f5asm-xss.txt

F5 BIG-IP Web Management ASM Security Report XSS Product: F5 BIG-IP Application Security Manager http://www.f5.com/products/big-ip/product-modules/application-security-manager.html The F5 BIG-IP ASM web management interface contains a cross-site scripting vulnerability in the Security Report...

F5 BIG-IP Application Security Manager 9.4.3 - report_type Cross-Site Scripting

F5 BIG-IP Application Security Manager 9.4.3 - reporttype Cross-Site Scripting source: https://www.securityfocus.com/bid/27462/info F5 BIG-IP Application Security Manager is prone to a cross-site scripting vulnerability because the web management interface fails to properly sanitize user-supplied...

F5 BIG-IP Application Security Manager 9.4.3 - 'report_type' Cross-Site Scripting

source: https://www.securityfocus.com/bid/27462/info F5 BIG-IP Application Security Manager is prone to a cross-site scripting vulnerability because the web management interface fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in...

CVE-2008-0265

Multiple cross-site scripting XSS vulnerabilities in the Search function in the web management interface in F5 BIG-IP 9.4.3 allow remote attackers to inject arbitrary web script or HTML via the SearchString parameter to 1 listsystem.jsp, 2 listpktfilter.jsp, 3 listltm.jsp, 4 resourcesaudit.jsp, a...

CVE-2008-0265

Multiple cross-site scripting XSS vulnerabilities in the Search function in the web management interface in F5 BIG-IP 9.4.3 allow remote attackers to inject arbitrary web script or HTML via the SearchString parameter to 1 listsystem.jsp, 2 listpktfilter.jsp, 3 listltm.jsp, 4 resourcesaudit.jsp, a...

f5-xss.txt

F5 BIG-IP Web Management List Search XSS Product: F5 BIG-IP http://www.f5.com/products/big-ip/ The F5 BIG-IP web management interface contains a cross-site scripting vulnerability in the Search function present on several list-like pages. Parameter SearchString is not sanitized before it gets...

CVE-2008-0150

Unspecified vulnerability in the LDAP authentication feature in Aruba Mobility Controller 2.3.6.15, 2.5.2.11, 2.5.4.25, 2.5.5.7, 3.1.1.3, and 2.4.8.11-FIPS or earlier allows remote attackers to bypass authentication mechanisms and obtain management or VPN interface access...

NetScaler Web Management ws/generic_api_call.pl standalone Parameter XSS

The remote Citrix NetScaler web management interface is susceptible to cross-site scripting attacks. %NASLMINLEVEL 70300 netscalerwebxss.nasl GPLv2 History: 1.00, 11/21/07 - Initial release Changes by Tenable: - Revised plugin title 9/23/09 - Added CPE and updated copyright 10/18/2012...

Design/Logic Flaw

The web management interface in Citrix NetScaler 8.0 build 47.8 uses weak encryption XOR of unpadded data to store credentials within a cookie, which makes it easier for remote attackers to obtain cleartext credentials when a cookie is captured via a known-plaintext attack...

CVE-2007-6193

The web management interface in Citrix NetScaler 8.0 build 47.8 stores the device's primary IP address in a cookie, which might allow remote attackers to obtain sensitive network configuration information if this address is not the same as the address being used by the web interface...

CVE-2007-6192

The web management interface in Citrix NetScaler 8.0 build 47.8 uses weak encryption XOR of unpadded data to store credentials within a cookie, which makes it easier for remote attackers to obtain cleartext credentials when a cookie is captured via a known-plaintext attack...

CVE-2007-6193

CVE-2007-6193 concerns the Citrix NetScaler web management interface. The OpenVAS entries and the NVD record indicate that NetScaler 8.0 build 47.8 exposes the device’s primary IP address (and, per OpenVAS, software version) via the web management cookie, enabling information disclosure. The impa...

CVE-2007-6192

The CVE-2007-6192 entry describes an information disclosure vulnerability in the Citrix NetScaler Web Management Interface (NetScaler 8.0 build 47.8). The issue arises from using weak encryption to protect cookie contents by XORing sensitive values (including credentials) with a fixed key stream,...

Cross site scripting

Cross-site scripting XSS vulnerability in the login page in the management interface in the Aruba 800 Mobility Controller 2.5.4.18 and earlier, and 2.4.8.6-FIPS and earlier, allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to the /screens URI, related to the url...

CVE-2003-1363

The CVE affects Aprelium Technologies Abyss Web Server 1.1.2 and earlier, where the remote web management interface on port 9999 fails to log connection attempts. This lack of logging can enable remote brute-force attacks against the administration console without detection. The available connect...

CVE-2007-5482

Unspecified vulnerability in the FTP service in Sun StorEdge/StorageTek 3510 FC Array with firmware before 4.21 allows remote attackers, with access to the Ethernet management interface, to cause a denial of service I/O request timeout and device hang via unspecified vectors...

Design/Logic Flaw

Unspecified vulnerability in the FTP service in Sun StorEdge/StorageTek 3510 FC Array with firmware before 4.21 allows remote attackers, with access to the Ethernet management interface, to cause a denial of service I/O request timeout and device hang via unspecified vectors...

CVE-2007-5482

Affected product : Sun StorEdge/StorageTek 3510 FC Array. Vulnerability class : unspecified vulnerability in the FTP service. Component/firmware : FTP service on the array with firmware before 4.21. Impact : remote attackers with access to the Ethernet management interface can cause a denial of s...

CVE-2007-5482

Unspecified vulnerability in the FTP service in Sun StorEdge/StorageTek 3510 FC Array with firmware before 4.21 allows remote attackers, with access to the Ethernet management interface, to cause a denial of service I/O request timeout and device hang via unspecified vectors...

CVE-2003-1343

Trend Micro ScanMail for Exchange SMEX before 3.81 and before 6.1 might install a back door account in smgSmxcfg30.exe, which allows remote attackers to gain access to the web management interface via the vcc parameter, possibly "3560121183d3"...