Ipswitch WhatsUp Gold SQL Injection Vulnerability

WhatsUp Gold provides a complete and easy-to-use monitoring mechanism to monitor all aspects of application services and network devices, assisting IT managers to turn network management information into readable business information. In Ipswitch WhatsUp Gold versions prior to 16.4,...

Ipswitch WhatsUp Gold SQL injection Vulnerability(CVE-2 0 1 5-8 2 6 1)-vulnerability warning-the black bar safety net

Affected system: Ipswitch WhatsUp Gold 〈 16.4 Description: CVECAN ID: CVE-2 0 1 5-8 2 6 1 WhatsUp Gold offers a complete easy-to-use monitoring mechanism for comprehensive monitoring of application services and network equipment, and assist IT managers the network management information into a...

CVE-2015-8261

The DroneDeleteOldMeasurements implementation in Ipswitch WhatsUp Gold before 16.4 does not properly validate serialized XML objects, which allows remote attackers to conduct SQL injection attacks via a crafted SOAP request...

Sql injection

The DroneDeleteOldMeasurements implementation in Ipswitch WhatsUp Gold before 16.4 does not properly validate serialized XML objects, which allows remote attackers to conduct SQL injection attacks via a crafted SOAP request...

CVE-2015-8261

Ipswitch WhatsUp Gold before 16.4 is vulnerable to SQL injection via the DroneDeleteOldMeasurements SOAP handler, caused by improper validation of serialized XML objects. A remote attacker can craft a SOAP request to inject/manipulate SQL in the back-end database, potentially exposing or altering...

CVE-2015-8261

The DroneDeleteOldMeasurements implementation in Ipswitch WhatsUp Gold before 16.4 does not properly validate serialized XML objects, which allows remote attackers to conduct SQL injection attacks via a crafted SOAP request...

PT-2016-1000 · Ipswitch · Ipswitch Whatsup Gold

Name of the Vulnerable Software and Affected Versions: Ipswitch WhatsUp Gold versions prior to 16.4 Description: The issue is related to the DroneDeleteOldMeasurements implementation, which does not properly validate serialized XML objects. This allows remote attackers to conduct SQL injection...

IPSwitch WhatsUp Gold does not validate commands when deserializing XML objects

Overview IPSwitch WhatsUp Gold version 16.3 does not properly validate data when deserializing XML objects sent over SOAP requests. Description CWE-502: Deserialization of Untrusted Data - CVE-2015-8261 WhatsUp Gold version 16.3 contains a SOAP request handler named DroneDeleteOldMeasurements...

CVE-2015-6005

Multiple cross-site scripting XSS vulnerabilities in IPSwitch WhatsUp Gold before 16.4 allow remote attackers to inject arbitrary web script or HTML via 1 an SNMP OID object, 2 an SNMP trap message, 3 the View Names field, 4 the Group Names field, 5 the Flow Monitor Credentials field, 6 the Flow...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in IPSwitch WhatsUp Gold before 16.4 allow remote attackers to inject arbitrary web script or HTML via 1 an SNMP OID object, 2 an SNMP trap message, 3 the View Names field, 4 the Group Names field, 5 the Flow Monitor Credentials field, 6 the Flow...

CVE-2015-6004

Multiple SQL injection vulnerabilities in IPSwitch WhatsUp Gold before 16.4 allow remote attackers to execute arbitrary SQL commands via 1 the UniqueID aka sUniqueID parameter to WrFreeFormText.asp in the Reports component or 2 the Find Device parameter...

Sql injection

Multiple SQL injection vulnerabilities in IPSwitch WhatsUp Gold before 16.4 allow remote attackers to execute arbitrary SQL commands via 1 the UniqueID aka sUniqueID parameter to WrFreeFormText.asp in the Reports component or 2 the Find Device parameter...

CVE-2015-6005

Ipswitch WhatsUp Gold (pre-16.4) is affected by multiple XSS vulnerabilities (CVE-2015-6005) due to improper validation in various fields (e.g., SNMP OID objects, SNMP traps, View/Group/Policy/Template Libraries, System Script Library, CLI Settings, etc.). An authenticated remote attacker could i...

CVE-2015-6004

Multiple SQL injection vulnerabilities in IPSwitch WhatsUp Gold before 16.4 allow remote attackers to execute arbitrary SQL commands via 1 the UniqueID aka sUniqueID parameter to WrFreeFormText.asp in the Reports component or 2 the Find Device parameter...

CVE-2015-6004

Ipswitch WhatsUp Gold prior to 16.4 is affected by CVE-2015-6004 (SQL injection) via the sUniqueID/Find Device inputs in the Reports component, enabling an authenticated remote attacker to manipulate or disclose data in the backend database. The issue is complemented by CVE-2015-6005 (stored XSS)...

CVE-2015-6005

Multiple cross-site scripting XSS vulnerabilities in IPSwitch WhatsUp Gold before 16.4 allow remote attackers to inject arbitrary web script or HTML via 1 an SNMP OID object, 2 an SNMP trap message, 3 the View Names field, 4 the Group Names field, 5 the Flow Monitor Credentials field, 6 the Flow...

PT-2015-7108 · Ipswitch · Ipswitch Whatsup Gold

Name of the Vulnerable Software and Affected Versions: IPSwitch WhatsUp Gold versions prior to 16.4 Description: The issue allows remote attackers to inject arbitrary web script or HTML via multiple fields, including 1 an SNMP OID object, 2 an SNMP trap message, 3 the View Names field, 4 the Grou...

Ipswitch WhatsUp Gold Cross-Site Scripting Vulnerability

Ipswitch WhatsUp Gold is a unified suite of infrastructure and application monitoring software. IPswitch WhatsUp Gold suffers from a cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, obtain sensitive information o...

Ipswitch WhatsUp Gold SQL Injection Vulnerability

Ipswitch WhatsUp Gold is a unified suite of infrastructure and application monitoring software. IPswitch WhatsUp Gold suffers from a SQL injection vulnerability. Failure to properly filter the 'UniqueID' parameter allows remote attackers to exploit the vulnerability to submit specially crafted SQ...

IPswitch WhatsUp Gold contains multiple XSS vulnerabilities and a SQLi

Overview IPSwitch's WhatsUp Gold version 16.3, and possibly previous versions, is vulnerable to SQL injection and cross-site scripting attacks. Description CWE-89: Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' - CVE-2015-6004The "Find Device" search field does...