9684 matches found
CVE-2013-3505: Undefined Security Weakness
The Nagios-App component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to bypass intended access restrictions via a direct request for a 1 log file or 2 configuration file...
CVE-2013-3506: Undefined Security Weakness
cgi-bin/performance/perfchart.cgi in the Performance component in GroundWork Monitor Enterprise 6.7.0 does not properly restrict XML content, which allows remote attackers to execute arbitrary commands by creating a .shtml file and leveraging Server Side Includes SSI functionality...
CVE-2013-3508: Improper Control of Generation of Code
html/System-Files.php in the System File Overview feature in the NeDi component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to execute arbitrary commands via vectors involving file editing...
CVE-2013-3500: Undefined Security Weakness
The Foundation webapp admin interface in GroundWork Monitor Enterprise 6.7.0 uses the nagios account as the owner of writable files under /usr/local/groundwork, which allows context-dependent attackers to bypass intended filesystem restrictions by leveraging access to a GroundWork script...
CVE-2013-3501: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in GroundWork Monitor Enterprise 6.7.0 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 the foundation-webapp/admin/ directory, 2 the NeDi component, or 3 the Noma component...
CVE-2013-3513: Cross-Site Request Forgery (CSRF)
Multiple cross-site request forgery CSRF vulnerabilities in the Noma component in GroundWork Monitor Enterprise 6.7.0 allow remote attackers to hijack the authentication of unspecified victims for requests that 1 store XSS sequences or 2 delete entries...
PT-2013-4443
Name of the Vulnerable Software and Affected Versions GroundWork Monitor Enterprise version 6.7.0 Description The issue allows remote authenticated users to execute arbitrary commands. This is possible through vectors involving file editing in the System File Overview feature of the NeDi componen...
CVE-2013-0673
Directory traversal vulnerability in the web interface in the Health Monitor service in MatrikonOPC A&E Historian 1.0.0.0 allows remote attackers to read and delete arbitrary files via a crafted URL...
CVE-2013-0673
Directory traversal vulnerability in the web interface in the Health Monitor service in MatrikonOPC A&E Historian 1.0.0.0 allows remote attackers to read and delete arbitrary files via a crafted URL...
CVE-2013-0673
CVE-2013-0673 describes a directory traversal vulnerability in the web interface of the MatrikonOPC A&E Historian Health Monitor service (version 1.0.0.0). An attacker can remotely read and delete arbitrary files by crafting a URL to the Health Monitor web interface, exposing sensitive server fil...
PT-2013-2518
Name of the Vulnerable Software and Affected Versions MatrikonOPC A&E Historian version 1.0.0.0 Description The issue allows remote attackers to read and delete arbitrary files via a crafted URL, specifically due to a directory traversal vulnerability in the web interface of the Health Monitor...
CVE-2013-0673: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in the web interface in the Health Monitor service in MatrikonOPC A&E Historian 1.0.0.0 allows remote attackers to read and delete arbitrary files via a crafted URL...
op5 Monitor < 5.7.3 Multiple Vulnerabilities
The version of op5 Monitor hosted on the remote web server is earlier than 5.7.3. It is, therefore, affected by the following vulnerabilities: - The 'status/hostgroupgrid' script fails to properly sanitize user-supplied input to the 'itemsperpage' parameter, which could allow for a SQL injection...
WordPress Download Monitor Plugin <= 3.3.6.1 - XSS #2
Because of this vulnerability in admin/admin.php, the attackers can inject arbitrary web script or HTML via the "p" parameter. Solution Update the plugin...
Virtual Access Monitor SQL injection
Few different SQL injections...
NGS00248 Patch Notification: Virtual Access Monitor Multiple SQL Injection Vulnerabilities
High Risk Vulnerability in Virtual Access Monitor 2 April 2013 Ken Wolstencroft of NCC Group has discovered a High risk vulnerability in Virtual Access Monitor Impact: Multiple SQL Injection Vulnerabilities Versions affected: Virtual Access Monitor 3.10.17 and previous Details of the most recent...
SEC Consult SA-20130308-0 :: Multiple critical vulnerabilities in GroundWork Monitor Enterprise (part 1)
SEC Consult Vulnerability Lab Security Advisory 20130308-0 ======================================================================= title: Multiple critical vulnerabilities part 1 product: GroundWork Monitor Enterprise vulnerable version: 6.7.0 fixed version: none - optional technical bulletin...
SEC Consult SA-20130308-1 :: Multiple vulnerabilities in GroundWork Monitor Enterprise (part 2)
SEC Consult Vulnerability Lab Security Advisory 20130308-1 ======================================================================= title: Multiple high risk vulnerabilities part 2 product: GroundWork Monitor Enterprise vulnerable version: 6.7.0 fixed version: none - optional technical bulletin...
GroundWork Monitor Enterprise 6.7.0 SQL Injection / Command Execution
GroundWork Monitor Enterprise version 6.7.0 suffers from remote SQL injection, file disclosure, command injection, and cross site scripting vulnerabilities. This is the second of two advisories documenting all the issues in GroundWork. Detailed proof of concepts were removed by the author because...
GroundWork Monitor Enterprise 6.7.0 XSS / Disclosure / Command Execution
GroundWork Monitor Enterprise version 6.7.0 suffers from insufficient authentication, file disclosure, file modification, cross site scripting, XML external entity injection, command injection, and various other vulnerabilities. Detailed proof of concepts were removed by the author because...