PT-2023-24459 · Microworld Technologies · Escan Management Console

Name of the Vulnerable Software and Affected Versions: Microworld Technologies eScan Management Console version 14.0.1400.2281 Description: The issue allows any remote attacker to retrieve the password of any admin or normal user in plain text format through the GetUserCurrentPwd function...

CVE-2023-33730

Privilege Escalation in the "GetUserCurrentPwd" function in Microworld Technologies eScan Management Console 14.0.1400.2281 allows any remote attacker to retrieve password of any admin or normal user in plain text format...

CVE-2023-31703

Cross Site Scripting XSS in the edit user form in Microworld Technologies eScan management console 14.0.1400.2281 allows remote attacker to inject arbitrary code via the from parameter...

Cross site scripting

Cross Site Scripting XSS in the edit user form in Microworld Technologies eScan management console 14.0.1400.2281 allows remote attacker to inject arbitrary code via the from parameter...

CVE-2023-31703

Cross Site Scripting XSS in the edit user form in Microworld Technologies eScan management console 14.0.1400.2281 allows remote attacker to inject arbitrary code via the from parameter...

CVE-2023-31703

CVE-2023-31703 affects Microworld eScan Management Console (v14.0.1400.2281). A Cross-Site Scripting flaw in the editUserName form via the from parameter enables remote injection of arbitrary code. Documented risk includes potential session-cookie theft leading to account takeover (as shown in Po...

CVE-2018-18388

eScan Agent Application MWAGENT.EXE 4.0.2.98 in MicroWorld Technologies eScan 14.0 allows remote or local attackers to execute arbitrary commands by sending a carefully crafted payload to TCP port 2222...

Code injection

eScan Agent Application MWAGENT.EXE 4.0.2.98 in MicroWorld Technologies eScan 14.0 allows remote or local attackers to execute arbitrary commands by sending a carefully crafted payload to TCP port 2222...

CVE-2018-18388

eScan Agent Application MWAGENT.EXE 4.0.2.98 in MicroWorld Technologies eScan 14.0 allows remote or local attackers to execute arbitrary commands by sending a carefully crafted payload to TCP port 2222...

Directory traversal

Directory traversal vulnerability in Web Based Administration in MicroWorld Technologies MailScan 5.6.a espatch 1 allows remote attackers to read arbitrary files via a .. dot dot in the URI...

Improper access control

Web Based Administration in MicroWorld Technologies MailScan 5.6.a espatch 1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to determine the installation path, IP addresses, and error messages via direct requests to files under LOG/...

CVE-2008-3726

Cross-site scripting XSS vulnerability in Web Based Administration in MicroWorld Technologies MailScan 5.6.a espatch 1 allows remote attackers to inject arbitrary web script or HTML via the URI...

CVE-2008-3729

Web Based Administration in MicroWorld Technologies MailScan 5.6.a espatch 1 allows remote attackers to bypass authentication and obtain administrative access via a direct request with 1 an IsAdmin=true cookie value or 2 no cookie...

CVE-2008-3728

CVE-2008-3728 affects MicroWorld Technologies MailScan 5.6.a espatch 1. Web-based administration stores sensitive information under the web root with insufficient access control, enabling remote attackers to discover installation path, IP addresses, and error messages by requesting files under LO...

CVE-2008-3726

Cross-site scripting XSS vulnerability in Web Based Administration in MicroWorld Technologies MailScan 5.6.a espatch 1 allows remote attackers to inject arbitrary web script or HTML via the URI...

CVE-2008-3728

Web Based Administration in MicroWorld Technologies MailScan 5.6.a espatch 1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to determine the installation path, IP addresses, and error messages via direct requests to files under LOG/...

CVE-2008-3729

CVE-2008-3729 affects MicroWorld Technologies MailScan Web-Based Administration (MailScan 5.6.a espatch 1). The issue allows remote attackers to bypass authentication and obtain administrative access by sending a direct request with (1) an IsAdmin=true cookie value or (2) no cookie. This is a coo...

CVE-2008-3727

CVE-2008-3727 describes a directory traversal vulnerability in the Web Based Administration component of MicroWorld Technologies MailScan 5.6.a espatch 1. An unauthenticated or remote attacker could read arbitrary files by presenting a URI path containing .. (dot dot). The available connected sou...

[Full-disclosure] Multiple eScan products insecure file permissions

========================================================================= Team Intell Security Advisory TISA2007-13-Public ------------------------------------------------------------------------- Multiple eScan products insecure file permissions...

Secunia Research: eScan Products Agent Service Command Decryption Buffer Overflow

====================================================================== Secunia Research 23/05/2007 - eScan Products Agent Service Command Decryption Buffer Overflow - ====================================================================== Table of Contents Affected...