57 matches found
Cross site scripting
Cross-site scripting XSS vulnerability in the events page in the System iNtrusion Analysis and Reporting Environment SNARE for Linux agent before 1.7.0 allows remote attackers to inject arbitrary web script or HTML via a logged shell command...
CVE-2011-5249
Cross-site scripting XSS vulnerability in the events page in the System iNtrusion Analysis and Reporting Environment SNARE for Linux agent before 1.7.0 allows remote attackers to inject arbitrary web script or HTML via a logged shell command...
CVE-2011-5249
SNARE for Linux (older than 1.7.0) contains a cross-site scripting (XSS) vulnerability in the web interface that serves the events/logs. The issue arises because user-supplied data from logged shell commands is not validated before rendering in the browser, allowing an attacker to inject arbitrar...
Snare Agent Detection
The remote web server contains a Snare Agent installation used for auditing and analysis of system events. The agent includes an optionally configured embedded web server used to configure rules for event monitoring. C Tenable Network Security, Inc. include"compat.inc"; if description...
Snare Agent for Linux < 1.7.0 / 2.0.0 Multiple Vulnerabilities
According to its self-reported version number, the installation of Snare Agent for Linux hosted on the remote web server is affected by multiple vulnerabilities in the optionally configured web interface: - The web interface discloses a hashed password for remote logins. An attacker can view the...
Snare Agent Linux Password Disclosure / CSRF Vulnerabilities
Snare for Linux ships with a web interface that can be used for viewing log data and configuring the agent. In the web interface at /remote, a user is able to set a password for remote configuration of the agent. The rendered page contains the field "RemotePassword" with its input type set to...
Snare for Linux Cross-Site Scripting via Log Injection I. BACKGROUND ---------------------- Snare for Linux provides a 'C2' or 'CAPP' style audit subsystem for the Linux operating system. It can be used as a standalone auditing tool for Linux, or can send data to the Snare Server for analysis and...
Snare for Linux Cross-Site Request Forgery
Snare for Linux Cross-Site Request Forgery I. BACKGROUND ---------------------- Snare for Linux provides a 'C2' or 'CAPP' style audit subsystem for the Linux operating system. It can be used as a standalone auditing tool for Linux, or can send data to the Snare Server for analysis and storage. II...
Snare for Linux Password Disclosure
Snare for Linux Password Disclosure I. BACKGROUND ---------------------- Snare for Linux provides a 'C2' or 'CAPP' style audit subsystem for the Linux operating system. It can be used as a standalone auditing tool for Linux, or can send data to the Snare Server for analysis and storage. II...
Snare For Linux Cross Site Scripting
Snare for Linux Cross-Site Scripting via Log Injection I. BACKGROUND ---------------------- Snare for Linux provides a 'C2' or 'CAPP' style audit subsystem for the Linux operating system. It can be used as a standalone auditing tool for Linux, or can send data to the Snare Server for analysis and...
Cross site request forgery (csrf)
Multiple cross-site request forgery CSRF vulnerabilities in the web management interface in InterSect Alliance Snare Agent 3.2.3 and earlier on Solaris, Snare Agent 3.1.7 and earlier on Windows, Snare Agent 1.5.0 and earlier on Linux and AIX, Snare Agent 1.4 and earlier on IRIX, Snare Epilog 1.5....
KLA10331 SB vulnerability in Snare
A CSRF vulnerability was found in Snare. By exploiting this vulnerability malicious users can hijack administrator auth. This vulnerability can be exploited remotely. Original advisories - Related products Snare-for-Windows Epilog-for-Windows CVE list CVE-2010-2594 high Solution Update to latest...
CVE-2010-2594
The CVE-2010-2594 issue affects InterSect Alliance Snare Agent and Epilog products across Solaris, Windows, Linux/AIX, IRIX and UNIX variants. Description and connected records confirm multiple CSRF vulnerabilities in the web management interface that allow remote attackers to hijack administrato...
CVE-2010-2594
Multiple cross-site request forgery CSRF vulnerabilities in the web management interface in InterSect Alliance Snare Agent 3.2.3 and earlier on Solaris, Snare Agent 3.1.7 and earlier on Windows, Snare Agent 1.5.0 and earlier on Linux and AIX, Snare Agent 1.4 and earlier on IRIX, Snare Epilog 1.5....
PT-2010-4133 · Ibm +6 · Aix +7
Name of the Vulnerable Software and Affected Versions: InterSect Alliance Snare Agent versions 3.2.3 and earlier on Solaris InterSect Alliance Snare Agent versions 3.1.7 and earlier on Windows InterSect Alliance Snare Agent versions 1.5.0 and earlier on Linux and AIX InterSect Alliance Snare Agen...
Snare for Windows < 3.1.8 Web Interface Cross-Site Request Forgery
Binary data 5590.prm...
Snare Agent web interface cross-site request forgery vulnerabilities
Overview The Snare Agent web interface is susceptible to cross-site request forgery attacks. Description The web interface allows the administrator to manage several agent settings, including changing the listening port and password. These HTTP requests do not perform proper validity checks and a...