CVE-2014-9609

Directory traversal vulnerability in webadmin/reporter/viewserverlog.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to list directory contents via a .. dot dot in the log parameter in a stats action...

CVE-2014-9608

Netsweeper is affected by an XSS in webadmin/policy/group_table_ajax.php/ across multiple tracked versions: before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2. The issue stems from insufficient validation of client-side data via PATH_INFO, enabling remote attackers to inject arbitrary web ...

PT-2020-7783

Name of the Vulnerable Software and Affected Versions: Netsweeper versions prior to 2.6.29.10 Description: The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the login parameter to the "webadmin/auth/verification.php" API endpoint or the dpid parameter t...

PT-2020-7785

Name of the Vulnerable Software and Affected Versions: Netsweeper version 4.0.4 Description: The issue allows remote attackers to inject arbitrary web script or HTML via the url parameter to "webadmin/deny/index.php" API endpoint. This is a cross-site scripting XSS issue, which can lead to the...

PT-2020-7781

Name of the Vulnerable Software and Affected Versions: Netsweeper versions 3.1.10 and earlier, 4.0.x through 4.0.8, 4.1.x through 4.1.1 Description: The issue allows remote attackers to list directory contents via a .. dot dot in the log parameter in a stats action. This is due to a directory...

PT-2020-7780

Name of the Vulnerable Software and Affected Versions: Netsweeper versions 3.1.x through 3.1.9 Netsweeper versions 4.0.x through 4.0.8 Netsweeper versions 4.1.x through 4.1.1 Description: A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the PATH...

CVE-2014-9614: Use of Hard-coded Credentials

The Web Panel in Netsweeper before 4.0.5 has a default password of branding for the branding account, which makes it easier for remote attackers to obtain access via a request to webadmin/...

CVE-2014-9608: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in webadmin/policy/grouptableajax.php/ in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO...

PT-2020-7784

Name of the Vulnerable Software and Affected Versions: Netsweeper versions prior to 4.0.5 Description: The issue concerns a default password set for the branding account in the Web Panel, making it easier for remote attackers to gain access. This can be achieved by sending a request to the...

CVE-2014-9615: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Netsweeper 4.0.4 allows remote attackers to inject arbitrary web script or HTML via the url parameter to webadmin/deny/index.php...

CVE-2014-9609: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in webadmin/reporter/viewserverlog.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to list directory contents via a .. dot dot in the log parameter in a stats action...

CVE-2014-9606: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allow remote attackers to inject arbitrary web script or HTML via the 1 server parameter to remotereporter/loadlogfiles.php, 2 customctid parameter to...

CVE-2014-9613: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Netsweeper before 2.6.29.10 allow remote attackers to execute arbitrary SQL commands via the 1 login parameter to webadmin/auth/verification.php or 2 dpid parameter to webadmin/deny/index.php...

Shell Backdoor List - PHP / ASP Shell Backdoor List

What is a shell backdoor ? A backdoor shell is a malicious piece of code e.g. PHP, Python, Ruby that can be uploaded to a site to gain access to files stored on that site. Once it is uploaded, the hacker can use it to edit, delete, or download any files on the site, or upload their own. How to...

LiteSpeed Technologie OpenLiteSpeed WebAdmin Console Code Execution Vulnerability

LiteSpeed Technologie OpenLiteSpeed is LiteSpeed Technologie's open source Web server . WebAdmin Console is one of the Web-based management console program . A security vulnerability exists in WebAdmin Console in LiteSpeed Technologie OpenLiteSpeed versions prior to 1.6.5. An attacker can exploit...

CVE-2020-5519

The WebAdmin Console in OpenLiteSpeed before v1.6.5 does not strictly check request URLs, as demonstrated by the "Server Configuration External App" screen...

CVE-2020-5519

The WebAdmin Console in OpenLiteSpeed before v1.6.5 does not strictly check request URLs, as demonstrated by the "Server Configuration External App" screen...

Design/Logic Flaw

The WebAdmin Console in OpenLiteSpeed before v1.6.5 does not strictly check request URLs, as demonstrated by the "Server Configuration External App" screen...

CVE-2020-5519

The WebAdmin Console in OpenLiteSpeed before v1.6.5 does not strictly check request URLs, as demonstrated by the "Server Configuration External App" screen...

CVE-2020-5519

The CVE-2020-5519 issue affects OpenLiteSpeed’s WebAdmin Console prior to 1.6.5, where URL validation in the Server Configuration > External App screen is insufficient. This is documented across multiple sources as enabling potential code execution via the WebAdmin Console. A fixed version is ...