona Live Assistance (`a5ebb00e-a771-583a-b678-0a6aac6eaee5`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2010-1913`	vulnerable	2026-06-08 04:54:10.938972	Details available The default configuration of pluginlicense.ini for the SdcWebSecureBase interface in tgctlcm.dll in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance, when downloaded from a server operated by Telefonica or possibly other companies, contains an incorrect DNS whitelist that includes the DNS hostnames of home computers of many persons, which allows remote attackers to bypass intended restrictions on ActiveX execution by hosting an ActiveX control on an applicable home web server. Published: 2010-05-11T23:00:00.000Z Updated: 2024-08-07T02:17:12.391Z Open on db.gcve.eu Reference links http://www.kb.cert.org/vuls/id/602801 http://wintercore.com/en/component/content/article/7-media/18-wintercore-releases-an-advisory-for-consona-products.html http://www.wintercore.com/downloads/rootedcon_0day.pdf http://www.securityfocus.com/archive/1/511176/100/0/threaded	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-1912`	vulnerable	2026-06-08 04:54:10.938584	Details available The SdcWebSecureBase interface in tgctlcm.dll in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance allows remote attackers to bypass intended restrictions on ActiveX execution via "instantiation/free attacks." Published: 2010-05-11T23:00:00.000Z Updated: 2024-08-07T02:17:13.139Z Open on db.gcve.eu Reference links http://www.kb.cert.org/vuls/id/602801 http://wintercore.com/en/component/content/article/7-media/18-wintercore-releases-an-advisory-for-consona-products.html http://www.wintercore.com/downloads/rootedcon_0day.pdf http://www.securityfocus.com/archive/1/511176/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/58607	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-1911`	vulnerable	2026-06-08 04:54:10.938054	Details available The site-locking implementation in the SdcWebSecureBase interface in tgctlcm.dll in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance relies on a list of server domain names to restrict execution of ActiveX controls, which makes it easier for man-in-the-middle attackers to execute arbitrary code via a DNS hijacking attack. Published: 2010-05-11T23:00:00.000Z Updated: 2024-08-07T02:17:12.156Z Open on db.gcve.eu Reference links http://www.kb.cert.org/vuls/id/602801 http://wintercore.com/en/component/content/article/7-media/18-wintercore-releases-an-advisory-for-consona-products.html http://www.wintercore.com/downloads/rootedcon_0day.pdf https://exchange.xforce.ibmcloud.com/vulnerabilities/58608 http://www.securityfocus.com/archive/1/511176/100/0/threaded	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-1910`	vulnerable	2026-06-08 04:54:10.937622	Details available The Forgot Password implementation in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance allows remote attackers to reset passwords of accounts with blank Hint questions and Hint answers by sending an empty value for each of these two Hint fields. Published: 2010-05-11T23:00:00.000Z Updated: 2024-08-07T02:17:12.411Z Open on db.gcve.eu Reference links http://www.kb.cert.org/vuls/id/602801 http://wintercore.com/en/component/content/article/7-media/18-wintercore-releases-an-advisory-for-consona-products.html http://www.securityfocus.com/archive/1/511176/100/0/threaded http://www.securityfocus.com/bid/40003 http://secunia.com/advisories/39740	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-1909`	vulnerable	2026-06-08 04:54:10.937126	Details available Buffer overflow in the RunCmd method in the SdcUser.TgConCtl ActiveX control in tgctlcm.dll in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance allows remote attackers to execute arbitrary code via vectors involving "CreateProcess params." NOTE: some of these details are obtained from third party information. Published: 2010-05-11T23:00:00.000Z Updated: 2024-08-07T02:17:12.164Z Open on db.gcve.eu Reference links http://secunia.com/advisories/39751 http://www.kb.cert.org/vuls/id/602801 http://wintercore.com/en/component/content/article/7-media/18-wintercore-releases-an-advisory-for-consona-products.html http://www.wintercore.com/downloads/rootedcon_0day.pdf http://www.securityfocus.com/archive/1/511176/100/0/threaded	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-1908`	vulnerable	2026-06-08 04:54:10.936719	Details available The SdcUser.TgConCtl ActiveX control in tgctlcm.dll in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance does not properly restrict access to the HTTPDownloadFile, HTTPGetFile, Install, and RunCmd methods, which allows remote attackers to execute arbitrary programs via a URL in the url argument to (1) HTTPDownloadFile or (2) HTTPGetFile. Published: 2010-05-11T23:00:00.000Z Updated: 2024-08-07T02:17:12.152Z Open on db.gcve.eu Reference links http://secunia.com/advisories/39751 http://www.kb.cert.org/vuls/id/602801 http://wintercore.com/en/component/content/article/7-media/18-wintercore-releases-an-advisory-for-consona-products.html http://www.wintercore.com/downloads/rootedcon_0day.pdf http://www.securityfocus.com/archive/1/511176/100/0/threaded	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-1907`	vulnerable	2026-06-08 04:54:10.936281	Details available The SdcUser.TgConCtl ActiveX control in tgctlcm.dll in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance allows remote attackers to discover the username of the client user, and consequently determine a pathname to a certain user directory, via a call to the GetUserName method. Published: 2010-05-11T23:00:00.000Z Updated: 2024-08-07T02:17:12.615Z Open on db.gcve.eu Reference links http://www.kb.cert.org/vuls/id/602801 http://wintercore.com/en/component/content/article/7-media/18-wintercore-releases-an-advisory-for-consona-products.html http://www.wintercore.com/downloads/rootedcon_0day.pdf http://www.securityfocus.com/archive/1/511176/100/0/threaded	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-1905`	vulnerable	2026-06-08 04:54:10.930496	Details available Multiple cross-site scripting (XSS) vulnerabilities in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance allow remote attackers to inject arbitrary web script or HTML via crafted input to ASP pages, as demonstrated using the backurl parameter to sdccommon/verify/asp/n6plugindestructor.asp. Published: 2010-05-11T23:00:00.000Z Updated: 2024-08-07T02:17:12.621Z Open on db.gcve.eu Reference links http://www.kb.cert.org/vuls/id/602801 http://wintercore.com/en/component/content/article/7-media/18-wintercore-releases-an-advisory-for-consona-products.html http://www.wintercore.com/downloads/rootedcon_0day.pdf http://www.securityfocus.com/archive/1/511176/100/0/threaded http://secunia.com/advisories/39740	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.