CVE-2008-1208

Cross-site scripting XSS vulnerability in the login page in Check Point VPN-1 UTM Edge W Embedded NGX 7.0.48x allows remote attackers to inject arbitrary web script or HTML via the user parameter...

CVE-2008-1208

CVE-2008-1208 affects Check Point VPN-1 UTM Edge W Embedded NGX 7.0.48x. The vulnerability is a reflected XSS in the login page, exploitable by supplying a crafted value for the user parameter that causes arbitrary web script/HTML execution. Public sources consistently describe this as a login-pa...

Check Point VPN-1 UTM Edge NGX 7.0.48x - Login Page Cross-Site Scripting

source: https://www.securityfocus.com/bid/28116/info Check Point VPN-1 UTM Edge is prone to a cross-site scripting vulnerability because it fails to adequately sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user...

Check Point VPN-1 UTM Edge NGX 7.0.48x - Login Page Cross-Site Scripting

Check Point VPN-1 UTM Edge NGX 7.0.48x - Login Page Cross-Site Scripting source: https://www.securityfocus.com/bid/28116/info Check Point VPN-1 UTM Edge is prone to a cross-site scripting vulnerability because it fails to adequately sanitize user-supplied input. An attacker may leverage this issu...

UTM-1 Edge W Embedded NGX 7.0.48x reflected XSS vulnerability (low severity) (CVE-2008-1208)

...

CVE-2007-3786

Cross-site request forgery CSRF vulnerability on the eSoft InstaGate EX2 UTM device before firmware 3.1.20070615 allows remote attackers to perform privileged actions as administrators. NOTE: the vendor disputes the distribution of the vulnerable software, stating that it was a custom build for a...

CVE-2007-3787

The eSoft InstaGate EX2 UTM device does not require entry of the old password when changing the admin password, which might allow remote attackers to gain privileges by conducting a CSRF attack, making a password change from an unattended workstation, or other attacks...

Cross site request forgery (csrf)

The eSoft InstaGate EX2 UTM device does not require entry of the old password when changing the admin password, which might allow remote attackers to gain privileges by conducting a CSRF attack, making a password change from an unattended workstation, or other attacks...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability on the eSoft InstaGate EX2 UTM device before firmware 3.1.20070615 allows remote attackers to perform privileged actions as administrators. NOTE: the vendor disputes the distribution of the vulnerable software, stating that it was a custom build for a...

Design/Logic Flaw

The eSoft InstaGate EX2 UTM device stores the admin password within the settings HTML document, which might allow context-dependent attackers to obtain sensitive information by reading this document...

CVE-2007-3786

The vulnerable product is the eSoft InstaGate EX2 UTM device. A CSRF flaw affects firmware versions prior to 3.1.20070615, allowing remote attackers to perform privileged actions as administrators. The issue’s root cause is a CSRF vulnerability (as described in the CVE entry and related docs). Re...

CVE-2007-3788

The eSoft InstaGate EX2 UTM device stores the admin password within the settings HTML document, which might allow context-dependent attackers to obtain sensitive information by reading this document...

CVE-2007-3788

The vulnerability CVE-2007-3788 affects the eSoft InstaGate EX2 UTM device, where the admin password is stored within the settings HTML document. This exposes a risk that an attacker who can read that document may obtain sensitive information, potentially compromising confidentiality and integrit...

CVE-2007-3786

Cross-site request forgery CSRF vulnerability on the eSoft InstaGate EX2 UTM device before firmware 3.1.20070615 allows remote attackers to perform privileged actions as administrators. NOTE: the vendor disputes the distribution of the vulnerable software, stating that it was a custom build for a...

CVE-2007-3787

The eSoft InstaGate EX2 UTM device does not require entry of the old password when changing the admin password, which might allow remote attackers to gain privileges by conducting a CSRF attack, making a password change from an unattended workstation, or other attacks...

CVE-2007-3787

The CVE covers the eSoft InstaGate EX2 UTM device where the admin password change flow does not require the existing password, enabling privilege escalation via CSRF or similar attacks from an unattended workstation. Affected component: admin password change mechanism. Root cause: missing verific...

eSoft InstaGate EX2 UTM crossite forgery

It's possible to submit the form with configuration data...

Calyptix Security Advisory CX-2007-05 - eSoft InstaGate EX2 Cross-Site Request Forgery Attack

Calyptix Security Advisory CX-2007-05 eSoft InstaGate EX2 Cross-Site Request Forgery Attack Date: 07/11/2007 http://www.calyptix.com/ http://labs.calyptix.com/CX-2007-05.php http://labs.calyptix.com/CX-2007-05.txt Overview Multiple versions of eSoft's InstaGate EX2 UTM device are vulnerable to...

checkpoint-csrf.txt

Louhi Networks Oy -= Security Advisory =- Advisory: Checkpoint VPN-1 UTM Edge Cross Site Request Forgery Release Date: 2007/06/26 Last Modified: 2007/06/26 Authors: Henri Lindberg, Associate of ISC² [email protected] Jussi Vuokko, CISSP [email protected] Application: Checkpoint VPN-1 Ed...

[Full-disclosure] CheckPoint VPN-1 UTM Edge Cross Site Request Forgery vulnerability

Louhi Networks Oy -= Security Advisory =- Advisory: Checkpoint VPN-1 UTM Edge Cross Site Request Forgery Release Date: 2007/06/26 Last Modified: 2007/06/26 Authors: Henri Lindberg, Associate of ISC? [email protected] Jussi Vuokko, CISSP [email protected] Application: Checkpoint VPN-1 Ed...