CVE-2007-6511: Undefined Security Weakness

Websense Enterprise 6.3.1 allows remote attackers to bypass content filtering by visiting http URLs with a 1 RealPlayer G2, 2 MSMSGS, or 3 StoneHttpAgent User-Agent header, which results in a Non-HTTP categorization...

Websense User-Agent头绕过安全限制漏洞

BUGTRAQ ID: 26847 Websense是业界领先的Web安全和网页过滤解决方案。 Websense在处理HTTP协议过滤时存在漏洞，远程攻击者可能利用此漏洞绕过检查过滤。 在过滤某些协议时，Websense使用HTTP头的User-Agent字段和报文特征判断请求是URL请求还是隧道协议请求，如果攻击者在HTTP请求中伪造了User-Agent头的话，就可以绕过过滤执行非授权操作。 Websense Enterprise 6.3.1 Websense -------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Advisory: Websense XSS Vulnerability

December 10th, 2007 ======= Summary ======= Name: Websense XSS Vulnerability Release Date: 10 December 2007 Reference: LSD002-2007 Discover: Dave Lewis CVE:Pending Vendor: Websense Product: Websense Enterprise and Websense Web Security Suite Systems Affected: version 6.3 as tested Risk: Less...

Cross site scripting

Cross-site scripting XSS vulnerability in the logon page in Web Reporting Tools portal in Websense Enterprise and Web Security Suite 6.3 allows remote attackers to inject arbitrary web script or HTML via the username field...

CVE-2007-6312

Cross-site scripting XSS vulnerability in the logon page in Web Reporting Tools portal in Websense Enterprise and Web Security Suite 6.3 allows remote attackers to inject arbitrary web script or HTML via the username field...

CVE-2007-6312

CVE-2007-6312 is an XSS vulnerability in the login page of Websense’s Web Reporting Tools portal (Websense Enterprise/Web Security Suite 6.3). The issue arises because the username field is not properly sanitized, allowing remote attackers to inject arbitrary script or HTML via that input. Affect...

CVE-2007-6312

Cross-site scripting XSS vulnerability in the logon page in Web Reporting Tools portal in Websense Enterprise and Web Security Suite 6.3 allows remote attackers to inject arbitrary web script or HTML via the username field...

CVE-2007-6312: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the logon page in Web Reporting Tools portal in Websense Enterprise and Web Security Suite 6.3 allows remote attackers to inject arbitrary web script or HTML via the username field...

Websense Reporting Tools WsCgiLogin.exe username Parameter XSS

The remote host is running Websense, a commercial suite of web filtering products. The remote instance of Websense fails to sanitize user input to the 'UserName' parameter of the 'Websense/cgi-bin/WsCgiLogin.exe' script before using it to generate dynamic content. An unauthenticated remote attack...

Authentication flaw

Cisco PIX/ASA 7.1.x before 7.12 and 7.0.x before 7.05, PIX 6.3.x before 6.3.5112, and FWSM 2.3.x before 2.34 and 3.x before 3.17, when used with Websense/N2H2, allows remote attackers to bypass HTTP access restrictions by splitting the GET method of an HTTP request into multiple packets, which...

CVE-2006-0515

Cisco PIX/ASA 7.1.x before 7.12 and 7.0.x before 7.05, PIX 6.3.x before 6.3.5112, and FWSM 2.3.x before 2.34 and 3.x before 3.17, when used with Websense/N2H2, allows remote attackers to bypass HTTP access restrictions by splitting the GET method of an HTTP request into multiple packets, which...

CVE-2006-0515

Cisco PIX/ASA 7.1.x before 7.12 and 7.0.x before 7.05, PIX 6.3.x before 6.3.5112, and FWSM 2.3.x before 2.34 and 3.x before 3.17, when used with Websense/N2H2, allows remote attackers to bypass HTTP access restrictions by splitting the GET method of an HTTP request into multiple packets, which...

Cisco PIX / FWSM WebSense content filtering bypass

Filter doesn't catch signature in segmented packet...

VSR Advisory: WebSense content filter bypass when deployed in conjunction with Cisco filtering devices

Cisco Response ============== This is Cisco PSIRT's response to the statements made by George Gal in his advisory: WebSense Content Filter Bypass in conjunction with Cisco PIX in packet filter mode, posted on May 08, 2006. The original email/advisory is available at...

VSR Advisory: WebSense content filter bypass when deployed in conjunction with Cisco filtering devices

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Virtual Security Research, LLC. http://www.vsecurity.com/ Security Advisory - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Advisory Name: WebSense content filter bypass when deployed in conjunction with Cisco filtering...

CVE-2006-0515: Undefined Security Weakness

Cisco PIX/ASA 7.1.x before 7.12 and 7.0.x before 7.05, PIX 6.3.x before 6.3.5112, and FWSM 2.3.x before 2.34 and 3.x before 3.17, when used with Websense/N2H2, allows remote attackers to bypass HTTP access restrictions by splitting the GET method of an HTTP request into multiple packets, which...

PT-2006-1579 · Cisco +1 · Cisco Pix +3

Name of the Vulnerable Software and Affected Versions: Cisco PIX/ASA versions 7.1.x before 7.12 Cisco PIX/ASA versions 7.0.x before 7.05 Cisco PIX version 6.3.x before 6.3.5112 Cisco FWSM versions 2.3.x before 2.34 Cisco FWSM versions 3.x before 3.17 Description: The issue allows remote attackers...

Cisco - WebSense Content Filtering Bypass

source: https://www.securityfocus.com/bid/17883/info Multiple Cisco products are susceptible to a content-filtering bypass vulnerability. This issue is due to a failure of the software to properly recognize HTTP request traffic. This issue allows users to bypass content-filtering and access...

Design/Logic Flaw

Websense, when configured to permit access to the dynamic content category, allows local users to bypass intended blocking of the Uncategorized category by appending a "/?" sequence to a URL...

CVE-2006-2035

Websense, when configured to permit access to the dynamic content category, allows local users to bypass intended blocking of the Uncategorized category by appending a "/?" sequence to a URL...