PT-2019-12259

Name of the Vulnerable Software and Affected Versions Snare Central versions prior to 7.4.5 Description The issue allows remote authenticated attackers to inject arbitrary OS commands. This is achieved via the FORMNAS share parameter in the ServerConf/DataManagement/DiskManager.php file...

InterSect Alliance SNARE Epilog for UNIX Cross-Site Scripting Vulnerability

InterSect Alliance is providing commercial support for Snare Enterprise Agent and Snare Server. A cross-site scripting vulnerability exists in InterSect Alliance SNARE Epilog for UNIX version 1.5. This allows remote authenticated users to inject arbitrary web script or HTML via the strlogname...

Cross site scripting

Cross-site scripting XSS vulnerability in InterSect Alliance SNARE Epilog for UNIX version 1.5 allows remote authenticated users to inject arbitrary web script or HTML via the strlogname parameter in a "Web Admin Portal Log Configuration Add" action...

CVE-2017-5998

Cross-site scripting XSS vulnerability in InterSect Alliance SNARE Epilog for UNIX version 1.5 allows remote authenticated users to inject arbitrary web script or HTML via the strlogname parameter in a "Web Admin Portal Log Configuration Add" action...

CVE-2017-5998

Cross-site scripting XSS vulnerability in InterSect Alliance SNARE Epilog for UNIX version 1.5 allows remote authenticated users to inject arbitrary web script or HTML via the strlogname parameter in a "Web Admin Portal Log Configuration Add" action...

CVE-2017-5998

CVE-2017-5998 concerns InterSect Alliance SNARE Epilog for UNIX v1.5. The issue is a cross-site scripting (XSS) vulnerability in the Web Admin Portal’s Log Configuration add action, exploitable when an authenticated user supplies a crafted value to the str_log_name parameter. The root cause is im...

CVE-2017-5998: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in InterSect Alliance SNARE Epilog for UNIX version 1.5 allows remote authenticated users to inject arbitrary web script or HTML via the strlogname parameter in a "Web Admin Portal Log Configuration Add" action...

PT-2017-16818

Name of the Vulnerable Software and Affected Versions InterSect Alliance SNARE Epilog for UNIX version 1.5 Description A cross-site scripting issue allows remote authenticated users to inject arbitrary web script or HTML via the str log name parameter in a "Web Admin Portal Log Configuration Add"...

Snare Lite for Windows Registry Access

This module uses the Registry Dump feature of the Snare Lite for Windows service on 6161/TCP to retrieve the Windows registry. The Dump Registry functionality is unavailable in Snare Enterprise. Note: The Dump Registry functionality accepts only one connected client at a time. Requesting a large...

KLA10332 OSI vulnerability in Snare

Weak keying material was found in Snare Agent. By exploiting this vulnerability malicious users can obtain and modify sensitive information. This vulnerability can be exploited remotely via MITM, at a point related to OpenSSL. Original advisories Snare Agent changelog Exploitation Related product...

CVE-2011-5249

Cross-site scripting XSS vulnerability in the events page in the System iNtrusion Analysis and Reporting Environment SNARE for Linux agent before 1.7.0 allows remote attackers to inject arbitrary web script or HTML via a logged shell command...

Cross site scripting

Cross-site scripting XSS vulnerability in the events page in the System iNtrusion Analysis and Reporting Environment SNARE for Linux agent before 1.7.0 allows remote attackers to inject arbitrary web script or HTML via a logged shell command...

CVE-2011-5249

Cross-site scripting XSS vulnerability in the events page in the System iNtrusion Analysis and Reporting Environment SNARE for Linux agent before 1.7.0 allows remote attackers to inject arbitrary web script or HTML via a logged shell command...

CVE-2011-5249

SNARE for Linux (older than 1.7.0) contains a cross-site scripting (XSS) vulnerability in the web interface that serves the events/logs. The issue arises because user-supplied data from logged shell commands is not validated before rendering in the browser, allowing an attacker to inject arbitrar...

CVE-2011-5249: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the events page in the System iNtrusion Analysis and Reporting Environment SNARE for Linux agent before 1.7.0 allows remote attackers to inject arbitrary web script or HTML via a logged shell command...

PT-2014-2185

Name of the Vulnerable Software and Affected Versions SNARE for Linux agent versions prior to 1.7.0 Description A cross-site scripting XSS issue exists in the events page of the SNARE for Linux agent, allowing remote attackers to inject arbitrary web script or HTML via a logged shell command. Thi...

Snare Agent for Linux < 1.7.0 / 2.0.0 Multiple Vulnerabilities

According to its self-reported version number, the installation of Snare Agent for Linux hosted on the remote web server is affected by multiple vulnerabilities in the optionally configured web interface: - The web interface discloses a hashed password for remote logins. An attacker can view the...

Snare Agent Detection

The remote web server contains a Snare Agent installation used for auditing and analysis of system events. The agent includes an optionally configured embedded web server used to configure rules for event monitoring. C Tenable Network Security, Inc. include"compat.inc"; if description...

Snare Agent Linux Password Disclosure / CSRF Vulnerabilities

Snare for Linux ships with a web interface that can be used for viewing log data and configuring the agent. In the web interface at /remote, a user is able to set a password for remote configuration of the agent. The rendered page contains the field "RemotePassword" with its input type set to...

Snare for Linux Password Disclosure

Snare for Linux Password Disclosure I. BACKGROUND ---------------------- Snare for Linux provides a 'C2' or 'CAPP' style audit subsystem for the Linux operating system. It can be used as a standalone auditing tool for Linux, or can send data to the Snare Server for analysis and storage. II...