CVE-2008-1208: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the login page in Check Point VPN-1 UTM Edge W Embedded NGX 7.0.48x allows remote attackers to inject arbitrary web script or HTML via the user parameter...

UTM-1 Edge W Embedded NGX 7.0.48x reflected XSS vulnerability (low severity) (CVE-2008-1208)

...

CVE-2007-3489: Undefined Security Weakness

Cross-site request forgery CSRF vulnerability in pop/WizU.html in the management interface in Check Point VPN-1 Edge X Embedded NGX 7.0.33x on the Check Point VPN-1 UTM Edge allows remote attackers to perform privileged actions as administrators, as demonstrated by a request with the swuuser and...

CVE-2007-3465

Check Point SofaWare Safe@Office, with firmware before Embedded NGX 7.0.45 GA, has a certain default password...

Default credentials

Check Point SofaWare Safe@Office, with firmware before Embedded NGX 7.0.45 GA, has a certain default password...

Cross site request forgery (csrf)

Check Point SofaWare Safe@Office, with firmware before Embedded NGX 7.0.45 GA, does not require entry of the old password when changing the admin password, which might allow attackers to gain privileges by conducting a CSRF attack, making a password change on an unattended workstation, or other...

CVE-2007-3464

The CVE-2007-3464 entry concerns Check Point SofaWare Safe@Office (firmware before Embedded NGX 7.0.45 GA). The underlying issue is that the admin password change does not require the old password, enabling potential privilege escalation via CSRF attacks or similar vectors on an unattended workst...

CVE-2007-3465

Check Point SofaWare Safe@Office, with firmware before Embedded NGX 7.0.45 GA, has a certain default password...

CVE-2007-3464: Undefined Security Weakness

Check Point SofaWare Safe@Office, with firmware before Embedded NGX 7.0.45 GA, does not require entry of the old password when changing the admin password, which might allow attackers to gain privileges by conducting a CSRF attack, making a password change on an unattended workstation, or other...

CVE-2007-3465: Undefined Security Weakness

Check Point SofaWare Safe@Office, with firmware before Embedded NGX 7.0.45 GA, has a certain default password...

[Full-disclosure] CheckPoint VPN-1 UTM Edge Cross Site Request Forgery vulnerability

Louhi Networks Oy -= Security Advisory =- Advisory: Checkpoint VPN-1 UTM Edge Cross Site Request Forgery Release Date: 2007/06/26 Last Modified: 2007/06/26 Authors: Henri Lindberg, Associate of ISC? [email protected] Jussi Vuokko, CISSP [email protected] Application: Checkpoint VPN-1 Ed...