CVE-2009-1594: Undefined Security Weakness

Armorlogic Profense Web Application Firewall before 2.2.22, and 2.4.x before 2.4.4, does not properly implement the "positive model," which allows remote attackers to bypass certain protection mechanisms via a %0A encoded newline, as demonstrated by a %0A in a cross-site scripting XSS attack URL...

CVE-2009-1745: Undefined Security Weakness

Armorlogic Profense Web Application Firewall before 2.2.22, and 2.4.x before 2.4.4, has a default root password hash, and permits password-based root logins over SSH, which makes it easier for remote attackers to obtain access...

CVE-2009-1593: Improper Neutralization of Input During Web Page Generation

Armorlogic Profense Web Application Firewall before 2.2.22, and 2.4.x before 2.4.4, does not properly implement the "negative model," which allows remote attackers to conduct cross-site scripting XSS attacks via a modified end tag of a SCRIPT element...

Profense 2.2.202.4.2 - Web Application Firewall Security Bypass

Profense 2.2.202.4.2 - Web Application Firewall Security Bypass source: https://www.securityfocus.com/bid/35053/info Profense Web Application Firewall is prone to multiple security-bypass vulnerabilities. An attacker can exploit these issues to bypass certain security restrictions and perform...

CVE-2009-0467

Cross-site scripting XSS vulnerability in proxy.html in Profense Web Application Firewall 2.6.2 and 2.6.3 allows remote attackers to inject arbitrary web script or HTML via the proxy parameter in a denylog manage action...

CVE-2009-0468

Multiple cross-site request forgery CSRF vulnerabilities in ajax.html in Profense Web Application Firewall 2.6.2 and 2.6.3 allow remote attackers to hijack the authentication of administrators for requests that 1 shutdown the server, 2 send ping packets, 3 enable network services, 4 configure a...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in ajax.html in Profense Web Application Firewall 2.6.2 and 2.6.3 allow remote attackers to hijack the authentication of administrators for requests that 1 shutdown the server, 2 send ping packets, 3 enable network services, 4 configure a...

CVE-2009-0467

CVE-2009-0467 affects Profense Web Application Firewall 2.6.2 and 2.6.3. A cross-site scripting (XSS) vulnerability exists in proxy.html, where the proxy parameter in the deny_log manage action can be exploited to inject arbitrary web script or HTML. This is due to insufficient input handling in ...

CVE-2009-0467

Cross-site scripting XSS vulnerability in proxy.html in Profense Web Application Firewall 2.6.2 and 2.6.3 allows remote attackers to inject arbitrary web script or HTML via the proxy parameter in a denylog manage action...

CVE-2009-0468

Multiple cross-site request forgery CSRF vulnerabilities in ajax.html in Profense Web Application Firewall 2.6.2 and 2.6.3 allow remote attackers to hijack the authentication of administrators for requests that 1 shutdown the server, 2 send ping packets, 3 enable network services, 4 configure a...

CVE-2009-0467: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in proxy.html in Profense Web Application Firewall 2.6.2 and 2.6.3 allows remote attackers to inject arbitrary web script or HTML via the proxy parameter in a denylog manage action...

CVE-2009-0468: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in ajax.html in Profense Web Application Firewall 2.6.2 and 2.6.3 allow remote attackers to hijack the authentication of administrators for requests that 1 shutdown the server, 2 send ping packets, 3 enable network services, 4 configure a...

Profense Web Application Firewall Default Credentials

Armorlogic Profense Web Application Firewall is installed on the remote host. It is possible to log into the web management interface using default credentials. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid35580...

Profense Web Application Firewall 2.6.2 XSRF/XSS Vulnerabilities

No description provided by source. Written By Michael Brooks Special thanks to str0ke! Affects: Profense Web Application Firewall XSRF and XSS Version: 2.6.2 download http://www.armorlogic.com/downloadsoftware.html "Defenses against all OWASP Top Ten vulnerabilities" Too bad it doesn't defend its...

Profense Web Application Firewall XSRF / XSS

Written By Michael Brooks Special thanks to str0ke! Affects: Profense Web Application Firewall XSRF and XSS Version: 2.6.2 download http://www.armorlogic.com/downloadsoftware.html "Defenses against all OWASP Top Ten vulnerabilities" Too bad it doesn't defend its self against all of these...

Profense Web Application Firewall 2.6.2 XSRF/XSS Vulnerabilities

Exploit for unknown platform in category remote exploits ================================================================ Profense Web Application Firewall 2.6.2 XSRF/XSS Vulnerabilities ================================================================ Written By Michael Brooks Special thanks to...

Profense Web Application Firewall 2.6.2 - Cross-Site Request Forgery Cross-Site Scripting

Profense Web Application Firewall 2.6.2 - Cross-Site Request Forgery Cross-Site Scripting Written By Michael Brooks Special thanks to str0ke! Affects: Profense Web Application Firewall XSRF and XSS Version: 2.6.2 download http://www.armorlogic.com/downloadsoftware.html "Defenses against all OWASP...

PHPCow file inclusion vulnerability

Overview Older versions of PHPCow contain a file inclusion vulnerability that could allow an attacker to take control of a vulnerable application. Description PHPCow is a content management system that uses PHP. Older versions of PHP contain a file inclusion vulnerability. We are aware of reports...

FreeBSD Ports: apache-tomcat

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

tomcat multiple content-length header poisioning

Jakarta Tomcat 5.0.19 Coyote/1.1 and Tomcat 4.1.24 Coyote/1.0 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Tomcat t...