Cross site scripting

Cross-site scripting XSS vulnerability in the management interface in Microsoft FAST ESP 5.1.5 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

HP Client Automation Satellite Web Console Detection

HP Client Automation Satellite, the portion of HP Client Automation that is installed on client systems, was detected on the remote host. This is used for managing client devices. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid56165; scriptversion"1.5";...

CVE-2009-5092

Cross-site scripting XSS vulnerability in the management interface in Microsoft FAST ESP 5.1.5 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-5092: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the management interface in Microsoft FAST ESP 5.1.5 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2011-1341

Name of the Vulnerable Software and Affected Versions Microsoft FAST ESP versions 5.1.5 and earlier Description A cross-site scripting XSS issue exists in the management interface, allowing remote attackers to inject arbitrary web script or HTML. Recommendations For versions 5.1.5 and earlier,...

Design/Logic Flaw

The web-based management interface on Cisco SA 500 series security appliances with software before 2.1.19 allows remote authenticated users to execute arbitrary commands via crafted parameters to web forms, aka Bug ID CSCtq65681...

CVE-2011-2547

The CVE-2011-2547 issue affects Cisco SA 500 Series Security Appliances running software before 2.1.19. The Privilege Escalation vulnerability allows an authenticated user to inject arbitrary commands into the underlying OS via crafted parameters in web forms, enabling execution with root-equival...

CVE-2011-2546

SQL injection vulnerability in the web-based management interface on Cisco SA 500 series security appliances with software before 2.1.19 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCtq65669...

PT-2011-3925

Name of the Vulnerable Software and Affected Versions Cisco SA 500 series security appliances versions prior to 2.1.19 Description A SQL injection issue exists in the web-based management interface, allowing remote attackers to execute arbitrary SQL commands. Recommendations For versions prior to...

CVE-2011-2546: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the web-based management interface on Cisco SA 500 series security appliances with software before 2.1.19 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCtq65669...

CVE-2011-2547: Undefined Security Weakness

The web-based management interface on Cisco SA 500 series security appliances with software before 2.1.19 allows remote authenticated users to execute arbitrary commands via crafted parameters to web forms, aka Bug ID CSCtq65681...

Cisco SA 500 Series Security Appliances Web Management Interface SQL Injection Vulnerability

Cisco SA 500 Series Security Appliances firmware contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary SQL code on a system. The vulnerability is due to improper validation of user-supplied input to the Cisco SA 500 Security Appliance web-based...

Cisco SA 500 Series Security Appliances Web Management Interface Vulnerabilities

...

ManageEngine SupportCenter Plus Default Administrator Credentials

The remote ManageEngine SupportCenter Plus install uses a default set of credentials 'administrator' / 'administrator' to control access to its management interface. With this information, an attacker can gain administrative access to the application. %NASLMINLEVEL 70300 C Tenable Network Securit...

PT-2011-08: Multiple vulnerabilities in Dlink DPH 150SE/E/F1

Positive Research Center has discovered multiple vulnerabilities in Dlink DPH 150SE/E/F1 IP phone. 1. A vulnerability exists in web management interface of Dlink DPH 150SE and allows an unauthenticated user to obtain device configuration file with all the settings including administrator's...

CVE-2011-1645

The web management interface on the Cisco RVS4000 Gigabit Security Router with software 1.x before 1.3.3.4 and 2.x before 2.0.2.7, and the WRVS4400N Gigabit Security Router with software before 2.0.2.1, allows remote attackers to read the backup configuration file, and consequently execute...

Design/Logic Flaw

The web management interface on the Cisco RVS4000 Gigabit Security Router with software 1.x before 1.3.3.4 and 2.x before 2.0.2.7, and the WRVS4400N Gigabit Security Router with software before 2.0.2.1, allows remote authenticated users to execute arbitrary commands via the 1 ping test parameter ...

CVE-2011-1645

The web management interface on the Cisco RVS4000 Gigabit Security Router with software 1.x before 1.3.3.4 and 2.x before 2.0.2.7, and the WRVS4400N Gigabit Security Router with software before 2.0.2.1, allows remote attackers to read the backup configuration file, and consequently execute...

CVE-2011-1647: Exposure of Sensitive Information to an Unauthorized Actor

The web management interface on the Cisco RVS4000 Gigabit Security Router with software 1.x before 1.3.3.4 and 2.x before 2.0.2.7, and the WRVS4400N Gigabit Security Router with software before 2.0.2.1, allows remote attackers to read the private key for the admin SSL certificate via unspecified...

CVE-2011-1645: Undefined Security Weakness

The web management interface on the Cisco RVS4000 Gigabit Security Router with software 1.x before 1.3.3.4 and 2.x before 2.0.2.7, and the WRVS4400N Gigabit Security Router with software before 2.0.2.1, allows remote attackers to read the backup configuration file, and consequently execute...