CVE-2013-5702

Multiple cross-site scripting XSS vulnerabilities in WebCenter in WatchGuard WSM and Fireware before 11.8 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters...

CVE-2013-6021

CVE-2013-6021 is a stack-based buffer overflow in WGagent used by WatchGuard WSM/Fireware before 11.8, caused by processing a crafted, oversized sessionid in cookies. This vulnerability enables remote code execution with network access, as attackers can exploit the cookie parsing to overflow the ...

CVE-2013-6021

Buffer overflow in WGagent in WatchGuard WSM and Fireware before 11.8 allows remote attackers to execute arbitrary code via a long sessionid value in a cookie...

Watchguard Extensible Threat Management (XTM) appliance version 11.7.4 contains a buffer overflow vulnerability

Overview Watchguard Extensible Threat Management XTM version 11.7.4 and possibly earlier versions contain a buffer overflow vulnerability CWE-121. Description CWE-121: Stack-based Buffer Overflow Watchguard Extensible Threat Management XTM version 11.7.4 and possibly earlier versions contain a...

CVE-2013-5701

Multiple untrusted search path vulnerabilities in 1 Watchguard Log Collector wlcollector.exe and 2 Watchguard WebBlocker Server wbserver.exe in WatchGuard Server Center 11.7.4, 11.7.3, and possibly earlier allow local users to gain privileges via a Trojan horse wgpr.dll file in the application's...

Design/Logic Flaw

Multiple untrusted search path vulnerabilities in 1 Watchguard Log Collector wlcollector.exe and 2 Watchguard WebBlocker Server wbserver.exe in WatchGuard Server Center 11.7.4, 11.7.3, and possibly earlier allow local users to gain privileges via a Trojan horse wgpr.dll file in the application's...

CVE-2013-5701

Multiple untrusted search path vulnerabilities in 1 Watchguard Log Collector wlcollector.exe and 2 Watchguard WebBlocker Server wbserver.exe in WatchGuard Server Center 11.7.4, 11.7.3, and possibly earlier allow local users to gain privileges via a Trojan horse wgpr.dll file in the application's...

CVE-2013-5701

Watchguard Server Center 11.7.4/11.7.3 are affected by CVE-2013-5701 due to insecure library loading via wgpr.dll, enabling local privilege escalation when a Trojan horse wgpr.dll is loaded from the application bin directory. This involves the Watchguard Server Center components wlcollector.exe a...

Watchguard Server Center 11.7.4 Insecure Library Loading

Watchguard Server Center version 11.7.4 suffers from a dll hijacking vulnerability with wgpr.dll. Watchguard Server Center v11.7.4 wgpr.dll Insecure Library Loading Local Privilege Escalation Vulnerability RCE Security Advisory http://www.rcesecurity.com 1. ADVISORY INFORMATION...

Watchguard Server Center 11.7.4 Insecure Library Loading

Watchguard Server Center v11.7.4 wgpr.dll Insecure Library Loading Local Privilege Escalation Vulnerability RCE Security Advisory http://www.rcesecurity.com 1. ADVISORY INFORMATION ----------------------- Product: Watchguard Server Center Vendor URL: www.watchguard.com Type: Uncontrolled Search...

Watchguard Server Center - Local Privilege Escalation

Watchguard Server Center - Local Privilege Escalation // source: https://www.securityfocus.com/bid/62261/info Watchguard Server Center is prone to a local privilege-escalation vulnerability. Local attackers can exploit this issue to gain SYSTEM privileges. Successful exploits will result in the...

Watchguard Server Center - Local Privilege Escalation

// source: https://www.securityfocus.com/bid/62261/info Watchguard Server Center is prone to a local privilege-escalation vulnerability. Local attackers can exploit this issue to gain SYSTEM privileges. Successful exploits will result in the complete compromise of affected computers. Watchguard...

CVE-2011-2165

The STARTTLS implementation in WatchGuard XCS 9.0 and 9.1 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command...

Command injection

The STARTTLS implementation in WatchGuard XCS 9.0 and 9.1 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command...

CVE-2011-2165

The STARTTLS implementation in WatchGuard XCS 9.0 and 9.1 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command...

CVE-2011-2165

Technical details about CVE-2011-2165 are not publicly provided in the connected documents. Please monitor for updates from vendors and security advisories as new information becomes available.

[NEWS] Watchguard Firebox PPTP VPN User Enumeration Vulnerability

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

Watchguard Firebox user enumeration

Error code is different for invalid username and password for PPTP MS-CHAPv2 authentication...

Authentication flaw

The PPTP VPN service in Watchguard Firebox before 10, when performing the MS-CHAPv2 authentication handshake, generates different error codes depending on whether the username is valid or invalid, which allows remote attackers to enumerate valid usernames...

CVE-2008-1618

The PPTP VPN service in Watchguard Firebox before 10, when performing the MS-CHAPv2 authentication handshake, generates different error codes depending on whether the username is valid or invalid, which allows remote attackers to enumerate valid usernames...