CVE-2013-3503: Undefined Security Weakness

The Profile Importer feature in monarch.cgi in the MONARCH component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External...

CVE-2013-3509: Undefined Security Weakness

html/System-NeDi.php in the NeDi component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the scan functionality in the System / NeDi menu...

CVE-2013-3505: Undefined Security Weakness

The Nagios-App component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to bypass intended access restrictions via a direct request for a 1 log file or 2 configuration file...

CVE-2013-3506: Undefined Security Weakness

cgi-bin/performance/perfchart.cgi in the Performance component in GroundWork Monitor Enterprise 6.7.0 does not properly restrict XML content, which allows remote attackers to execute arbitrary commands by creating a .shtml file and leveraging Server Side Includes SSI functionality...

CVE-2013-3508: Improper Control of Generation of Code

html/System-Files.php in the System File Overview feature in the NeDi component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to execute arbitrary commands via vectors involving file editing...

CVE-2013-3499: Undefined Security Weakness

GroundWork Monitor Enterprise 6.7.0 performs authentication on the basis of the HTTP Referer header, which allows remote attackers to obtain administrative privileges or access files via a crafted header...

CVE-2013-3500: Undefined Security Weakness

The Foundation webapp admin interface in GroundWork Monitor Enterprise 6.7.0 uses the nagios account as the owner of writable files under /usr/local/groundwork, which allows context-dependent attackers to bypass intended filesystem restrictions by leveraging access to a GroundWork script...

CVE-2013-3513: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Noma component in GroundWork Monitor Enterprise 6.7.0 allow remote attackers to hijack the authentication of unspecified victims for requests that 1 store XSS sequences or 2 delete entries...

CVE-2013-3501: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in GroundWork Monitor Enterprise 6.7.0 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 the foundation-webapp/admin/ directory, 2 the NeDi component, or 3 the Noma component...

CVE-2013-3512: Improper Input Validation

The Cacti component in GroundWork Monitor Enterprise 6.7.0 does not properly perform authorization checks, which allows remote authenticated users to read or modify configuration settings via unspecified vectors, as demonstrated by reading credentials...

PT-2013-4436

Name of the Vulnerable Software and Affected Versions GroundWork Monitor Enterprise version 6.7.0 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The vulnerabilities are related ...

CVE-2013-0673

Directory traversal vulnerability in the web interface in the Health Monitor service in MatrikonOPC A&E Historian 1.0.0.0 allows remote attackers to read and delete arbitrary files via a crafted URL...

CVE-2013-0673

Directory traversal vulnerability in the web interface in the Health Monitor service in MatrikonOPC A&E Historian 1.0.0.0 allows remote attackers to read and delete arbitrary files via a crafted URL...

CVE-2013-0673

CVE-2013-0673 describes a directory traversal vulnerability in the web interface of the MatrikonOPC A&E Historian Health Monitor service (version 1.0.0.0). An attacker can remotely read and delete arbitrary files by crafting a URL to the Health Monitor web interface, exposing sensitive server fil...

PT-2013-2518

Name of the Vulnerable Software and Affected Versions MatrikonOPC A&E Historian version 1.0.0.0 Description The issue allows remote attackers to read and delete arbitrary files via a crafted URL, specifically due to a directory traversal vulnerability in the web interface of the Health Monitor...

CVE-2013-0673: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the web interface in the Health Monitor service in MatrikonOPC A&E Historian 1.0.0.0 allows remote attackers to read and delete arbitrary files via a crafted URL...

op5 Monitor < 5.7.3 Multiple Vulnerabilities

The version of op5 Monitor hosted on the remote web server is earlier than 5.7.3. It is, therefore, affected by the following vulnerabilities: - The 'status/hostgroupgrid' script fails to properly sanitize user-supplied input to the 'itemsperpage' parameter, which could allow for a SQL injection...

WordPress Download Monitor Plugin <= 3.3.6.1 - XSS #2

Because of this vulnerability in admin/admin.php, the attackers can inject arbitrary web script or HTML via the "p" parameter. Solution Update the plugin...

Virtual Access Monitor SQL injection

Few different SQL injections...

NGS00248 Patch Notification: Virtual Access Monitor Multiple SQL Injection Vulnerabilities

High Risk Vulnerability in Virtual Access Monitor 2 April 2013 Ken Wolstencroft of NCC Group has discovered a High risk vulnerability in Virtual Access Monitor Impact: Multiple SQL Injection Vulnerabilities Versions affected: Virtual Access Monitor 3.10.17 and previous Details of the most recent...