CVE-2013-3507: Exposure of Sensitive Information to an Unauthorized Actor

The NeDi component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to obtain sensitive information via a direct request for 1 a configuration file, 2 a database dump, or 3 the Tomcat status context...

PT-2013-4445

Name of the Vulnerable Software and Affected Versions GroundWork Monitor Enterprise version 6.7.0 Description The issue concerns multiple SQL injection vulnerabilities. These vulnerabilities allow remote authenticated users to execute arbitrary SQL commands. The affected API endpoints include...

PT-2013-4436

Name of the Vulnerable Software and Affected Versions GroundWork Monitor Enterprise version 6.7.0 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The vulnerabilities are related ...

CVE-2013-3511: Improper Input Validation

Open redirect vulnerability in the NeDi component in GroundWork Monitor Enterprise 6.7.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

SEC Consult SA-20130308-1 :: Multiple vulnerabilities in GroundWork Monitor Enterprise (part 2)

SEC Consult Vulnerability Lab Security Advisory 20130308-1 ======================================================================= title: Multiple high risk vulnerabilities part 2 product: GroundWork Monitor Enterprise vulnerable version: 6.7.0 fixed version: none - optional technical bulletin...

GroundWork Monitor Enterprise 6.7.0 SQL Injection / Command Execution

GroundWork Monitor Enterprise version 6.7.0 suffers from remote SQL injection, file disclosure, command injection, and cross site scripting vulnerabilities. This is the second of two advisories documenting all the issues in GroundWork. Detailed proof of concepts were removed by the author because...