How to add a pre-log in or post-log in message for users in an on-prem Storefront environment

With on-prem Storefront, administrators can customise their users' pre-log in or post log-in experience by adding a pop-up welcome message...

Palo Alto Networks PAN-OS 5.0.9 Multiple Vulnerabilities

The remote host is running version 5.0.9 of Palo Alto Networks PAN-OS. It is, therefore, affected by multiple vulnerabilities : - A denial of service vulnerability exists due to an inability to handle IP packets larger than 1480 bytes through an Active/Active VWire setup. An attacker can exploit...

SOL11797 - Pre-logon sequence vulnerability to token spoofing

A vulnerability exists in the FirePass pre-logon sequence. Under certain conditions, the FirePass controller can accept the output of a pre-logon sequence check that would have been run on a different computer. This vulnerability would allow an attacker to use the pre-logon token from a workstati...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in F5 FirePass 4100 SSL VPN 5.4.1 through 5.5.2 and 6.0 through 6.0.1, when pre-logon sequences are enabled, allow remote attackers to inject arbitrary web script or HTML via the query string to 1 my.activation.php3 and 2 my.logon.php3...

SOL7923 - Cross-site scripting vulnerability in the logon page after enabling a pre-logon sequence - CVE-2007-6704

A cross-site scripting XSS vulnerability—CVE-2007-6704—exists in the FirePass logon page when a pre-logon sequence is enabled. The affected FirePass URL fails to fully sanitize URL input before the web page content is sent to the browser. It is possible for an attacker to create web pages,...

SOL7164 - Execution of UNIX shell commands from a URL without authentication

A URL that is accessible without first authenticating to the FirePass controller may be modified to inject UNIX shell commands. Under certain conditions, the commands can then be executed with user-level privileges. Any attacker with access to the FirePass logon page can theoretically launch this...