PT-2009-5092 · Ca · Ca Siteminder

Name of the Vulnerable Software and Affected Versions: CA SiteMinder affected versions not specified Description: The issue allows remote attackers to bypass cross-site scripting XSS protections for J2EE applications. This is achieved through a request containing a %00 encoded null byte...

Computer Associates SiteMinder - %00 Cross-Site Scripting Protection Security Bypass

Computer Associates SiteMinder - %00 Cross-Site Scripting Protection Security Bypass source: https://www.securityfocus.com/bid/36086/info Computer Associates SiteMinder is prone to a security-bypass vulnerability because it fails to properly validate user-supplied input. An attacker can exploit...

Computer Associates SiteMinder - Unicode Cross-Site Scripting Protection Security Bypass

Computer Associates SiteMinder - Unicode Cross-Site Scripting Protection Security Bypass source: https://www.securityfocus.com/bid/36088/info Computer Associates SiteMinder is prone to a security-bypass vulnerability because it fails to properly validate user-supplied input. An attacker can explo...

Computer Associates SiteMinder - Unicode Cross-Site Scripting Protection Security Bypass

source: https://www.securityfocus.com/bid/36088/info Computer Associates SiteMinder is prone to a security-bypass vulnerability because it fails to properly validate user-supplied input. An attacker can exploit this issue to bypass cross-site scripting protections. Successful exploits can aid in...

Computer Associates SiteMinder - '%00' Cross-Site Scripting Protection Security Bypass

source: https://www.securityfocus.com/bid/36086/info Computer Associates SiteMinder is prone to a security-bypass vulnerability because it fails to properly validate user-supplied input. An attacker can exploit this issue to bypass cross-site scripting protections. Successful exploits can aid in...

CVE-2007-5923

Cross-site scripting XSS vulnerability in forms/smpwservices.fcc in CA formerly Computer Associates eTrust SiteMinder Agent allows remote attackers to inject arbitrary web script or HTML via the SMAUTHREASON parameter, a different vector than CVE-2005-2204...

CVE-2007-5923

The CVE-2007-5923 entry describes a Cross-site scripting (XSS) vulnerability in CA eTrust SiteMinder components, specifically in forms/smpwservices.fcc, exposed via the SMAUTHREASON parameter. The vulnerability affects the SiteMinder Agent/web components and could allow an attacker to inject arbi...

CVE-2007-5923

Cross-site scripting XSS vulnerability in forms/smpwservices.fcc in CA formerly Computer Associates eTrust SiteMinder Agent allows remote attackers to inject arbitrary web script or HTML via the SMAUTHREASON parameter, a different vector than CVE-2005-2204...

SiteMinder Agent: Cross Site Scripting

Exploit in XSS: https://www.example.com/siteminderagent/forms/smpwservices.fcc?SMAUTHREASON=XSS Cross Site Scripting Code: https://www.example.com/siteminderagent/forms/smpwservices.fcc?SMAUTHREASON=1alertdocument.cookie;function+dropif0 In this way we can inject the alert code without brackets i...

Computer Associates SiteMinder - Web Agent Smpwservices.FCC Cross-Site Scripting

Computer Associates SiteMinder - Web Agent Smpwservices.FCC Cross-Site Scripting source: https://www.securityfocus.com/bid/26375/info Computer Associates SiteMinder Web Agent is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting...

Computer Associates SiteMinder - Web Agent Smpwservices.FCC Cross-Site Scripting

source: https://www.securityfocus.com/bid/26375/info Computer Associates SiteMinder Web Agent is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue allows attackers to execute arbitrary HTML or script code in a user's...

CVE-2003-1311

siteminderagent/SmMakeCookie.ccc in Netegrity SiteMinder does not ensure that the TARGET parameter names a valid redirection resource, which allows remote attackers to construct a URL that might trick users into visiting an arbitrary web site referenced by this parameter...

CVE-2003-1311

Technical details about CVE-2003-1311 are not publicly available in the provided connected documents. No concrete affected products, versions, root cause specifics, or remediation are present. Monitor for updates to obtain authoritative information.

CVE-2003-1312

CVE-2003-1312 affects siteminderagent/SmMakeCookie.ccc in Netegrity SiteMinder, where a session ID is placed in the SMSESSION parameter value within a URL. This could allow an attacker to obtain the session ID via network sniffing, Referer logs, or similar methods. The provided documents describe...

CVE-2003-1312

siteminderagent/SmMakeCookie.ccc in Netegrity SiteMinder places a session ID string in the value of the SMSESSION parameter in a URL, which might allow remote attackers to obtain the ID by sniffing, reading Referer logs, or other methods...

CVE-2005-2204

Cross-site scripting XSS vulnerability in Computer Associates CA eTrust SiteMinder 5.5, when the "CSSChecking" parameter is set to "NO," allows remote attackers to inject arbitrary web script or HTML via the 1 PASSWORD or 2 BUFFER parameters to smpwservicescgi.exe, 3 the TARGET parameter to...

CVE-2005-2204

CVE-2005-2204 describes a cross-site scripting vulnerability in CA eTrust SiteMinder 5.5. When CSSChecking is set to NO, an attacker can inject arbitrary script/HTML through parameters to smpwservicescgi.exe (PASSWORD, BUFFER) and login.fcc (TARGET), and possibly other vectors. This affects SiteM...

CVE-2005-2204

Cross-site scripting XSS vulnerability in Computer Associates CA eTrust SiteMinder 5.5, when the "CSSChecking" parameter is set to "NO," allows remote attackers to inject arbitrary web script or HTML via the 1 PASSWORD or 2 BUFFER parameters to smpwservicescgi.exe, 3 the TARGET parameter to...

SiteMinder 5.5 Multiple Script XSS

The remote host is running SiteMinder, an access-management solution from Netegrity / Computer Associates. The installed version of SiteMinder suffers from several cross-site scripting flaws in its 'smpwservicescgi.exe' and 'login.fcc' scripts. An attacker can exploit these flaws to inject...

[Full-disclosure] SiteMinder Multiple Vulnerabilities

/ $ An open security advisory 10 - Siteminder v5.5 Vulnerabilities 1: Bug Researcher: c0ntex - c0ntexbatgmail.com 2: Bug Released: July 08 2005 3: Bug Impact Rate: Medium / Hi 4: Bug Scope Rate: Remote $ This advisory and/or proof of concept code must not be used for commercial gain. Siteminder...