CVE-2002-0706: Undefined Security Weakness

UserManager.js in the Web Reports Server for SurfControl SuperScout WebFilter uses weak encryption for administrator functions, which allows remote attackers to decrypt the administrative password using a hard-coded key in a Javascript function...

CVE-2002-0708: Undefined Security Weakness

Directory traversal vulnerability in the Web Reports Server for SurfControl SuperScout WebFilter allows remote attackers to read arbitrary files via an HTTP request containing ... triple dot sequences...

CVE-2002-0707: Undefined Security Weakness

The Web Reports Server for SurfControl SuperScout WebFilter allows remote attackers to cause a denial of service CPU consumption via large GET requests, possibly due to a buffer overflow...

CVE-2002-0705: Undefined Security Weakness

The Web Reports Server for SurfControl SuperScout WebFilter stores the "scwebusers" username and password file in a web-accessible directory, which allows remote attackers to obtain valid usernames and crack the passwords...

CVE-2002-0709: Undefined Security Weakness

SQL injection vulnerabilities in the Web Reports Server for SurfControl SuperScout WebFilter allow remote attackers to execute arbitrary SQL queries via the RunReport option to SimpleBar.dll, and possibly other DLLs...

CVE-2001-1465

SurfControl SuperScout only filters packets containing both an HTTP GET request and a Host header, which allows local users to bypass filtering by fragmenting packets so that no packet contains both data elements...

CVE-2000-0124

CVE-2000-0124 affects surfCONTROL SuperScout. The vulnerability arises because it does not properly assign a category to web sites that end with a dot, which could allow bypassing web access restrictions. The NVD entry lists a low base score (CVSS2 2.1) with local attack vector, unauthenticated a...

CVE-2000-0124: Undefined Security Weakness

surfCONTROL SuperScout does not properly asign a category to web sites with a . dot at the end, which may allow users to bypass web access restrictions...

CVE-2000-0124

surfCONTROL SuperScout does not properly asign a category to web sites with a . dot at the end, which may allow users to bypass web access restrictions...

surfcontrol.txt

Vulnerable Apps/Platforms: -So far, surfCONTROL SuperScout 2.6.1.6, Only version tested, with rules blocking based on web site category. Complete No Access rules still successfully block. -Possibly all previous versions. -This vulnerability voids the ability to block users based on category...