PT-2015-3306

Name of the Vulnerable Software and Affected Versions Redgate SQL Monitor versions prior to 3.10 Redgate SQL Monitor versions 4.x prior to 4.2 Description A remote attacker can gain unauthenticated access to the Base Monitor, resulting in the ability to execute arbitrary SQL commands on any...

SolarWinds Network Performance Monitor Open Redirect

Affected software: SolarWinds Network Performance Monitor Type of vulnerability:url redirection URL:http://www.solarwinds.com/ Discovered by: provensec Website: provensec.com version:N/A Proof of concept http://oriondemo.solarwinds.com/Orion/Login.aspx?ReturnUrl=//google.com...

WordPress Download Monitor Plugin <= 1.7.0 - Cross Site Scripting

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update the plugin...

How to Find the Details of a Network Attack

Let’s be honest, a network attack of any scale is inevitable in today’s IT world. Do you have the ability to quickly identify the details of the attack? If your network goes down, your network monitoring tool can tell you what happened, but knowing details about who was vulnerable or why the atta...

Cross site scripting

Cross-site scripting XSS vulnerability in Huawei SEQ Analyst before V200R002C03LG0001CP0022 allows remote attackers to inject arbitrary web script or HTML via the command XML element in the req parameter to flexdata.action in 1 common/, 2 monitor/, or 3 psnpm/ or the 4 module XML element in the r...

SmartSniff v2.17 - Capture TCP/IP packets on your network adapter

SmartSniff is a network monitoring utility that allows you to capture TCP/IP packets that pass through your network adapter, and view the captured data as sequence of conversations between clients and servers. You can view the TCP/IP conversations in Ascii mode for text-based protocols, like HTTP...

MySQL Enterprise Monitor 3.0.x < 3.0.19 Apache Struts Predictable Token XSRF

According to its self-reported version, the MySQL Enterprise Monitor running on the remote host may be affected by a cross-site request forgery vulnerability due to the token generator failing to adequately randomize the token values. A remote attacker can exploit this by extracting a token from ...

MySQL Enterprise Monitor < 2.3.17 Multiple Vulnerabilities

According to its self-reported version, the MySQL Enterprise Monitor running on the remote host is affected by multiple vulnerabilities : - A flaw exists within 'MultipartStream.java' in Apache Commons FileUpload when parsing malformed Content-Type headers. A remote attacker, using a crafted...

MySQL Enterprise Monitor < 2.3.20 Apache Struts Predictable Token XSRF

According to its self-reported version, the MySQL Enterprise Monitor running on the remote host may be affected by a cross-site request forgery vulnerability due to the token generator failing to adequately randomize the token values. A remote attacker can exploit this by extracting a token from ...

MySQL Enterprise Monitor 3.0.x < 3.0.5 Apache Struts DMI Multiple Vulnerabilities

According to its self-reported version, the MySQL Enterprise Monitor running on the remote host is affected by multiple unspecified vulnerabilities related to dynamic method invocation DMI in the bundled version of Apache Struts. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

MySQL Enterprise Monitor 3.0.x < 3.0.11 Multiple Vulnerabilities

According to its self-reported version, the MySQL Enterprise Monitor running on the remote host is affected by multiple vulnerabilities : - A flaw exists within 'MultipartStream.java' in Apache Commons FileUpload when parsing malformed Content-Type headers. A remote attacker, using a crafted...

MySQL Enterprise Monitor < 2.3.14 Apache Struts Multiple Vulnerabilities

According to its self-reported version, the MySQL Enterprise Monitor running on the remote host is affected by the multiple vulnerabilities in the bundled version of Apache Struts : - Input validation errors exist that allows the execution of arbitrary Object-Graph Navigation Language OGNL...

Release Notes for Veeam ONE 8.0 Update 2

Challenge Release Notes for Veeam ONE 8.0 Update 2. Cause Please confirm you are running Veeam ONE 8 prior to installing this update. You can check this under Help | About in Veeam ONE Monitor Client, the build number should be 8.0.0.xxx. After upgrading, your version build will be 8.0.0.1669. Th...

Download Monitor <= 1.7.0 - Cross-Site Scripting (XSS)

The Download Monitor WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

Huawei SEQ Analyst XXE Injection

Document Title: ============ Huawei SEQ Analyst - XML External Entity Injection XXE Release Date: =========== 15 Apr 2015 CVE-ID: ======= CVE-2015-2346 Product & Service Introduction: ======================= SEQ Analyst is a platform for business quality monitoring and management by individual us...

das_watchdog 'XAUTHORITY' environment variable handles buffer overflow vulnerabilities

daswatchdog is a generic monitor on Linux operating systems. A buffer overflow vulnerability exists in daswatchdog when handling the XAUTHORITY environment variable. An attacker could exploit this vulnerability to execute arbitrary code in the context of an affected application...

Ericsson Drutt Mobile Service Delivery Platform Directory Traversal Vulnerability

Ericsson Drutt Mobile Service Delivery Platform MSDP is a business support system from Ericsson, Sweden, that supports Service Delivery Platforms SDPs for on-site and off-portal services. A directory traversal vulnerability exists in Instance Monitor in Ericsson Drutt MSDP. A remote attacker coul...

CVE-2015-2166

Directory traversal vulnerability in the Instance Monitor in Ericsson Drutt Mobile Service Delivery Platform MSDP 4, 5, and 6 allows remote attackers to read arbitrary files via a ..%2f dot dot encoded slash in the default URI...

CVE-2015-2166

Ericsson Drutt Mobile Service Delivery Platform (MSDP) has a Local File Inclusion vulnerability in the Instance Monitor affecting versions 4–6. The flaw lets remote attackers read arbitrary files via a dot-dot-encoded slash (..%2f) in the default URI, enabling information disclosure. Root cause i...

PT-2015-5638

Name of the Vulnerable Software and Affected Versions Ericsson Drutt Mobile Service Delivery Platform MSDP versions 4 through 6 Description The issue allows remote attackers to read arbitrary files via a ..%2f dot dot encoded slash in the default URI, which is a directory traversal vulnerability ...