CVE-2011-3007

CVE-2011-3007 affects McAfee SaaS Endpoint Protection (ActiveX control myCIOScn.dll) versions 5.2.1 and earlier. The vulnerability arises in the MyCioScan.Scan.ReportFile parameter, which allows remote attackers to specify an arbitrary filename, enabling writing to arbitrary files. Documented imp...

CVE-2011-3006

The CVE-2011-3006 entry concerns the MyAsUtil ActiveX control (MyAsUtil5.2.0.603.dll) in McAfee SaaS Endpoint Protection, affected in 5.2.1 and earlier. The vulnerability arises in the MyAsUtil.SecureObjectFactory.CreateSecureObject domain policy, which can be bypassed via a cross-site scripting ...

CVE-2011-3006

The MyAsUtil ActiveX control in MyAsUtil5.2.0.603.dll in McAfee SaaS Endpoint Protection 5.2.1 and earlier allows remote attackers to bypass the MyASUtil.SecureObjectFactory.CreateSecureObject domain execution policy using a cross-site scripting XSS attack, execute arbitrary code using the...

CVE-2011-3007

The myCIOScn ActiveX control myCIOScn.dll in McAfee SaaS Endpoint Protection 5.2.1 and earlier allows remote attackers to write to arbitrary files by specifying an arbitrary filename in the MyCioScan.Scan.ReportFile parameter, as demonstrated by injecting script into a log file and executing...

PT-2011-4245

Name of the Vulnerable Software and Affected Versions McAfee SaaS Endpoint Protection versions 5.2.1 and earlier Description The issue allows remote attackers to write to arbitrary files by specifying an arbitrary filename in the MyCioScan.Scan.ReportFile parameter. This can be used to inject...

CVE-2011-3007: Improper Control of Generation of Code

The myCIOScn ActiveX control myCIOScn.dll in McAfee SaaS Endpoint Protection 5.2.1 and earlier allows remote attackers to write to arbitrary files by specifying an arbitrary filename in the MyCioScan.Scan.ReportFile parameter, as demonstrated by injecting script into a log file and executing...

PT-2011-4244

Name of the Vulnerable Software and Affected Versions McAfee SaaS Endpoint Protection versions 5.2.1 and earlier Description The issue allows remote attackers to bypass the MyASUtil.SecureObjectFactory.CreateSecureObject domain execution policy using a cross-site scripting XSS attack, execute...

CVE-2011-3006: Undefined Security Weakness

The MyAsUtil ActiveX control in MyAsUtil5.2.0.603.dll in McAfee SaaS Endpoint Protection 5.2.1 and earlier allows remote attackers to bypass the MyASUtil.SecureObjectFactory.CreateSecureObject domain execution policy using a cross-site scripting XSS attack, execute arbitrary code using the...

McAfee SaaS Endpoint Protection 'myCIOScn' ActiveX远程代码执行漏洞

Bugtraq ID: 49087 McAfee SaaS Endpoint Protection是一款提供了用于拦截病毒、间谍软件、Web 威胁和黑客攻击的基本保护功能。 myCIOScn.dll存在缺陷。首先通过ActiveX导出的MyCioScan.Scan.ReportFile参数可设置为任意文件名，包括敏感系统文件和目录，其次，可构建特制的MyCioScan.Scan.Start方法的参数，把恶意脚本注入到在AV扫描结束时创建的日志文件中。组合这两个缺陷可使远程攻击者以浏览器上下文执行任意代码。 0 McAfee SaaS Endpoint Protection 5.2.1...

McAfee SaaS Endpoint Protection 'MyAsUtil5.2.0.603.dll' ActiveX远程代码执行漏洞

Bugtraq ID: 49088 McAfee SaaS Endpoint Protection是一款提供了用于拦截病毒、间谍软件、Web 威胁和黑客攻击的基本保护功能。 MyAsUtil5.2.0.603.dll提供的ActiveX控件存在安全漏洞。首先跨站脚本可用于绕过MyASUtil.SecureObjectFactory.CreateSecureObject中实现的域执行策略来创建一个MyASUtil.InstallInfo实例，之后MyASUtil.InstallInfo.RunUserProgram可用于在系统上执行代码。另外用户系统上多个其他对象和接口可任意使用这个通用机...

SolveDirect SaaS v5.6.3 - XPath & SQL Vulnerabilities

Document Title: =============== SolveDirect SaaS v5.6.3 - XPath & SQL Vulnerabilities Release Date: ============= 2011-07-26 Vulnerability Laboratory ID VL-ID: ==================================== 119 Product & Service Introduction: =============================== Die weltweit groesste SaaS...

SolveDirect SaaS v5.6.3 - XPath & SQL Vulnerabilities

Document Title: =============== SolveDirect SaaS v5.6.3 - XPath & SQL Vulnerabilities Release Date: ============= 2011-07-26 Vulnerability Laboratory ID VL-ID: ==================================== 119 Product & Service Introduction: =============================== Die weltweit groesste SaaS...

Coalfire Systems Speaking at Shared Assessments Summit 2011

Do you know how to ensure reliability and resiliency in cloud and SaaS environments? Join leaders from within the IT outsourcing risk management industry at the Shared Assessments Summit 2011 in Boston on March 29 and 30. Coalfire is participating in this summit because the value of managing risk...

Google Message Security SaaS Cross Site Scripting

Security Advisory: MVSA-10-002 Vendor: Google Service: Google Message Security SaaS powered by Postini - Security Console Admin Console - Message Center Classic - Message Center II Vulnerabilities: Multiple Cross-Site Scripting XSS Risk: High Attack Vector: From Remote Authentication: Required...

Google Message Security SaaS multiple security vulnerabilities

Crossite scripting, SQL injection...

MVSA-10-002 - Google Message Security SaaS - Multiple XSS vulnerabilities

Security Advisory: MVSA-10-002 Vendor: Google Service: Google Message Security SaaS powered by Postini - Security Console Admin Console - Message Center Classic - Message Center II Vulnerabilities: Multiple Cross-Site Scripting XSS Risk: High Attack Vector: From Remote Authentication: Required...

MVSA-10-001 - Google Message Security SaaS - SQL Injection vulnerabilities

Security Advisory: MVSA-10-001 Vendor: Google Service: Google Message Security SaaS powered by Postini - Message Center II Vulnerabilities: SQL Injection Risk: High Attack Vector: From Remote Authentication: Required Reference: http://www.ventuneac.net/security-advisories/MVSA-10-001...

Cacti Multiple Parameter Cross Site Scripting Vulnerabilities

Cacti Multiple Parameter Cross Site Scripting Vulnerabilities I. BACKGROUND --------------------- "Cacti is a complete network graphing solution designed to harness the power of RRDTool's data storage and graphing functionality. Cacti provides a fast poller, advanced graph templating, multiple da...

The Berkeley breach: Is SaaS the answer?

One recent Friday afternoon I took time off to visit two new health providers: a new dentist nearer my home and an orthopedic to look at my lateral epicondylitis. In both cases, as a new patient, I filled in page after page of medical history and personal information, including my Social Security...