CVE-2011-2157

The 1 Admin/frmEmailReportSettings.aspx and 2 Admin/frmGeneralSettings.aspx components in the SmarterTools SmarterStats 6.0 web server generate web pages containing e-mail addresses, which allows remote attackers to obtain potentially sensitive information by reading the default values of form...

PT-2011-3639

Name of the Vulnerable Software and Affected Versions SmarterTools SmarterStats version 6.0 Description The issue allows remote attackers to obtain sensitive information by sniffing the network, as certain components in the SmarterTools SmarterStats web server accept cleartext passwords. The...

CVE-2011-2153: Exposure of Sensitive Information to an Unauthorized Actor

Login.aspx in the SmarterTools SmarterStats 6.0 web server supports URLs containing txtUser and txtPass parameters in the query string, which makes it easier for context-dependent attackers to discover credentials by reading 1 web-server access logs, 2 web-server Referer logs, or 3 the browser...

CVE-2011-2152: Exposure of Sensitive Information to an Unauthorized Actor

The SmarterTools SmarterStats 6.0 web server generates web pages containing external links in response to GET requests with query strings for 1 Client/frmViewReports.aspx or 2 UserControls/Popups/frmHelp.aspx, which makes it easier for remote attackers to obtain sensitive information by reading a...

PT-2011-3637

Name of the Vulnerable Software and Affected Versions SmarterTools SmarterStats version 6.0 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via certain parameters to specific API endpoints such as "Admin/frmSite.aspx", "Default.aspx",...

PT-2011-3645

Name of the Vulnerable Software and Affected Versions SmarterTools SmarterStats version 6.0 Description The issue concerns the generation of web pages containing email addresses by certain components in the SmarterTools SmarterStats web server. Specifically, the Admin/frmEmailReportSettings.aspx...

CVE-2011-2158: Undefined Security Weakness

The SmarterTools SmarterStats 6.0 web server sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving 1 Admin/frmSite.aspx, 2 Admin/frmSites.aspx, 3 Admin/frmViewReports.aspx, 4...

CVE-2011-2148: Improper Neutralization of Special Elements used in an OS Command

Admin/frmSite.aspx in the SmarterTools SmarterStats 6.0 web server allows remote attackers to execute arbitrary commands via vectors involving a leading and trailing & ampersand character, and 1 an STTTState cookie, 2 the ctl00%24MPH%24txtAdminNewPasswordSettingText parameter, 3 the...

PT-2011-3644

Name of the Vulnerable Software and Affected Versions SmarterTools SmarterStats version 6.0 Description The issue allows remote attackers to obtain directory listings via direct requests for specific directory names. This includes requests for the Admin/, Admin/Defaults/, Admin/GettingStarted/,...

PT-2011-3646

Name of the Vulnerable Software and Affected Versions SmarterTools SmarterStats version 6.0 Description The issue concerns the SmarterTools SmarterStats web server sending incorrect Content-Type headers for certain resources. This could potentially allow remote attackers to leverage an...

PT-2011-3640

Name of the Vulnerable Software and Affected Versions SmarterTools SmarterStats version 6.0 Description The issue allows remote attackers to obtain sensitive information by exploiting a "cross-domain Referer leakage" issue. This is achieved through GET requests with query strings for specific API...

CVE-2011-2154: Exposure of Sensitive Information to an Unauthorized Actor

login.aspx in the SmarterTools SmarterStats 6.0 web server does not include the HTTPOnly flag in a Set-Cookie header for the loginsettings cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie...

PT-2011-3642

Name of the Vulnerable Software and Affected Versions SmarterTools SmarterStats version 6.0 Description The issue concerns the SmarterTools SmarterStats web server, where the login.aspx page does not include the HTTPOnly flag in a Set-Cookie header for the loginsettings cookie. This omission make...

PT-2011-3647

Name of the Vulnerable Software and Affected Versions SmarterTools SmarterStats version 6.0 Description The SmarterTools SmarterStats web server may be affected by an issue where certain resources omit the Content-Type header, potentially allowing remote attackers to leverage an interpretation...

CVE-2011-2150: Improper Input Validation

The SmarterTools SmarterStats 6.0 web server does not properly validate string data that is intended for storage in an XML document, which allows remote attackers to cause a denial of service parsing error and daemon pause via vectors involving 1 certain cookies in a SiteInfoLookup action to...

CVE-2011-2157: Undefined Security Weakness

The 1 Admin/frmEmailReportSettings.aspx and 2 Admin/frmGeneralSettings.aspx components in the SmarterTools SmarterStats 6.0 web server generate web pages containing e-mail addresses, which allows remote attackers to obtain potentially sensitive information by reading the default values of form...

PT-2011-3638

Name of the Vulnerable Software and Affected Versions SmarterTools SmarterStats version 6.0 Description The issue is related to an "XML injection" problem where the web server does not properly validate string data intended for storage in an XML document. This allows remote attackers to cause a...

PT-2011-3641

Name of the Vulnerable Software and Affected Versions SmarterTools SmarterStats version 6.0 Description The issue allows context-dependent attackers to discover credentials by reading web-server access logs, web-server Referer logs, or the browser history, due to the support of URLs containing...

CVE-2011-2149: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the SmarterTools SmarterStats 6.0 web server allow remote attackers to execute arbitrary SQL commands via certain parameters to 1 Admin/frmSite.aspx, 2 Default.aspx, 3 Services/SiteAdmin.asmx, or 4 Client/frmViewReports.aspx; certain cookies to 5...

CVE-2011-2156: Exposure of Sensitive Information to an Unauthorized Actor

The SmarterTools SmarterStats 6.0 web server allows remote attackers to obtain directory listings via a direct request for the 1 Admin/, 2 Admin/Defaults/, 3 Admin/GettingStarted/, 4 Admin/Popups/, 5 AppThemes/, 6 Client/, 7 Client/Popups/, 8 Services/, 9 Temp/, 10 UserControls/, 11...