Cross site scripting

Cross-site scripting XSS vulnerability in the Dashboard Backend service stats/dashboard.jsp in SonicWall Network Security Appliance NSA 2400 allows remote attackers to inject arbitrary web script or HTML via the sn parameter...

CVE-2014-2589

Cross-site scripting XSS vulnerability in the Dashboard Backend service stats/dashboard.jsp in SonicWall Network Security Appliance NSA 2400 allows remote attackers to inject arbitrary web script or HTML via the sn parameter...

McAfee ePolicy Orchestrator XML External Entity (CVE-2014-2205)

An XML External Entity XXE vulnerability has been reported in McAfee ePolicy Orchestrator ePO. The vulnerability is due to a design weakness in the ePO Web Console component. A remote attacker can exploit this vulnerability by sending a maliciously crafted XML dashboard definition...

PT-2014-4798 · Sonicwall · Sonicwall Network Security Appliance

Name of the Vulnerable Software and Affected Versions: SonicWall Network Security Appliance NSA 2400 Description: The issue is related to a cross-site scripting XSS vulnerability in the Dashboard Backend service, specifically in the stats/dashboard.jsp component. This vulnerability allows remote...

Fedora 20 : ReviewBoard-1.7.22-2.fc20 (2014-3446)

New upstream security release 1.7.22 - http://www.reviewboard.org/docs/releasenotes/reviewboa rd/1.7.22/ - Security Fixes : - An XSS vulnerability was found in the Search field's auto-complete. - New Features : - Added support for anonymous access to public Local Sites. - Added support for...

CVE-2012-0891

Multiple cross-site scripting XSS vulnerabilities in Puppet Dashboard 1.0 before 1.2.5 and Enterprise 1.0 before 1.2.5 and 2.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified fields...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Puppet Dashboard 1.0 before 1.2.5 and Enterprise 1.0 before 1.2.5 and 2.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified fields...

CVE-2012-0891

Multiple cross-site scripting XSS vulnerabilities in Puppet Dashboard 1.0 before 1.2.5 and Enterprise 1.0 before 1.2.5 and 2.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified fields...

CVE-2012-0891

CVE-2012-0891 involves multiple XSS vulnerabilities in Puppet Dashboard 1.0 up to 1.2.5 and Puppet Enterprise 1.0 up to 1.2.5, and in 2.x up to 2.0.1. The issue allows an attacker to inject arbitrary web script or HTML via unspecified input fields, enabling likely browser-side code execution and ...

SonicWALL NSA 2400 Security Dashboard跨站脚本漏洞

SonicWALL NSA 系列采用新一代统一威胁管理UTM技术抵抗各种攻击,兼备入侵防御、防病毒及反间谍软件功能和SonicWALL应用防火墙的应用层控制功能。 由于通过"sn" GET参数传递到/stats/dashboard.jsp的输入在返回用户前未能正确过滤，攻击者可以利用漏洞在受影响站点上下文的用户浏览器会话中执行任意HTML和脚本代码。 0 SonicWALL Network Security Appliance NSA Series 厂商补丁： SonicWALL ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

[RT-SA-2014-001] McAfee ePolicy Orchestrator: XML External Entity Expansion in Dashboard

Advisory: McAfee ePolicy Orchestrator XML External Entity Expansion in Dashboard RedTeam Pentesting identified an XML external entity expansion vulnerability in McAfee ePolicy Orchestrator's ePO dashboard feature. Users with the ability to create new dashboards in the ePO web interface who exploi...

[WAF-FLE v0.6.3] Web application firewall: fast log and event console

WAF-FLE is a OpenSource Console for ModSecurity, it allow the modsec admin to view and search events sent by mlogc modsecurity event log handler. Features : Central event console Support Modsecurity in “traditional” and “Anomaly Scoring” Able to receive events sent from mlogc in real time or in...

CVE-2013-6728

The charting component in IBM WebSphere Dashboard Framework WDF 6.1.5 and 7.0.1 allows remote attackers to view or delete image files by leveraging incorrect security constraints for a temporary directory...

Directory traversal

The charting component in IBM WebSphere Dashboard Framework WDF 6.1.5 and 7.0.1 allows remote attackers to view or delete image files by leveraging incorrect security constraints for a temporary directory...

CVE-2013-6728

The charting component in IBM WebSphere Dashboard Framework WDF 6.1.5 and 7.0.1 allows remote attackers to view or delete image files by leveraging incorrect security constraints for a temporary directory...

Apache Tomcat Manager Code Execution Exploit

This Metasploit module can be used to execute a payload on Apache Tomcat servers that have an exposed "manager" application. The payload is uploaded as a WAR archive containing a jsp application using a POST request against the /manager/html/upload component. NOTE: The compatible payload sets var...

Apache Tomcat Manager Authenticated Upload Code Execution

This module can be used to execute a payload on Apache Tomcat servers that have an exposed "manager" application. The payload is uploaded as a WAR archive containing a jsp application using a POST request against the /manager/html/upload component. NOTE: The compatible payload sets vary based on...

Cross-Site Scripting (XSS) in WP-Cron Dashboard Wordpress plugin

Advisory ID: HTB23189 Product: WP-Cron Dashboard Wordpress plugin Vendor: OKAMOTO Wataru Vulnerable Versions: 1.1.5 and probably prior Tested Version: 1.1.5 Advisory Publication: December 5, 2013 without technical details Vendor Notification: December 5, 2013 Public Disclosure: December 26, 2013...

CVE-2013-6991

Cross-site scripting XSS vulnerability in the WP-Cron Dashboard plugin 1.1.5 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the procname parameter to wp-admin/tools.php...

Cross site scripting

Cross-site scripting XSS vulnerability in the WP-Cron Dashboard plugin 1.1.5 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the procname parameter to wp-admin/tools.php...