HP SiteScope SNMP Trap消息HTML代码注入漏洞

BUGTRAQ ID: 31816 CVECAN ID: CVE-2007-4350 HP SiteScope提供无代理监控，补充现有基于代理的解决方案，帮助保持分布式IT基础架构的可用性和性能。 HP SiteScope在处理SNMP信息的显示时存在漏洞，可以将SiteScope服务器配置为接收设备的SNMP Trap，并可以通过Web界面查看SNMP监控的状态和所接收到SNMP trap消息的内容。由于未经过滤便在管理界面中呈现了SNMP消息，因此在查看信息时可能在用户浏览器会话中执行任意HTML和脚本代码。 HP SiteScope 9.0 build 911 HP --...

Cross site scripting

Cross-site scripting XSS vulnerability in the management interface in HP SiteScope 9.0 build 911 allows remote attackers to inject arbitrary web script or HTML via an SNMP trap message...

CVE-2007-4350

Cross-site scripting XSS vulnerability in the management interface in HP SiteScope 9.0 build 911 allows remote attackers to inject arbitrary web script or HTML via an SNMP trap message...

CVE-2007-4350

Cross-site scripting XSS vulnerability in the management interface in HP SiteScope 9.0 build 911 allows remote attackers to inject arbitrary web script or HTML via an SNMP trap message...

CVE-2007-4350

HP SiteScope 9.0 build 911 contains a cross-site scripting (XSS) vulnerability in the management interface. The issue arises from rendering SNMP trap messages in the web UI without filtering, allowing an attacker to inject arbitrary HTML/script that could execute in a user’s browser. This affects...

HP Mercury SiteScope multiple security vulnerabilities

No description provided...

IOActive Security Advisory: Multiple Remote SiteScope Vulnerabilities

IOActive Security Advisory Title: Multiple Remote Vulnerabilities in Mercury SiteScope Severity: Critical Date Discovered: 10.05.2006 Date Reported: 05.21.2007 Date Disclosed: 09.20.2007 Affected Products: Mercury SiteScope - All Versions Synopsis: IOActive has discovered multiple critical...

CVE-2006-5134

Mercury SiteScope 8.2 8.1.2.0 allows remote authenticated users to cause a denial of service loss of connectivity to the classic interface via attempted HTML injection into the "new monitor description" field...

CVE-2006-5122

Multiple cross-site scripting XSS vulnerabilities in Mercury SiteScope 8.2 8.1.2.0 allow remote authenticated users to inject arbitrary web script or HTML via 1 "any field create name field" except "create new group name" or 2 any description field...

CVE-2006-5134

Mercury SiteScope 8.2 8.1.2.0 allows remote authenticated users to cause a denial of service loss of connectivity to the classic interface via attempted HTML injection into the "new monitor description" field...

CVE-2006-5122

Multiple cross-site scripting XSS vulnerabilities in Mercury SiteScope 8.2 8.1.2.0 allow remote authenticated users to inject arbitrary web script or HTML via 1 "any field create name field" except "create new group name" or 2 any description field...

CVE-2006-5134

Mercury SiteScope 8.2 (8.1.2.0) is affected by a vulnerability in the new monitor description field where remote authenticated users can inject HTML, leading to a denial of service (loss of connectivity to the classic interface). The issue is triggered by HTML injection in the monitor description...

CVE-2006-5122

CVE-2006-5122 , tied to Mercury SiteScope 8.2 (8.1.2.0), describes two XSS vectors where remote authenticated users can inject arbitrary script/HTML via (1) any field create name field (excluding the 2create new group name2) and (2) any description field. The connected documents confirm the vul...

Mercury SiteScope Server Detection

Binary data 3758.prm...

Mercury SiteScope 8.2 (8.1.2.0) Cross Site Scripting (XSS) Vulnerability

Whitehat.org.uk Advisory 1 Mercury SiteScope 8.2 8.1.2.0 Cross Site Scripting XSS Vulnerability Vulnerability Type: Active code injection XSS Problem Discovered: 14 September 2006 Vendor Contacted: 14 September 2006 Advisory Published: 29 September 2006 Abstract: Mercury SiteScope is an agentless...

SiteScope Web Administration Server Detection (HTTP)

HTTP based detection of the SiteScope Web Administration Server. SPDX-FileCopyrightText: 2005 SecuriTeam Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SiteScope Web Managegment Server Detection (HTTP)

The remote web server is running the SiteScope Management web server. SPDX-FileCopyrightText: 2005 Noam Rathaus / SecuriTeam Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Unprotected SiteScope Service (HTTP)

The SiteScope web service has no password set. An attacker who can connect to this server could view usernames and passwords stored in the preferences section or reconfigure the service. SPDX-FileCopyrightText: 2001 Digital Defense Inc. Some text descriptions might be excerpted from a referenced...