CVE-2014-9619

CVE-2014-9619 affects Netsweeper Webadmin: unrestricted file upload via webadmin/ajaxfilemanager/ajaxfilemanager.php. An authenticated admin can upload a file with a double extension and, by requesting it from webadmin/deny/images/, execute arbitrary PHP code (e.g., secuid0.php.gif). Affected ver...

CVE-2014-9610

Netsweeper versions affected: before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2. A remote attacker can bypass authentication and remove IP addresses from quarantine by supplying the ip parameter to webadmin/user/quarantine_disable.php. This is an authentication bypass vulnerability that a...

CVE-2014-9616

Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to obtain sensitive information by making a request that redirects to the deny page...

CVE-2014-9618

The Client Filter Admin portal in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and subsequently create arbitrary profiles via a showdeny action to the default URL...

CVE-2014-9616

CVE-2014-9616 affects Netsweeper versions prior to 3.1.10, 4.0.x prior to 4.0.9, and 4.1.x prior to 4.1.2. The issue allows remote attackers to obtain sensitive information by issuing a request that redirects to the deny page. Affected component/behavior is an information disclosure via misdirect...

CVE-2014-9610

Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and remove IP addresses from the quarantine via the ip parameter to webadmin/user/quarantinedisable.php...

CVE-2014-9619

Unrestricted file upload vulnerability in webadmin/ajaxfilemanager/ajaxfilemanager.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote authenticated users with admin privileges on the Cloud Manager web console to execute arbitrary PHP code by uploading a file...

CVE-2014-9611

Netsweeper before 4.0.5 allows remote attackers to bypass authentication and create arbitrary accounts and policies via a request to webadmin/nslam/index.php...

CVE-2014-9618

The CVE-2014-9618 vulnerability affects Netsweeper’s Client Filter Admin portal (versions before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2). It allows remote attackers to bypass authentication and subsequently create arbitrary profiles via a showdeny action to the default URL. Public sou...

CVE-2014-9611

CVE-2014-9611 affects Netsweeper prior to 4.0.5. An unauthenticated remote attacker can bypass authentication via the request to webadmin/nslam/index.php and can create arbitrary user accounts and policies. This is evidenced by the CNVD-2017-30727 entry and the corroborating exploit references no...

CVE-2014-9619: Unrestricted Upload of File with Dangerous Type

Unrestricted file upload vulnerability in webadmin/ajaxfilemanager/ajaxfilemanager.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote authenticated users with admin privileges on the Cloud Manager web console to execute arbitrary PHP code by uploading a file...

PT-2017-6374

Name of the Vulnerable Software and Affected Versions Netsweeper versions prior to 3.1.10 Netsweeper versions 4.0.x prior to 4.0.9 Netsweeper versions 4.1.x prior to 4.1.2 Description The issue allows remote attackers to bypass authentication and create arbitrary profiles via a showdeny action to...

PT-2017-6373

Name of the Vulnerable Software and Affected Versions Netsweeper versions prior to 3.1.10 Netsweeper versions 4.0.x prior to 4.0.9 Netsweeper versions 4.1.x prior to 4.1.2 Description The issue allows remote attackers to obtain sensitive information by making a request that redirects to the deny...

PT-2017-6372

Name of the Vulnerable Software and Affected Versions Netsweeper versions prior to 4.0.5 Description The issue allows remote attackers to bypass authentication and create arbitrary accounts and policies via a request to "webadmin/nslam/index.php". Recommendations For versions prior to 4.0.5, upda...

CVE-2014-9618: Improper Authentication

The Client Filter Admin portal in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and subsequently create arbitrary profiles via a showdeny action to the default URL...

CVE-2014-9616: Exposure of Sensitive Information to an Unauthorized Actor

Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to obtain sensitive information by making a request that redirects to the deny page...

CVE-2014-9611: Improper Authentication

Netsweeper before 4.0.5 allows remote attackers to bypass authentication and create arbitrary accounts and policies via a request to webadmin/nslam/index.php...

PT-2017-6371

Name of the Vulnerable Software and Affected Versions Netsweeper versions prior to 3.1.10 Netsweeper versions 4.0.x prior to 4.0.9 Netsweeper versions 4.1.x prior to 4.1.2 Description The issue allows remote attackers to bypass authentication and remove IP addresses from the quarantine. This is...

PT-2017-6375

Name of the Vulnerable Software and Affected Versions Netsweeper versions prior to 3.1.10 Netsweeper versions 4.0.x prior to 4.0.9 Netsweeper versions 4.1.x prior to 4.1.2 Description The issue allows remote authenticated users with admin privileges on the Cloud Manager web console to execute...

Netsweeper WebUpgrade Authorization Issues Vulnerability

Netsweeper is a Web content filtering solution from Netsweeper Canada. A security vulnerability exists in Netsweeper's WebUpgrade that stems from the webupgrade/webupgrade.php script failing to adequately filter the 'login' and 'password ' parameters. A remote attacker can exploit the vulnerabili...