Packeteer PacketShaper Web DoS Vulnerability (CVE-2007-3151)

Packeteer PacketShaper is susceptible to a denial of service vulnerability in the web management interface. SPDX-FileCopyrightText: 2008 nnposter Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Unencrypted NetScaler Web Management Interface (HTTP)

The remote web management interface does not encrypt connections. Description : The remote Citrix NetScaler web management interface does use TLS or SSL to encrypt connections. SPDX-FileCopyrightText: 2008 nnposter Some text descriptions might be excerpted from a referenced sources, and are...

RPortal 1.1 (file_op) Remote File Inclusion Vulnerability

No description provided by source. RPortal v1.1 Rportal is a management system of contents simple and powerful Web, enabling you to create your site in a few minutes, while profiting from a complete and effective administration. Remote and Local File Inclusion Vulnerability = 1.1 Found the 29th...

RPortal 1.1 - 'file_op' Remote File Inclusion

RPortal v1.1 Rportal is a management system of contents simple and powerful Web, enabling you to create your site in a few minutes, while profiting from a complete and effective administration. Remote and Local File Inclusion Vulnerability = 1.1 Found the 29th September 2008 Author: Kad mail :...

Design/Logic Flaw

The web management console in Trend Micro OfficeScan 7.0 through 8.0, Worry-Free Business Security 5.0, and Client/Server/Messaging Suite 3.5 and 3.6 creates a random session token based only on the login time, which makes it easier for remote attackers to hijack sessions via brute-force attacks...

PT-2008-3901 · Trend Micro · Trend Micro Officescan +3

Name of the Vulnerable Software and Affected Versions: Trend Micro OfficeScan versions 7.0 through 8.0 Worry-Free Business Security version 5.0 Client/Server/Messaging Suite versions 3.5 and 3.6 Description: The web management console creates a random session token based only on the login time,...

趋势科技OfficeScan Web管理绕过认证漏洞

BUGTRAQ ID: 30792 CVECAN ID: CVE-2008-2433 OfficeScan是一种针对整个网段的分布式杀毒软件。 OfficeScan的web管理控制台使用了不充分的熵用于创建识别已认证管理员的随机会话令牌。当真正的管理员登录时，会话令牌的熵仅来自于系统时间，细粒度为1秒。攻击者可以相对容易的暴力猜测到认证令牌，扮演成当前登录的管理员，然后通过操控配置完全控制系统。 Trend Micro OfficeScan 8.0 Trend Micro OfficeScan 7.3 Trend Micro OfficeScan 7.0 Trend Micro...

Blue Coat K9 Web Protection Referer头栈溢出漏洞

BUGTRAQ ID: 30463 CVECAN ID: CVE-2007-2952 K9 Web Protection是家用电脑上所使用的内容过滤解决方案，允许用户控制可访问的Internet内容。 在访问基于Web的管理接口时K9 Web Protection的过滤服务（k9filter.exe）没有正确地处理Referer头。如果用户访问了恶意站点并向该接口返回了超长的Referer头，就可以触发栈溢出，导致执行任意指令。 Blue Coat Systems K9 Web Protection 3.2.44 Blue Coat Systems -----------------...

DEV Web Management System 1.5 - Multiple Input Validation Vulnerabilities

source: https://www.securityfocus.com/bid/30447/info DEV Web Management System is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied data. The issues include local file-include, SQL-injection, and cross-site scripting vulnerabilities...

Input validation

Multiple unspecified "input validation" vulnerabilities in the Web management interface aka Messaging Administration interface in Avaya Message Storage Server MSS 3.x and 4.0, and possibly Communication Manager 3.1.x, allow remote authenticated administrators to execute arbitrary commands as user...

CVE-2008-3081

Multiple unspecified "input validation" vulnerabilities in the Web management interface aka Messaging Administration interface in Avaya Message Storage Server MSS 3.x and 4.0, and possibly Communication Manager 3.1.x, allow remote authenticated administrators to execute arbitrary commands as user...

phpMyAdmin远程跨站脚本漏洞

CVECAN ID: CVE-2008-2960 phpMyAdmin是用PHP编写的工具，用于通过WEB管理MySQL。 如果PHP registerglobals的设置为on且服务器没有应用/libraries中.htaccess文件的设置的话，远程攻击者就可以通过向phpMyAdmin提交恶意请求执行跨站脚本攻击，导致执行任意代码。 phpMyAdmin 2.11.7 厂商补丁： phpMyAdmin ---------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

F5 FirePass Content Inspection Management XSS

F5 FirePass Content Inspection Management XSS Product: F5 FirePass http://www.f5.com/products/firepass/ The F5 FirePass SSL VPN appliance provides rudimentary web request sanitization for resources exposed through the appliance via Portal Access. This Content Inspection feature can be configured...

FreeStyleWiki command injection vulnerability

Overview A cross-site scripting vulnerability exists in FreeStyleWiki's web management interface. Impact A user having FreeStyleWiki administrative privileges but with no web server administrative privileges could execute arbitrary code with privileges to execute CGI on the web server. Solution N...

Aruba Mobility Controller Series cross-site scripting vulnerability

Overview Aruba Mobility Controller series, switch products from Aruba Networks, contain a cross-site scripting vulnerability. Aruba Mobility Controller series, switch products from Aruba Networks, contain a cross-site scripting vulnerability in the login page to the web management screens. Impact...

SOL8602 - Cross-site scripting (XSS) vulnerability viewing logs from the web management interface

To prevent exposure to this vulnerability do not select any unknown or suspicious content when viewing log files using the BIG-IP or Enterprise Manager web management interface. To view log files from the command line, access the device using an SSH client. Note: Because exploitation of this...

SOL8599 - Cross-site scripting vulnerability viewing logs from the Console section of the web management interface

A cross-site scripting XSS vulnerability in the Console feature of the BIG-IP and Enterprise Manager web management interface may allow for script excecution when viewing a log file that contains malicious content. Exploitation of this vulnerability would require an attacker to generate a log ent...

CVE-2008-1543

The Advanced User Interface Pages in the ProST Web Management component on the Airspan WiMAX ProST have a certain default User ID and password, which makes it easier for remote attackers to obtain partial administrative access, a different vulnerability than CVE-2008-1262...

Design/Logic Flaw

The Advanced User Interface Pages in the ProST Web Management component on the Airspan WiMAX ProST have a certain default User ID and password, which makes it easier for remote attackers to obtain partial administrative access, a different vulnerability than CVE-2008-1262...

CVE-2008-1543

The Advanced User Interface Pages in the ProST Web Management component on the Airspan WiMAX ProST have a certain default User ID and password, which makes it easier for remote attackers to obtain partial administrative access, a different vulnerability than CVE-2008-1262...