SurfControl SuperScout Email Filter 3.5 - User Credential Disclosure

SurfControl SuperScout Email Filter 3.5 - User Credential Disclosure source: https://www.securityfocus.com/bid/5929/info SurfControl SuperScout Email Filter comes with a web-based interface to provide remote access to administrative facilities. One of the files userlist.asp that comes with the we...

CVE-2002-0708

The CVE-2002-0708 entry relates to a directory traversal vulnerability in SurfControl SuperScout WebFilter’s Web Reports Server. Affected component: Web Reports Server; vulnerability arises from improper handling of HTTP requests containing repeated dot sequences, enabling remote attackers to rea...

CVE-2002-0709

The CVE-2002-0709 issue affects SurfControl SuperScout WebFilter’s Web Reports Server. The problem arises from SQL injection in the report components (notably SimpleBar.dll/RunReport and related DLLs) where input is not properly validated, allowing remote attackers toExecute arbitrary SQL against...

CVE-2002-0705

CVE-2002-0705 affects SurfControl SuperScout WebFilter's Web Reports Server. The vulnerability stems from storing the scwebusers file (usernames) and associated passwords in a web-accessible directory, allowing remote attackers to obtain valid usernames and crack passwords. The security advisory ...

CVE-2002-0708

Directory traversal vulnerability in the Web Reports Server for SurfControl SuperScout WebFilter allows remote attackers to read arbitrary files via an HTTP request containing ... triple dot sequences...

CVE-2002-0707

The Web Reports Server for SurfControl SuperScout WebFilter allows remote attackers to cause a denial of service CPU consumption via large GET requests, possibly due to a buffer overflow...

CVE-2002-0706

CVE-2002-0706 affects SurfControl SuperScout WebFilter’s Web Reports Server, specifically the UserManager.js component. The root cause is the use of weak encryption for administrator functions, with a hard-coded key inside a JavaScript function, enabling decryption of the admin password. This all...

CVE-2002-0705

The Web Reports Server for SurfControl SuperScout WebFilter stores the "scwebusers" username and password file in a web-accessible directory, which allows remote attackers to obtain valid usernames and crack the passwords...

CVE-2002-0707

The CVE-2002-0707 issue affects SurfControl SuperScout WebFilter’s Web Reports Server. The vulnerability allows remote attackers to trigger a denial of service by sending large GET requests, potentially due to a buffer overflow. Documented impact is CPU consumption leading to service unavailabili...

CVE-2002-0706

UserManager.js in the Web Reports Server for SurfControl SuperScout WebFilter uses weak encryption for administrator functions, which allows remote attackers to decrypt the administrative password using a hard-coded key in a Javascript function...

SurfControl SuperScout WebFilter for Windows 2000 - File Disclosure

SurfControl SuperScout WebFilter for Windows 2000 - File Disclosure source: https://www.securityfocus.com/bid/5857/info SurfControl SuperScout WebFilter Reports Server is prone to a vulnerability which may allow remote attackers to disclose the contents of arbitrary files. The Reports Server does...

SurfControl SuperScout does not filter web requests fragmented in multiple packets

Overview SurfControl SuperScout Web Filter does not block some HTTP requests that have been fragmented into multiple packets. Description SurfControl SuperScout Web Filter is software intended for companies that wish to limit employees' web surfing to appropriate uses. SuperScout anazlyzes...

Переполнения буфера в SurfControl (buffer overflow)

Переполнения буфера при разбору SMTP-команд...

DoS in SurfControl's EmailFilter

Just an FYI: I did communicate heavily with SurfControl on this before posting it here: On February 12, 2002, I contacted SurfControl concerning a denial of service condition in the EmailFilter Version 4.0. The DoS was successfully carried out on a Windows 2000 Professional SP2 box. On February 1...

CVE-2001-1465

SurfControl SuperScout only filters packets containing both an HTTP GET request and a Host header, which allows local users to bypass filtering by fragmenting packets so that no packet contains both data elements...

CVE-2000-0124

surfCONTROL SuperScout does not properly asign a category to web sites with a . dot at the end, which may allow users to bypass web access restrictions...

CVE-2000-0124

CVE-2000-0124 affects surfCONTROL SuperScout. The vulnerability arises because it does not properly assign a category to web sites that end with a dot, which could allow bypassing web access restrictions. The NVD entry lists a low base score (CVSS2 2.1) with local attack vector, unauthenticated a...

CVE-2000-0124

surfCONTROL SuperScout does not properly asign a category to web sites with a . dot at the end, which may allow users to bypass web access restrictions...

surfcontrol.txt

Vulnerable Apps/Platforms: -So far, surfCONTROL SuperScout 2.6.1.6, Only version tested, with rules blocking based on web site category. Complete No Access rules still successfully block. -Possibly all previous versions. -This vulnerability voids the ability to block users based on category...