Symantec Web Gateway管理接口"username" SQL注入漏洞

CVE ID：CVE-2011-0549 Symantec Web Gateway是一款Web安全网关硬件设备。 通过"username"参数传递给管理接口中的forget.php的输入在用于SQL查询之前缺少过滤，攻击者可以通过SQL注入攻击获得敏感信息或操作数据库。 Symantec Web Gateway 4.x 厂商解决方案 用户可参考如下供应商提供的安全公告获得补丁信息：...

ZDI-11-233: Symantec Web Gateway forget.php SQL Injection Vulnerability

ZDI-11-233: Symantec Web Gateway forget.php SQL Injection Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-233 July 7, 2011 -- CVE ID: CVE-2011-0549 -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P -- Affected Vendors: Symantec -- Affected Products: Symantec Web Gateway -- TippingPointTM...

Sql injection

SQL injection vulnerability in forget.php in the management GUI in Symantec Web Gateway 4.5.x allows remote attackers to execute arbitrary SQL commands via the username parameter...

CVE-2011-0549

SQL injection vulnerability in forget.php in the management GUI in Symantec Web Gateway 4.5.x allows remote attackers to execute arbitrary SQL commands via the username parameter...

CVE-2011-0549

SQL injection vulnerability in forget.php in the management GUI in Symantec Web Gateway 4.5.x allows remote attackers to execute arbitrary SQL commands via the username parameter...

CVE-2011-0549

Concretely, CVE-2011-0549 affects Symantec Web Gateway 4.5.x, where the forget.php management interface passes the username parameter unfiltered, enabling remote SQL injection. The vulnerability allows an unauthenticated attacker to manipulate the backend database; CVSSv2 is 7.5 (HIGH). Vendor ad...

CVE-2011-0549: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in forget.php in the management GUI in Symantec Web Gateway 4.5.x allows remote attackers to execute arbitrary SQL commands via the username parameter...

Symantec Web Gateway Blind SQL Injection

SUMMARY Symantecs Web Gateway management GUI is susceptible to blind SQL injection which could result in the injection of arbitrary code into the backend database. AFFECTED PRODUCTS Product | Version | Solution ---|---|--- Symantec Web Gateway | 4.5.x | Upgrade to Symantec Web Gateway 5.0.1 ISSUE...

Symantec Web Gateway forget.php SQL Injection Vulnerability

This vulnerability allows remote attackers to inject arbitrary SQL on vulnerable installations of the Symantec Web Gateway appliance. Authentication is not required to exploit this vulnerability. The specific flaw exists within the username parameter of POST requests to the forget.php script. The...

Symantec Web Gateway Management GUI远程SQL注入漏洞

BUGTRAQ ID: 45742 CVE ID: CVE-2010-0115 Symantec Web Gateway是赛门铁克企业级网页威胁防护解决方案。 Symantec Web Gateway在SQL查询中使用用户提供的数据前没有正确过滤，在实现上存在安全漏洞，远程攻击者可利用此漏洞控制设备、访问或修改数据或利用基础数据库中的潜在漏洞。 在向login.php页面发送解析请求时，进程未正确过滤USERNAME POST参数。提供发送特制的字符串，远程攻击者可利用此漏洞向服务器上的后端数据库注入任意SQL。 Symantec Web Gateway 4.5 厂商补丁： Symant...

CVE-2010-0115

SQL injection vulnerability in login.php in the GUI management console in Symantec Web Gateway 4.5 before 4.5.0.376 allows remote attackers to execute arbitrary SQL commands via the USERNAME parameter...

Sql injection

SQL injection vulnerability in login.php in the GUI management console in Symantec Web Gateway 4.5 before 4.5.0.376 allows remote attackers to execute arbitrary SQL commands via the USERNAME parameter...

CVE-2010-0115

SQL injection vulnerability in login.php in the GUI management console in Symantec Web Gateway 4.5 before 4.5.0.376 allows remote attackers to execute arbitrary SQL commands via the USERNAME parameter...

CVE-2010-0115

Symantec Web Gateway 4.5 (before 4.5.0.376) contains a SQL injection in login.php’s USERNAME parameter in the GUI management console. The vulnerability allows remote attackers to inject arbitrary SQL into backend queries, potentially affecting data confidentiality, integrity, and availability. So...

CVE-2010-0115: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in login.php in the GUI management console in Symantec Web Gateway 4.5 before 4.5.0.376 allows remote attackers to execute arbitrary SQL commands via the USERNAME parameter...

Symantec Web Gateway Blind SQL Injection

SUMMARY Symantecs Web Gateway management GUI is susceptible to a blind SQL injection attack which could result in injection of arbitrary code into the backend database. AFFECTED PRODUCTS Product | Version | Solution ---|---|--- Symantec Web Gateway | 4.5 | Apply DB update 4.5.0.376 ISSUES Severit...

Symantec Web Gateway Management Interface USERNAME Blind SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Symantec Web Gateway. Authentication is not required to exploit this vulnerability. The specific flaw exists within the management interface which listens by default on TCP port 443. While parsing...

CVE-2009-2429

SmartFilter Web Gateway Security 4.2.1.00 stores user credentials in cleartext in adminbackup.xml files and uses insecure permissions for these files, which allows local users to gain privileges. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

Information disclosure

SmartFilter Web Gateway Security 4.2.1.00 stores user credentials in cleartext in adminbackup.xml files and uses insecure permissions for these files, which allows local users to gain privileges. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2009-2429

McAfee SmartFilter (Web Gateway Security) 4.2.1.00 stores user credentials in cleartext in admin_backup.xml files and uses insecure file permissions, enabling local users to gain privileges via access to those files. Affected component/file: admin_backup.xml (within SmartFilter Administration/ser...