Qualys Cloud Platform 8.15.2 New Features

Patch release of Qualys Cloud Platform, version 8.15.2, includes new support for Apache instance auto-discovery in Qualys Policy Compliance. Policy Compliance Apache Instance Auto-Discovery – This new feature in Qualys PC enables automatic discovery of Apache during compliance scans. Once one or...

Qualys Cloud Platform 8.15.1 New Features

This new patch release of the Qualys Cloud Platform, version 8.15.1, includes updates to Qualys Vulnerability Management. Vulnerability Management IP Update Handling for Agents – External IP address for Agents will no longer overwrite previous internal IP address when an internal address is not...

CVE-2016-9494

Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, are potentially vulnerable to improper input validation. The device's advanced status web page that is linked to from the basic status web page does not appear to properly parse malformed GET requests. This may...

Electric Sheep Fencing pfSense 'graph' Parameter Command Execution Vulnerability

Electric Sheep Fencing pfsense is a free and open source FreeBSD-based firewall and router software from Electric Sheep Fencing. A security vulnerability exists in Electric Sheep Fencing pfSense versions prior to 2.3. A remote attacker can exploit this vulnerability by sending the 'graph' paramet...

NetComm Wireless 4GT101W Router Information Disclosure Vulnerability

NetComm Wireless 4GT101W routers is a wireless router product from NetComm Wireless Australia. A security vulnerability in NetComm Wireless 4GT101W routers running hardware version 0.01/software version V1.1.8.8/bootloader version 1.1.3 stems from the program's failure to perform an authenticatio...

PT-2017-11434

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 2.10 Description The issue allows remote users to execute arbitrary SQL commands. This can be achieved by exploiting the cat false or cat true parameter in the comments or status page to "cat options.php" API endpoint...

Qualys Cloud Platform 2.28 New Features

This release of the Qualys Cloud Platform version 2.28 includes updates and new features for Cloud Agent, AssetView, ThreatPROTECT, Security Assessment Questionnaire and Web Application Scanning, highlights as follows: Cloud Agent Cloud Agent AIX Beta – beta release of Qualys Cloud Agent supporti...

Icinga Cross-Site Scripting Vulnerability

Icinga is a set of enterprise-grade open source monitoring system from the Icinga project, a product between the Nagios Community Edition and Enterprise Edition. A cross-site scripting vulnerability exists in Icinga's Classic-UI with CSV export link and pagination functionality. Remote attackers...

CVE-2016-2840

An issue was discovered in Open-Xchange Server 6 / OX AppSuite before 7.8.0-rev26. The "session" parameter for file-download requests can be used to inject script code that gets reflected through the subsequent status page. Malicious script code can be executed within a trusted domain's context...

CVE-2016-2058

Multiple cross-site scripting XSS vulnerabilities in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow 1 remote Xymon clients to inject arbitrary web script or HTML via a status-message, which is not properly handled in the "detailed status" page, or 2 remote authenticated users to inject arbitra...

CVE-2016-2058: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow 1 remote Xymon clients to inject arbitrary web script or HTML via a status-message, which is not properly handled in the "detailed status" page, or 2 remote authenticated users to inject arbitra...

Xymon HTML Injection Vulnerability

Xymon is an open source , cross-platform network monitoring application . The application can be viewed through the web page of the operational status of each server , and supports Email and SMS notification function . There is an HTML injection vulnerability in Xymon. This vulnerability can be...

Code injection

Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote attackers to obtain sensitive debugging information by entering a crafted URL to trigger an exception, and then visiting a certain status page...

CVE-2015-7900: Exposure of Sensitive Information to an Unauthorized Actor

Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote attackers to obtain sensitive debugging information by entering a crafted URL to trigger an exception, and then visiting a certain status page...

CVE-2015-2350: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in MikroTik RouterOS 5.0 and earlier allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a request in the status page to /cfg...

Cross site scripting

Cross-site scripting XSS vulnerability in Brother MFC-J4410DW printer with firmware before L allows remote attackers to inject arbitrary web script or HTML via the url parameter to general/status.html and possibly other pages...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Stark CRM 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 firstname, 2 lastname, or 3 notes parameter to the client page; 4 insuname or 5 price parameter to the addinsurancecat page; or 6 status parameter to the...

httpd: mod_status heap-based buffer overflow

A race condition flaw, leading to heap-based buffer overflows, was found in the modstatus httpd module. A remote attacker able to access a status page served by modstatus on a server using a threaded Multi-Processing Module MPM could send a specially crafted request that would cause the httpd chi...

httpd: mod_status heap-based buffer overflow

A race condition flaw, leading to heap-based buffer overflows, was found in the modstatus httpd module. A remote attacker able to access a status page served by modstatus on a server using a threaded Multi-Processing Module MPM could send a specially crafted request that would cause the httpd chi...

httpd: mod_status heap-based buffer overflow

A race condition flaw, leading to heap-based buffer overflows, was found in the modstatus httpd module. A remote attacker able to access a status page served by modstatus on a server using a threaded Multi-Processing Module MPM could send a specially crafted request that would cause the httpd chi...