WebUI 1.5b6 - Remote Code Execution

WebUI 1.5b6 - Remote Code Execution + Author: TUNISIAN CYBER + Title: WebUI Remote Code Execution Vulnerability + Date: 21-04-2015 + Vendor: https://github.com/baram01/webui/ + Type: WebAPP + Tested on: KaliLinux Debian + Twitter: @TCYB3R + Proof of concept: http://i.imgur.com/co9Qx0n.png...

ipa security, bug fix, and enhancement update

4.1.0-18.0.1 - Replace login-screen-logo.png 20362818 - Drop subscription-manager requires for OL7 - Drop redhat-access-plugin-ipa requires for OL7 - Blank out header-logo.png product-name.png 4.1.0-18 - Fix ipa-pwd-extop global configuration caching 1187342 - group-detach does not add correct...

Symantec Data Center Security Server 'environment.jsp' Information Disclosure (SYM15-001)

The remote Symantec Data Center Security Server running on the remote host is affected by an information disclosure vulnerability in the '/webui/admin/environment.jsp' script, which discloses sensitive information about the server and software configuration. %NASLMINLEVEL 70300 C Tenable Network...

Cross site scripting

Cross-site scripting XSS vulnerability in the ajaxswing webui in the Management Console server in the management server in Symantec Critical System Protection SCSP 5.2.9 through MP6 and Symantec Data Center Security: Server Advanced SDCS:SA 6.0.x through 6.0 MP1 allows remote authenticated users ...

CVE-2014-9225

The ajaxswing webui in the management server in Symantec Critical System Protection SCSP 5.2.9 through MP6 and Symantec Data Center Security: Server Advanced SDCS:SA 6.0.x through 6.0 MP1 allows remote authenticated users to obtain sensitive server information via unspecified vectors...

CVE-2014-9224

CVE-2014-9224 is a cross-site scripting vulnerability in the ajaxswing webui of the Symantec Critical System Protection (SCSP) Management Console and Symantec Data Center Security: Server Advanced (SDCS:SA). It allows remote authenticated users to inject arbitrary web script or HTML, via unspecif...

PT-2015-4163

Name of the Vulnerable Software and Affected Versions Symantec Critical System Protection SCSP versions 5.2.9 through MP6 Symantec Data Center Security: Server Advanced SDCS:SA versions 6.0.x through 6.0 MP1 Description A cross-site scripting XSS issue exists in the ajaxswing webui component of t...

CVE-2014-9224: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the ajaxswing webui in the Management Console server in the management server in Symantec Critical System Protection SCSP 5.2.9 through MP6 and Symantec Data Center Security: Server Advanced SDCS:SA 6.0.x through 6.0 MP1 allows remote authenticated users ...

CVE-2014-9225: Exposure of Sensitive Information to an Unauthorized Actor

The ajaxswing webui in the management server in Symantec Critical System Protection SCSP 5.2.9 through MP6 and Symantec Data Center Security: Server Advanced SDCS:SA 6.0.x through 6.0 MP1 allows remote authenticated users to obtain sensitive server information via unspecified vectors...

IBM Network Security Protection XGS WebUI Detection

Binary data ibmxgswebuidetect.nbin...

Cisco Identity Services Engine WebUI Detection

Binary data ciscoisewebuidetect.nbin...

CVE-2014-3809: Reflected XSS in Alcatel Lucent 1830 PSS-32/16/4

SWISSCOM CSIRT ADVISORY - http://www.swisscom.com/security CVE ID: CVE-2014-3809 Product: 1830 Photonic Service Switch PSS-32/16/4 Vendor: Alcatel-Lucent Subject: Reflected Cross-site Scripting - XSS Effect: Remotely exploitable Author: Stephan Rickauer stephan.rickauer at swisscom.com Date:...

Cisco TelePresence Conductor WebUI Detection

Binary data ciscotelepresenceconductorwebuidetect.nbin...

CVE-2014-5395

CVE-2014-5395 describes CSRF vulnerabilities in Huawei HiLink devices: HiLink E3276 and E3236 TCPU (before V200R002B470D13SP00C00) and WebUI (before V100R007B100D03SP01C03), E5180s-22 (before 21.270.21.00.00), and E586Bs-2 (before 21.322.10.00.889). The underlying issue is cross-site request forg...

CVE-2014-6616 Softing FG-100 Webui XSS

COMPASS SECURITY ADVISORY http://www.csnc.ch/en/downloads/advisories.html Product: Softing FG-100 PB Vendor: Softing AG www.softing.com CVD ID: CVE-2014-6616 Subject: XSS Risk: High Effect: Remotely exploitable Author: Johannes Klick Daniel Marzin Ingmar Rosenhagen Date: 05.11.2014 Introduction:...

Centreon SQL Injection / Command Injection Vulnerability

Centreon SQL InjectioCentreon versions 2.5.2 and below and Centreon Enterprise Server versions 2.2 and below and 3.0 and below suffer from remote SQL injection and remote command injection vulnerabilities.n / Command Injection Multiple unauthenticated SQL injections and unauthenticated remote...

Centreon SQL Injection / Command Injection

Multiple unauthenticated SQL injections and unauthenticated remote command injection in Centreon SQL injections: ------------------ POST http://server/centreon/include/configuration/configObject/traps/GetXMLTrapsForVendor.php POST DATA mnftrid=1 or 1=1 union all select version,2 -- / POST...

ArubaOS 6.3.1.11 / 6.4.2.1 SSH Authentication Bypass

The version of ArubaOS has an unspecified vulnerability that allows a remote attacker to obtain limited administrative privileges without valid credentials. The vulnerability affects access over SSH. However, access through WebUI and the serial port is not affected, and the vulnerability does not...

Cisco Integrated Management Controller WebUI Detection

Binary data ciscoimcwebuidetect.nbin...

Azureus HTML WebUI 0.7.6 - Cross-Site Request Forgery Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/28848/info Azureus HTML WebUI is prone to a cross-site request-forgery vulnerability. Successful exploits aid in transferring malicious content to unsuspecting users' computers, aiding in further attacks. Other actions ma...