CVE-2008-2026

The CVE-2008-2026 issue affects RSA Security's WebID IISWebAgentIF.dll in the RSA Authentication Agent for Web, version 5.3.0.258 and older than 5.3.3.378. Root cause is insufficient filtering of the postdata parameter, enabling remote XSS via a URL-encoded postdata value. An exploit example exis...

CVE-2008-2027

Open redirect vulnerability in WebID/IISWebAgentIF.dll in RSA Authentication Agent 5.3.0.258 for Web for IIS, when accessed via certain browsers such as Mozilla Firefox, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an ftp URL in the url paramet...

CVE-2008-2026: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in WebID/IISWebAgentIF.dll in RSA Authentication Agent 5.3.0.258, and other versions before 5.3.3.378, allows remote attackers to inject arbitrary web script or HTML via a URL-encoded postdata parameter. NOTE: this is different than CVE-2005-1118, but it mig...

CVE-2008-2027: Exposure of Sensitive Information to an Unauthorized Actor

Open redirect vulnerability in WebID/IISWebAgentIF.dll in RSA Authentication Agent 5.3.0.258 for Web for IIS, when accessed via certain browsers such as Mozilla Firefox, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an ftp URL in the url paramet...

RSA认证代理登录页面IISWebAgentIF.dll跨站脚本漏洞

BUGTRAQ ID: 28277 CVECAN ID: CVE-2008-1470 RSA认证代理软件是非常流行的动态认证工具，可控制对公司网络、基于Web的应用和操作系统的访问。 RSA认证的服务器端脚本/WebID/IISWebAgentIF.dll没有正确地过滤postdata参数输入，如果攻击者通过POST或GET方式传送了恶意参数的话，就可能导致跨站脚本攻击。 RSA Security RSA Authentication Agent for Web 5.3.0.258 RSA Security ------------...

RSA认证代理URI重新定向漏洞

BUGTRAQ ID: 28907 RSA认证代理软件是非常流行的动态认证工具，可控制对公司网络、基于Web的应用和操作系统的访问。 RSA认证代理处理URL参数时存在输入验证漏洞，远程攻击者可能利用此漏洞执行钓鱼攻击。 当RSA认证代理访问特制的URL时，服务器端脚本/WebID/IISWebAgentIF.dll只过滤了http://和https:// 协议的url参数但没有过滤FTP或Gopher协议的URL参数。如果攻击者向允许匿名连接的FTP服务器上传了伪造的登录页面的话，就可能将用户重新定向至任意页面，这有助于攻击者发动网络钓鱼攻击。 RSA Security RSA...

ProCheckUp Security Advisory 2007.44

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 PR07-44: XSS on RSA Authentication Agent login page Vulnerability found: 5th December 2007 Vendor informed: 13th December 2007 Severity: Medium-high Successfully tested on: RSA Authentication Agent 5.3.0.258 for Web for Internet Information Services...

ProCheckUp Security Advisory 2007.43

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 PR07-43: Cross-domain redirect on RSA Authentication Agent Vulnerability found: 5th December 2007 Vendor informed: 13th December 2007 Severity: Medium-low Successfully tested on: RSA Authentication Agent 5.3.0.258 for Web for Internet Information...

PR07-44: XSS on RSA Authentication Agent login page

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 PR07-44: XSS on RSA Authentication Agent login page Vulnerability found: 5th December 2007 Vendor informed: 13th December 2007 Severity: Medium-high Successfully tested on: RSA Authentication Agent 5.3.0.258 for Web for Internet Information Services...

RSA Authentication Agent crossite scripting

Crossite scriptign via authorization page...

PR07-43: Cross-domain redirect on RSA Authentication Agent

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 PR07-43: Cross-domain redirect on RSA Authentication Agent Vulnerability found: 5th December 2007 Vendor informed: 13th December 2007 Severity: Medium-low Successfully tested on: RSA Authentication Agent 5.3.0.258 for Web for Internet Information...

RSA Authentication Agent for Web 5.3 - Open Redirection

RSA Authentication Agent for Web 5.3 - Open Redirection source: https://www.securityfocus.com/bid/28907/info RSA Authentication Agent for Web is prone to a remote URI-redirection vulnerability because the application fails to adequately sanitize user-supplied input. A successful attack may aid in...

RSA Authentication Agent for Web 5.3 - Open Redirection

source: https://www.securityfocus.com/bid/28907/info RSA Authentication Agent for Web is prone to a remote URI-redirection vulnerability because the application fails to adequately sanitize user-supplied input. A successful attack may aid in phishing-style attacks. This issue affects RSA...

Attack Trojans-remote control software of its own vulnerability to your attention?-vulnerability warning-the black bar safety net

from:sowhat blog Two days before the RSA conference, there was a guy named Joel Eriksson researchers show how to attack the Trojans, particularly the Trojan control terminalto control the“hacker”. blog.wired.com/27bstroke6/2008/04/researcher-demo.html Eriksson found one in the Celestial Empire on...

CVE-2008-1470

Incomplete blacklist vulnerability in IISWebAgentIF.dll in the WebID RSA Authentication Agent 5.3, and possibly earlier, allows remote attackers to conduct cross-site scripting XSS attacks via the postdata parameter, due to an incomplete fix for CVE-2005-1118...

CVE-2008-1470

CVE-2008-1470 describes an incomplete blacklist vulnerability in IISWebAgentIF.dll of the WebID RSA Authentication Agent 5.3 (and possibly earlier) , allowing remote attackers to perform cross-site scripting (XSS) via the postdata parameter. The issue stems from an incomplete fix for CVE-2005-111...

CVE-2008-1470

Incomplete blacklist vulnerability in IISWebAgentIF.dll in the WebID RSA Authentication Agent 5.3, and possibly earlier, allows remote attackers to conduct cross-site scripting XSS attacks via the postdata parameter, due to an incomplete fix for CVE-2005-1118...

CVE-2008-1470: Improper Neutralization of Input During Web Page Generation

Incomplete blacklist vulnerability in IISWebAgentIF.dll in the WebID RSA Authentication Agent 5.3, and possibly earlier, allows remote attackers to conduct cross-site scripting XSS attacks via the postdata parameter, due to an incomplete fix for CVE-2005-1118...

rsa-xss.txt

The following security report has been sent to RSA/EMC on the 2/10/2007 and confirmed by them. RSA took action to alert their customers. ----------------------------------------- Description The WebID authentication framework suffers from a flow allowing to steal an authenticated users's session ...

RSA WebID 5.3 - IISWebAgentIF.dll Cross-Site Scripting

RSA WebID 5.3 - IISWebAgentIF.dll Cross-Site Scripting source: https://www.securityfocus.com/bid/28277/info RSA WebID is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary...