WatchGuard Fireware XTM < 12.0 Multiple Vulnerabilities

WatchGuard Fireware XMT Web UI is prone to an XML external entity XXE, denial of service DoS and stored cross-site scripting XSS vulnerabilities. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective rig...

WatchGuard Fireware Cross-Site Scripting Vulnerability

WatchGuard Fireware XTM is a firewall appliance from WatchGuard, Inc. that provides intrusion protection, spam filtering, SSL VPN, and more through intelligent layering technology.WatchGuard Fireware is the firmware of... A cross-site scripting vulnerability exists in versions of WatchGuard...

WatchGuard Fireware Denial of Service Vulnerability (CNVD-2017-35372)

WatchGuard Fireware XTM is a firewall appliance from WatchGuard, Inc. that provides intrusion protection, spam filtering, SSL VPN, and more through intelligent layering technology.WatchGuard Fireware is the firmware of... A security vulnerability exists in versions of WatchGuard Fireware prior to...

CVE-2017-14615

An FBX-5313 issue was discovered in WatchGuard Fireware before 12.0. When a failed login attempt is made to the login endpoint of the XML-RPC interface, if JavaScript code, properly encoded to be consumed by XML parsers, is embedded as value of the user element, the code will be rendered in the...

CVE-2017-14616

An FBX-5312 issue was discovered in WatchGuard Fireware before 12.0. If a login attempt is made in the XML-RPC interface with an XML message containing an empty member element, the wgagent crashes, logging out any user with a session opened in the UI. By continuously executing the failed login...

Design/Logic Flaw

An FBX-5313 issue was discovered in WatchGuard Fireware before 12.0. When a failed login attempt is made to the login endpoint of the XML-RPC interface, if JavaScript code, properly encoded to be consumed by XML parsers, is embedded as value of the user element, the code will be rendered in the...

CVE-2017-14615

An FBX-5313 issue was discovered in WatchGuard Fireware before 12.0. When a failed login attempt is made to the login endpoint of the XML-RPC interface, if JavaScript code, properly encoded to be consumed by XML parsers, is embedded as value of the user element, the code will be rendered in the...

CVE-2017-14616

An FBX-5312 issue was discovered in WatchGuard Fireware before 12.0. If a login attempt is made in the XML-RPC interface with an XML message containing an empty member element, the wgagent crashes, logging out any user with a session opened in the UI. By continuously executing the failed login...

Design/Logic Flaw

An FBX-5312 issue was discovered in WatchGuard Fireware before 12.0. If a login attempt is made in the XML-RPC interface with an XML message containing an empty member element, the wgagent crashes, logging out any user with a session opened in the UI. By continuously executing the failed login...

CVE-2017-14615

CVE-2017-14615 affects WatchGuard Fireware pre-12.0. An XML-RPC login endpoint issue allows JavaScript embedded in the user element to be rendered in the Web UI (Traffic Monitor: Events/All), causing a stored-XSS effect where subsequent events are hidden until a restart. Affected product: WatchGu...

CVE-2017-14616

WatchGuard Fireware before 12.0 is affected by CVE-2017-14616. The issue occurs in the XML-RPC login flow: sending an XML message with an empty member element causes the wgagent to crash, logging out any active UI session and, with repeated failed logins, making UI management unusable. Affected p...

CVE-2017-14616

An FBX-5312 issue was discovered in WatchGuard Fireware before 12.0. If a login attempt is made in the XML-RPC interface with an XML message containing an empty member element, the wgagent crashes, logging out any user with a session opened in the UI. By continuously executing the failed login...

Watchguard Firebox / XTM XML-RPC Empty Member Denial Of Service

Watchguardas Firebox and XTM are a series of enterprise grade network security appliances providing advanced security services like next generation firewall, intrusion prevention, malware detection and blockage and others. Two vulnerabilities were discovered affecting the XML-RPC interface of the...

WatchGuard Firewall Detection

Binary data 700077.prm...

WatchGuard Fireware Denial of Service Vulnerability

WatchGuard Fireware is a firewall appliance from WatchGuard USA that provides intrusion protection, spam filtering, SSL VPN and more with intelligent layering technology. A denial of service vulnerability exists in WatchGuard Fireware v11.12.1 and prior versions. An attacker can exploit this...

WatchGuard Fireware User Enumeration Vulnerability

WatchGuard Fireware is a firewall appliance from WatchGuard USA that provides intrusion protection, spam filtering, SSL VPN and more with intelligent layering technology. A user enumeration vulnerability exists in WatchGuard Fireware v11.12.1 and earlier versions. An attacker can exploit this...

CVE-2017-8055

WatchGuard Fireware allows user enumeration, e.g., in the Firebox XML-RPC login handler. A login request that contains a blank password sent to the XML-RPC agent in Fireware v11.12.1 and earlier returns different responses for valid and invalid usernames. An attacker could exploit this...

CVE-2017-8056

WatchGuard Fireware v11.12.1 and earlier mishandles requests referring to an XML External Entity XXE, in the XML-RPC agent. This causes the Firebox wgagent process to crash. This process crash ends all authenticated sessions to the Firebox, including management connections, and prevents new...

CVE-2017-8056

WatchGuard Fireware v11.12.1 and earlier mishandles requests referring to an XML External Entity XXE, in the XML-RPC agent. This causes the Firebox wgagent process to crash. This process crash ends all authenticated sessions to the Firebox, including management connections, and prevents new...

Xxe

WatchGuard Fireware v11.12.1 and earlier mishandles requests referring to an XML External Entity XXE, in the XML-RPC agent. This causes the Firebox wgagent process to crash. This process crash ends all authenticated sessions to the Firebox, including management connections, and prevents new...