Symantec LiveUpdate Administrator控制请求伪造漏洞

CVE ID: CVE-2011-0545 Symantecs LiveUpdate Administrator可对内容提供基础架构支持。 Symantec LiveUpdate Administrator在实现上存在控制请求伪造漏洞，远程攻击者可利用此漏洞以管理员身份执行HTML或脚本代码。 此漏洞源于登录界面未能正确过滤或验证外部输入中的变量。在向受影响系统的事件日志提交了恶意条目后，授权管理员必须登录到管理界面GUI并访问事件登录页面触发漏洞。 Symantec LiveUpdate Administrator 2.2.2.9 厂商补丁： Symantec --------...

CVE-2011-0545

Cross-site request forgery CSRF vulnerability in adduser.do in Symantec LiveUpdate Administrator LUA before 2.3 allows remote attackers to hijack the authentication of administrators for requests that create new administrative accounts, and possibly have unspecified other impact, via the userRole...

CVE-2011-0545

CVE-2011-0545 describes a cross-site request forgery in Symantec LiveUpdate Administrator (LUA) prior to version 2.3. The vulnerability occurs in the adduser.do endpoint via the userRole parameter, allowing a remote attacker to hijack administrator authentication to create new administrative acco...

NSOADV-2011-001: Symantec LiveUpdate Administrator CSRF vulnerability

NSOADV-2011-001: Symantec LiveUpdate Administrator CSRF vulnerability 111101111 11111 00110 00110001111 111111 01 01 1 11111011111111 11111 0 11 01 0 11 1 1 111011001 11111111101 1 11 0110111 1 1111101111 1001 0 1 10 11 0 10 11 1111111 1 111 111001 111111111 0 10 1111 0 11 11 111111111 1 1101 10...

Symantec LiveUpdate Administrator Cross-Site Request Forgery

SUMMARY Symantecs LiveUpdate Administrator LUA is susceptible to a cross-site request forgery vulnerability which could result in the execution of HTML or script code in the context of the admins browser. AFFECTED PRODUCTS Product | Version | Solution ---|---|--- Symantec LiveUpdate Administrator...