PT-2018-9836

Name of the Vulnerable Software and Affected Versions: Trend Micro Smart Protection Server Standalone versions 3.x Description: A SQL injection remote code execution issue exists due to a flaw in the handling of parameters provided to the wcs bwlists handler.php file. This could allow a remote...

CVE-2012-5990

CVE-2012-5990 describes reflected XSS in the Health Monitor login pages of Cisco Prime NCS/WCS. Affected component: Health Monitor Login pages. Root cause: input validation error leading to reflection of HTML/script (CWE-79). Impact stated: attacker can execute arbitrary script in the user’s brow...

CVE-2011-4014

CVE-2011-4014 affects Cisco Wireless Control System (WCS) 7.0, via the TAC Case Attachment tool. The vulnerability allows remote authenticated users to read arbitrary files under webnms/Temp/ through unspecified vectors (Bug ID CSCtq86807). The available sources (NVD entry and Cisco notes) confir...

CVE-2011-4014: Exposure of Sensitive Information to an Unauthorized Actor

The TAC Case Attachment tool in Cisco Wireless Control System WCS 7.0 allows remote authenticated users to read arbitrary files under webnms/Temp/ via unspecified vectors, aka Bug ID CSCtq86807...

CVE-2010-2826

Cisco WCS 6.0.x is affected by a SQL injection vulnerability (CVE-2010-2826) in the ORDER BY clause of the Client List screens. The issue allows an authenticated remote attacker to modify system configuration and potentially affect managed devices. The vulnerability is fixed in WCS 6.0.196.0. No ...

CVE-2010-2986

Cross-site scripting XSS vulnerability in webacs/QuickSearchAction.do in the search feature in the web interface in Cisco Wireless Control System WCS before 6.0194.0 and 7.x before 7.0.164 allows remote attackers to inject arbitrary web script or HTML via the searchText parameter, aka Bug ID...

CVE-2010-2987

Multiple cross-site scripting XSS vulnerabilities in Cisco Wireless Control System WCS 7.x before 7.0.164, as used in Cisco Unified Wireless Network UWN Solution 7.x before 7.0.98.0, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCtg33854...

CVE-2010-2986

The CVE-2010-2986 entry concerns Cisco Wireless Control System (WCS) Web UI. A XSS flaw exists in webacs/QuickSearchAction.do within the search feature, allowing remote attackers to inject arbitrary web script or HTML via the searchText parameter. Affected versions include WCS prior to 6.0(194.0)...

CVE-2010-2986

Cross-site scripting XSS vulnerability in webacs/QuickSearchAction.do in the search feature in the web interface in Cisco Wireless Control System WCS before 6.0194.0 and 7.x before 7.0.164 allows remote attackers to inject arbitrary web script or HTML via the searchText parameter, aka Bug ID...

CVE-2010-2987

CVE-2010-2987 describes multiple reflected XSS vulnerabilities in Cisco Wireless Control System (WCS) 7.x up to 7.0.163/164, used with Cisco Unified Wireless Network (UWN) Solution 7.x up to 7.0.98.0. The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2007-5382

The conversion utility for converting CiscoWorks Wireless LAN Solution Engine WLSE 4.1.91.0 and earlier to Cisco Wireless Control System WCS creates administrator accounts with default usernames and passwords, which allows remote attackers to gain privileges...

CVE-2007-2032

Cisco Wireless Control System WCS before 4.0.96.0 has a hard-coded FTP username and password for backup operations, which allows remote attackers to read and modify arbitrary files via unspecified vectors related to "properties of the FTP server," aka Bug ID CSCse93014...

CVE-2007-2033

Summary (CVE-2007-2033) : Cisco Wireless Control System (WCS) is affected by an unspecified vulnerability in versions before 4.0.81.0. The issue allows remote authenticated users to read any configuration page by changing the group membership of user accounts (Bug ID CSCse78596). The NVD entry li...

CVE-2007-2033

Unspecified vulnerability in Cisco Wireless Control System WCS before 4.0.81.0 allows remote authenticated users to read any configuration page by changing the group membership of user accounts, aka Bug ID CSCse78596...

CVE-2007-2035

Cisco Wireless Control System (WCS) before 4.0.66.0 stores sensitive information under the web root with insufficient access control, allowing remote attackers to obtain network organization data by direct requests to files in certain directories. This summary is based on the primary CVE-2007-203...

CVE-2007-2032

Cisco Wireless Control System (WCS) prior to 4.0.96.0 contains a hard-coded FTP username and password used for backup operations. This credential flaw can allow remote attackers to read and modify arbitrary files via unspecified vectors related to the FTP server’s properties (Bug CSCse93014). The...

CVE-2007-2034

Cisco Wireless Control System (WCS) prior to 4.0.87.0 contains a privilege-escalation flaw that, when authenticated to WCS, allows a remote attacker to add their account to the SuperUsers group via the configuration page due to insufficient access controls. Impacted component: WCS application and...

CVE-2007-1771

PHP remote file inclusion vulnerability in manage/javascript/formjavascript.php in Ay System Solutions Web Content System WCS 2.7.1 allows remote attackers to execute arbitrary PHP code via a URL in the pathJavascriptEdit parameter...

CVE-2007-1467

The CVE-2007-1467 entry describes multiple cross-site scripting (XSS) vulnerabilities affecting Cisco Secure Access Control Server and related Cisco products. The root issue is insufficient input filtering in the search form used by PreSearch.html and PreSearch.class, allowing remote attackers to...

CVE-2006-3289

Cross-site scripting XSS vulnerability in the login page of the HTTP interface for the Cisco Wireless Control System WCS for Linux and Windows before 3.251 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving a "malicious URL"...