Symantec杀毒软件Reporting Server组件URL处理漏洞

BUGTRAQ ID: 34668 CVECAN ID: CVE-2009-1432 Symantec AntiVirus是非常流行的杀毒解决方案。 Reporting Server是Symantec杀毒软件产品中所使用的用于创建有关企业网络中Symantec杀毒产品报表的可选组件。Reporting Server组件的登录屏幕存在URL处理错误，如果用户受骗跟随了恶意链接就会导致在登录屏幕上显示误导性消息，这有助于攻击者执行网络钓鱼类的欺骗攻击。 Symantec Client Security 3.1 Symantec AntiVirus Corporate Edition 10.2...

Symantec Reporting Server Improper URL Handling Exposure

The remote host is running Symantec Reporting Server, a component of Symantec AntiVirus Corporate Edition, Symantec Client Security, and Symantec Endpoint Protection Manager that serves to create reports about the use of Symantec antivirus products in an enterprise environment. The installed...

CVE-2009-1432

Symantec Reporting Server, as used in Symantec AntiVirus SAV Corporate Edition 10.1 before 10.1 MR8 and 10.2 before 10.2 MR2, Symantec Client Security SCS before 3.1 MR8, and the Symantec Endpoint Protection Manager SEPM component in Symantec Endpoint Protection SEP before 11.0 MR2, allows remote...

CVE-2009-1432

CVE-2009-1432 affects Symantec Reporting Server, used with Symantec AntiVirus Corporate Edition, Symantec Client Security, and Symantec Endpoint Protection Manager. A URL handling error in the Reporting Server login page allows remote attackers to display arbitrary text via a crafted link, enabli...

CVE-2009-1432

Symantec Reporting Server, as used in Symantec AntiVirus SAV Corporate Edition 10.1 before 10.1 MR8 and 10.2 before 10.2 MR2, Symantec Client Security SCS before 3.1 MR8, and the Symantec Endpoint Protection Manager SEPM component in Symantec Endpoint Protection SEP before 11.0 MR2, allows remote...

CVE-2009-1432: Improper Input Validation

Symantec Reporting Server, as used in Symantec AntiVirus SAV Corporate Edition 10.1 before 10.1 MR8 and 10.2 before 10.2 MR2, Symantec Client Security SCS before 3.1 MR8, and the Symantec Endpoint Protection Manager SEPM component in Symantec Endpoint Protection SEP before 11.0 MR2, allows remote...

Symantec Reporting Server Improper URL Handling Exposure

SUMMARY The login web page in some versions of Symantec Reporting Server contains a URL handling error which could potentially allow an attacker to launch a phishing attack. AFFECTED PRODUCTS Product | Affected Version | Solution ---|---|--- Symantec AntiVirus Corporate Edition | 10.1 MR7 and...

FreeBSD : neon format string vulnerabilities (84237895-8f39-11d8-8b29-0020ed76ef5a)

Greuff reports that the neon WebDAV client library contains several format string bugs within error reporting code. A malicious server may exploit these bugs by sending specially crafted PROPFIND or PROPPATCH responses. Although several applications include neon, such as cadaver and subversion, t...

RHEL 5 : udev (RHSA-2009:0427)

Updated udev packages that fix one security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. udev provides a user-space API and implements a dynamic device directory, providing only the...

ftpdmin 0.96 RNFR Remote Buffer Overflow Exploit (xp sp3/case study)

Exploit for windows platform in category remote exploits ==================================================================== ftpdmin 0.96 RNFR Remote Buffer Overflow Exploit xp sp3/case study ==================================================================== ".$cmd."\n";...

Ubuntu Update for moin vulnerabilities USN-458-1

Ubuntu Update for Linux kernel vulnerabilities USN-458-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN4581.nasl 7969 2017-12-01 09:23:16Z santu $ Ubuntu Update for moin vulnerabilities USN-458-1 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH,...

Ubuntu: Security Advisory (USN-458-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Reporting Plugin- Cross-site scripting error

Our e-security found the following error for the Reporting plugin: Number System/Location Defect Type Status R2 Reporting Plugin Client-side Attacks: Cross-site Scripting Open Description Security Risk: It is possible to steal or manipulate customer session and cookies, which may be used to...

Reporting Plugin- Cross-site scripting error

Our e-security found the following error for the Reporting plugin: Number System/Location Defect Type Status R2 Reporting Plugin Client-side Attacks: Cross-site Scripting Open Description Security Risk: It is possible to steal or manipulate customer session and cookies, which may be used to...

Reporting Plugin- Cross-site scripting error

Our e-security found the following error for the Reporting plugin: Number System/Location Defect Type Status R2 Reporting Plugin Client-side Attacks: Cross-site Scripting Open Description Security Risk: It is possible to steal or manipulate customer session and cookies, which may be used to...

New e-crime reporting tool being developed

The Anti-Phishing Working Group APWG hasdeveloped a way for police and other organizations to report e-crimes in a common data format readable by a Web browser or other application, according to a report by Jeremy Kirk CIO.com. Peter Cassidy, secretary general of the Anti-Phishing Working Group...

Unfixed XSS vulnerability at www.globalhealthreporting.org

Security researcher Xylitol, has submitted on 03/10/2009 a cross-site-scripting XSS vulnerability affecting www.globalhealthreporting.org, which at the time of submission ranked 26828719 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 13/01/201...

CVE-2009-0857

Cross-site scripting XSS vulnerability in /prm/reports in the Performance Reporting Module PRM for Sun Management Center SunMC 3.6.1 and 4.0 allows remote attackers to inject arbitrary web script or HTML via the msg parameter. NOTE: this can be leveraged for access to the SunMC Web Console...

Cross site scripting

Cross-site scripting XSS vulnerability in /prm/reports in the Performance Reporting Module PRM for Sun Management Center SunMC 3.6.1 and 4.0 allows remote attackers to inject arbitrary web script or HTML via the msg parameter. NOTE: this can be leveraged for access to the SunMC Web Console...

CVE-2009-0857

Cross-site scripting XSS vulnerability in /prm/reports in the Performance Reporting Module PRM for Sun Management Center SunMC 3.6.1 and 4.0 allows remote attackers to inject arbitrary web script or HTML via the msg parameter. NOTE: this can be leveraged for access to the SunMC Web Console...