CVE-2013-4094

The Key Management feature in the SecureSphere Operations Manager SOM Management Server in Imperva SecureSphere 9.0.0.5 allows remote authenticated users to upload executable files via the 1 privatekey or 2 publickey parameter in a T/keyManagement request to plain/settings.html, as demonstrated b...

CVE-2013-4094

The Key Management feature in the SecureSphere Operations Manager SOM Management Server in Imperva SecureSphere 9.0.0.5 allows remote authenticated users to upload executable files via the 1 privatekey or 2 publickey parameter in a T/keyManagement request to plain/settings.html, as demonstrated b...

CVE-2013-4093: Improper Limitation of a Pathname to a Restricted Directory

The SecureSphere Operations Manager SOM Management Server in Imperva SecureSphere 9.0.0.5 allows remote attackers to obtain sensitive information via 1 a direct request to dwr/call/plaincall/AsyncOperationsContainer.getOperationState.dwr, which reveals the installation path in the s0.filePath...

CVE-2013-4094: Improper Input Validation

The Key Management feature in the SecureSphere Operations Manager SOM Management Server in Imperva SecureSphere 9.0.0.5 allows remote authenticated users to upload executable files via the 1 privatekey or 2 publickey parameter in a T/keyManagement request to plain/settings.html, as demonstrated b...

PT-2013-4847

Name of the Vulnerable Software and Affected Versions Imperva SecureSphere version 9.0.0.5 Description The issue allows remote authenticated users to upload executable files. This can be achieved by using the private key or public key parameter in a T/keyManagement request to the...

PT-2013-4846

Name of the Vulnerable Software and Affected Versions Imperva SecureSphere version 9.0.0.5 Description The issue allows remote attackers to obtain sensitive information. This can be achieved through a direct request to "dwr/call/plaincall/AsyncOperationsContainer.getOperationState.dwr", which...

CVE-2005-4558: Undefined Security Weakness

IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, does not properly restrict acceptable values for the language parameter to mail/settings.html before it is stored in a database, which can allow remote authenticated users to include...

CVE-2005-1488: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Merak Mail Server 8.0.3 with Icewarp Web Mail 5.4.2 allow remote authenticated users to inject arbitrary web script or HTML via 1 the E-mail address, Note, or Public Certificate fields to address.html, 2 addressaction.html, 3 the Signature fiel...

CVE-2004-1719: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Merak Webmail Server 5.2.7 allow remote attackers to inject arbitrary web script or HTML via the 1 category, 2 cserver, 3 ext, 4 global, 5 showgroups, 6 or showlite parameters to address.html, or the 7 spage or 8 autoresponder parameters to...