CVE-2011-2150

CVE-2011-2150 concerns the SmarterTools SmarterStats 6.0 web server, where the XML storage path accepts unvalidated string data. The root cause is improper validation of strings intended for XML, enabling a remote denial-of-service condition through XML parsing errors. Attack vectors include cert...

CVE-2011-2159

The SmarterTools SmarterStats 6.0 web server omits the Content-Type header for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving 1 Admin/Defaults/frmDefaultSiteSettings.aspx, 2...

CVE-2011-2153

CVE-2011-2153 affects SmarterTools SmarterStats 6.0 Web server. The vulnerability arises from Login.aspx accepting txtUser/txtPass in the query string, enabling context-dependent attackers to discover credentials by reading server access logs, Referer logs, or browser history (cross-domain Refere...

CVE-2011-2153

Login.aspx in the SmarterTools SmarterStats 6.0 web server supports URLs containing txtUser and txtPass parameters in the query string, which makes it easier for context-dependent attackers to discover credentials by reading 1 web-server access logs, 2 web-server Referer logs, or 3 the browser...

CVE-2011-2148

Admin/frmSite.aspx in the SmarterTools SmarterStats 6.0 web server allows remote attackers to execute arbitrary commands via vectors involving a leading and trailing & ampersand character, and 1 an STTTState cookie, 2 the ctl00%24MPH%24txtAdminNewPasswordSettingText parameter, 3 the...

CVE-2011-2152

The SmarterTools SmarterStats 6.0 web server generates web pages containing external links in response to GET requests with query strings for 1 Client/frmViewReports.aspx or 2 UserControls/Popups/frmHelp.aspx, which makes it easier for remote attackers to obtain sensitive information by reading a...

CVE-2011-2152

The CVE-2011-2152 entry concerns SmarterTools SmarterStats 6.0 web server behavior: responses to GET requests with certain query strings (Client/frmViewReports.aspx or UserControls/Popups/frmHelp.aspx) generate pages containing external links, enabling cross-domain Referer leakage. This can allow...

CVE-2011-2155

The CVE-2011-2155 entry concerns SmarterTools SmarterStats 6.0. The vulnerability arises in Login.aspx where a password form field (ctl00$MPH$txtPassword) is generated with autocomplete enabled, which can enable an attacker to bypass authentication when a workstation is left unattended. According...

CVE-2011-2157

The 1 Admin/frmEmailReportSettings.aspx and 2 Admin/frmGeneralSettings.aspx components in the SmarterTools SmarterStats 6.0 web server generate web pages containing e-mail addresses, which allows remote attackers to obtain potentially sensitive information by reading the default values of form...

CVE-2011-2150

The SmarterTools SmarterStats 6.0 web server does not properly validate string data that is intended for storage in an XML document, which allows remote attackers to cause a denial of service parsing error and daemon pause via vectors involving 1 certain cookies in a SiteInfoLookup action to...

CVE-2011-2151

CVE-2011-2151 concerns SmarterTools SmarterStats 6.0 where several admin and login pages (Admin/frmEmailReportSettings.aspx, Admin/frmGeneralSettings.aspx, Admin/frmSite.aspx, Client/frmUser.aspx, Login.aspx) accept cleartext passwords. The root cause is transmission of credentials in cleartext o...

CVE-2011-2155

Login.aspx in the SmarterTools SmarterStats 6.0 web server generates a ctl00$MPH$txtPassword password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation...

CVE-2011-2154

login.aspx in the SmarterTools SmarterStats 6.0 web server does not include the HTTPOnly flag in a Set-Cookie header for the loginsettings cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie...

CVE-2011-2159

The CVE concerns SmarterTools SmarterStats 6.0 web server that omits the Content-Type header for a defined set of resources (including Admin and Client pages, skin/theme files, config/XML-like files, and sitemap.xml). The root cause is header omission which could allow remote attackers to cause a...

CVE-2011-2157

CVE-2011-2157 affects SmarterTools SmarterStats 6.0 web server. The Admin/frmEmailReportSettings.aspx and Admin/frmGeneralSettings.aspx pages generate web pages that contain e-mail addresses, allowing remote attackers to read the default values of form fields and disclose potentially sensitive in...

CVE-2011-2152: Exposure of Sensitive Information to an Unauthorized Actor

The SmarterTools SmarterStats 6.0 web server generates web pages containing external links in response to GET requests with query strings for 1 Client/frmViewReports.aspx or 2 UserControls/Popups/frmHelp.aspx, which makes it easier for remote attackers to obtain sensitive information by reading a...

CVE-2011-2158: Undefined Security Weakness

The SmarterTools SmarterStats 6.0 web server sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving 1 Admin/frmSite.aspx, 2 Admin/frmSites.aspx, 3 Admin/frmViewReports.aspx, 4...

PT-2011-3641

Name of the Vulnerable Software and Affected Versions SmarterTools SmarterStats version 6.0 Description The issue allows context-dependent attackers to discover credentials by reading web-server access logs, web-server Referer logs, or the browser history, due to the support of URLs containing...

PT-2011-3644

Name of the Vulnerable Software and Affected Versions SmarterTools SmarterStats version 6.0 Description The issue allows remote attackers to obtain directory listings via direct requests for specific directory names. This includes requests for the Admin/, Admin/Defaults/, Admin/GettingStarted/,...

PT-2011-3638

Name of the Vulnerable Software and Affected Versions SmarterTools SmarterStats version 6.0 Description The issue is related to an "XML injection" problem where the web server does not properly validate string data intended for storage in an XML document. This allows remote attackers to cause a...