Netsweeper WebAdmin unixlogin.php Python Code Injection

This module exploits a Python code injection in the Netsweeper WebAdmin component's unixlogin.php script, for versions 6.4.4 and prior, to execute code as the root user. Authentication is bypassed by sending a random whitelisted Referer header in each request. Tested on the CentOS Linux-based...

Security Bulletin: IBM Integration Bus is affected by WebAdmin Session Timeout vulnerability (CVE-2017-1693)

Summary IBM Integration Bus has addressed the following vulnerability Vulnerability Details CVEID: CVE-2017-1693 DESCRIPTION: IBM Integration Bus could allow an attacker that has captured a valid session id to highjack another users session during a small timeframe before the session times out...

Netsweeper Cross-Site Scripting Vulnerability (CNVD-2020-10711)

Netsweeper is a Web content filtering solution from Netsweeper Canada. A cross-site scripting vulnerability exists in the webadmin / policy / grouptableajax.php file in versions of Netsweeper prior to 3.1.10, which stems from a lack of proper validation of client-side data by the WEB application...

CVE-2014-9608

Cross-site scripting XSS vulnerability in webadmin/policy/grouptableajax.php/ in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO...

CVE-2014-9615

Cross-site scripting XSS vulnerability in Netsweeper 4.0.4 allows remote attackers to inject arbitrary web script or HTML via the url parameter to webadmin/deny/index.php...

Sql injection

Multiple SQL injection vulnerabilities in Netsweeper before 2.6.29.10 allow remote attackers to execute arbitrary SQL commands via the 1 login parameter to webadmin/auth/verification.php or 2 dpid parameter to webadmin/deny/index.php...

Directory traversal

Directory traversal vulnerability in webadmin/reporter/viewserverlog.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to list directory contents via a .. dot dot in the log parameter in a stats action...

CVE-2014-9615

Netsweeper 4.0.4 is affected by a cross-site scripting (XSS) vulnerability via the url parameter to webadmin/deny/index.php. The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to script execution in the victim’s browser. The Nuclei template confirms this...

CVE-2014-9614

CVE-2014-9614 (Netsweeper) affects the Web Panel prior to version 4.0.5, where the branding account uses a default password of 'branding'. This allows remote attackers to access the system by targeting the webadmin/ interface. The NUCLEI template confirms the issue and describes impact as unautho...

CVE-2014-9609

Directory traversal vulnerability in webadmin/reporter/viewserverlog.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to list directory contents via a .. dot dot in the log parameter in a stats action...

CVE-2014-9609

CVE-2014-9609 describes a directory traversal flaw in Netsweeper’s webadmin/reporter/view_server_log.php, exploitable via a .. in the log parameter under a stats action to list directory contents. Affected versions include Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2. Reme...

CVE-2014-9608

Netsweeper is affected by an XSS in webadmin/policy/group_table_ajax.php/ across multiple tracked versions: before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2. The issue stems from insufficient validation of client-side data via PATH_INFO, enabling remote attackers to inject arbitrary web ...

PT-2020-7783

Name of the Vulnerable Software and Affected Versions: Netsweeper versions prior to 2.6.29.10 Description: The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the login parameter to the "webadmin/auth/verification.php" API endpoint or the dpid parameter t...

PT-2020-7784

Name of the Vulnerable Software and Affected Versions: Netsweeper versions prior to 4.0.5 Description: The issue concerns a default password set for the branding account in the Web Panel, making it easier for remote attackers to gain access. This can be achieved by sending a request to the...

CVE-2014-9615: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Netsweeper 4.0.4 allows remote attackers to inject arbitrary web script or HTML via the url parameter to webadmin/deny/index.php...

CVE-2014-9609: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in webadmin/reporter/viewserverlog.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to list directory contents via a .. dot dot in the log parameter in a stats action...

CVE-2014-9608: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in webadmin/policy/grouptableajax.php/ in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO...

CVE-2014-9606: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allow remote attackers to inject arbitrary web script or HTML via the 1 server parameter to remotereporter/loadlogfiles.php, 2 customctid parameter to...

PT-2020-7785

Name of the Vulnerable Software and Affected Versions: Netsweeper version 4.0.4 Description: The issue allows remote attackers to inject arbitrary web script or HTML via the url parameter to "webadmin/deny/index.php" API endpoint. This is a cross-site scripting XSS issue, which can lead to the...

PT-2020-7781

Name of the Vulnerable Software and Affected Versions: Netsweeper versions 3.1.10 and earlier, 4.0.x through 4.0.8, 4.1.x through 4.1.1 Description: The issue allows remote attackers to list directory contents via a .. dot dot in the log parameter in a stats action. This is due to a directory...