CVE-2012-0297 Symantec Web Gateway Vulnerability

The management GUI in Symantec Web Gateway 5.0.x before 5.0.3 does not properly restrict access to application scripts, which allows remote attackers to execute arbitrary code by 1 injecting crafted data or 2 including crafted data. Recent assessments: wchen-r7 at September 12, 2019 6:07pm UTC...

CVE-2012-0298: Undefined Security Weakness

The file-management scripts in the management GUI in Symantec Web Gateway 5.0.x before 5.0.3 allow remote attackers to 1 read or 2 delete arbitrary files via unspecified vectors...

CVE-2012-0297: Undefined Security Weakness

The management GUI in Symantec Web Gateway 5.0.x before 5.0.3 does not properly restrict access to application scripts, which allows remote attackers to execute arbitrary code by 1 injecting crafted data or 2 including crafted data...

PT-2012-2475

Name of the Vulnerable Software and Affected Versions Symantec Web Gateway versions 5.0.x through 5.0.2 Description The issue allows remote attackers to upload arbitrary code to a designated pathname and possibly execute this code via unspecified vectors. This is related to the file-management...

CVE-2012-0296: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the management GUI in Symantec Web Gateway 5.0.x before 5.0.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2012-2472

Name of the Vulnerable Software and Affected Versions Symantec Web Gateway versions 5.0.x before 5.0.3 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the management GUI. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via...

Sql injection

SQL injection vulnerability in forget.php in the management GUI in Symantec Web Gateway 4.5.x allows remote attackers to execute arbitrary SQL commands via the username parameter...

CVE-2011-0549

SQL injection vulnerability in forget.php in the management GUI in Symantec Web Gateway 4.5.x allows remote attackers to execute arbitrary SQL commands via the username parameter...

CVE-2011-0549: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in forget.php in the management GUI in Symantec Web Gateway 4.5.x allows remote attackers to execute arbitrary SQL commands via the username parameter...

PT-2011-2437

Name of the Vulnerable Software and Affected Versions Symantec Web Gateway versions 4.5.x Description The issue allows remote attackers to execute arbitrary SQL commands via the username parameter in the forget.php file of the management GUI. Recommendations For Symantec Web Gateway versions 4.5....

Cross site scripting

Cross-site scripting XSS vulnerability in the management GUI in the MX Management Server in Imperva SecureSphere Web Application Firewall 6.2, 7.x, and 8.x allows remote attackers to inject arbitrary web script or HTML via an HTTP request to a firewalled server, aka Bug ID 31759...

PT-2011-2618

Name of the Vulnerable Software and Affected Versions Imperva SecureSphere Web Application Firewall versions 6.2, 7.x, and 8.x Description A cross-site scripting XSS issue exists in the management GUI of the MX Management Server, allowing remote attackers to inject arbitrary web script or HTML vi...

CVE-2011-0767: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the management GUI in the MX Management Server in Imperva SecureSphere Web Application Firewall 6.2, 7.x, and 8.x allows remote attackers to inject arbitrary web script or HTML via an HTTP request to a firewalled server, aka Bug ID 31759...

CVE-2009-2766

httpd.c in httpd in the management GUI in DD-WRT 24 sp1 does not require administrative authentication for programs under cgi-bin/, which allows remote attackers to change settings via HTTP requests...

Design/Logic Flaw

httpd.c in httpd in the management GUI in DD-WRT 24 sp1 does not require administrative authentication for programs under cgi-bin/, which allows remote attackers to change settings via HTTP requests...

CVE-2009-2765

httpd.c in httpd in the management GUI in DD-WRT 24 sp1, and other versions before build 12533, allows remote attackers to execute arbitrary commands via shell metacharacters in a request to a cgi-bin/ URI...

CVE-2009-2766

httpd.c in httpd in the management GUI in DD-WRT 24 sp1 does not require administrative authentication for programs under cgi-bin/, which allows remote attackers to change settings via HTTP requests...

CVE-2009-2765

The DD-WRT firmware (versions 24 sp1 and others before build 12533 ) is vulnerable to a remote command injection flaw in the httpd.c component of the management GUI. The root cause is a failure to adequately sanitize user-supplied input data, allowing unauthenticated attackers to execute arbitrar...

CVE-2009-2766

CVE-2009-2766 affects httpd.c in the httpd management GUI of DD-WRT 24 sp1; CGI programs under /cgi-bin/ can be accessed without administrative authentication, enabling remote changes via HTTP requests. CBSS: Network vector, low complexity, no authentication, with partial impact on confidentialit...

CVE-2009-2765: Improper Input Validation

httpd.c in httpd in the management GUI in DD-WRT 24 sp1, and other versions before build 12533, allows remote attackers to execute arbitrary commands via shell metacharacters in a request to a cgi-bin/ URI...