Design/Logic Flaw

SVM in Websense TRITON V-Series appliances before 8.0.0 allows attackers to upload arbitrary files via unspecified vectors...

Design/Logic Flaw

The Mail Server in Websense TRITON AP-EMAIL and V-Series appliances before 8.0.0 uses plaintext credentials, which allows remote attackers to obtain sensitive information via unspecified vectors...

Code injection

The Personal Email Manager PEM in Websense TRITON AP-EMAIL before 8.0.0 allows attackers to have unspecified impact via a brute force attack...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Personal Email Manager PEM in Websense TRITON AP-EMAIL before 8.0.0 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors...

Path traversal

Websense TRITON V-Series appliances before 7.8.3 Hotfix 03 and 7.8.4 before Hotfix 01 allow remote administrators to read arbitrary files and obtain passwords via a crafted path...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Websense TRITON AP-DATA before 8.0.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to the DSS 1 Mobile or 2 DLP report catalog...

Design/Logic Flaw

SVM in Websense TRITON V-Series appliances before 8.0.0 allows attackers to read arbitrary files via unspecified vectors...

Design/Logic Flaw

Unspecified vulnerability in Websense TRITON AP-EMAIL before 8.0.0 has unknown impact and attack vectors, related to "Autocomplete Enabled."...

Authentication flaw

Websense TRITON AP-WEB before 8.0.0 allows remote attackers to enumerate Windows domain user accounts via vectors related to HTTP authentication...

CVE-2015-2773

SVM in Websense TRITON V-Series appliances before 8.0.0 allows attackers to read arbitrary files via unspecified vectors...

CVE-2015-2764

Multiple cross-site scripting XSS vulnerabilities in Websense TRITON AP-DATA before 8.0.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to the DSS 1 Mobile or 2 DLP report catalog...

CVE-2015-2768

Cross-site scripting XSS vulnerability in Websense TRITON AP-EMAIL before 8.0.0 and V-Series 7.7 appliances allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-2769

CVE-2015-2769 describes multiple CSRF vulnerabilities in Websense TRITON AP-EMAIL PEM that allow remote attackers to hijack user authentication via unknown vectors. Affected products include Websense TRITON AP-EMAIL (earlier than 8.0.0) and related TRITON/AP-WEB, AP-DATA, and S/G components liste...

CVE-2014-9712

Websense TRITON V-Series appliances before 7.8.3 Hotfix 03 and 7.8.4 before Hotfix 01 allow remote administrators to read arbitrary files and obtain passwords via a crafted path...

CVE-2015-2766

The Personal Email Manager PEM in Websense TRITON AP-EMAIL before 8.0.0 allows attackers to have unspecified impact via a brute force attack...

CVE-2015-2767

Unspecified vulnerability in Websense TRITON AP-EMAIL before 8.0.0 has unknown impact and attack vectors, related to "Autocomplete Enabled."...

CVE-2015-2773

Affected software: Websense TRITON V-Series appliances BEFORE version 8.0.0. Vulnerability: In the SVM component, reading of arbitrary local files via unspecified vectors is possible. This is corroborated by multiple sources (CVE-2015-2773 entry and CNVD-2015-02196) describing a directory/file re...

CVE-2015-2761

Cross-site scripting XSS vulnerability in the Exceptions and Scanning Exceptions Pages in Websense TRITON AP-WEB before 8.0.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-2771

The CVE-2015-2771 entry affects Websense TRITON AP-EMAIL and V-Series appliances. The root cause is plaintext credentials storage in the Mail Server prior to version 8.0.0, enabling remote attackers to obtain sensitive information via unspecified vectors. Affected products include TRITON AP-WEB, ...

CVE-2015-2764

CVE-2015-2764 describes multiple XSS vulnerabilities in Websense TRITON AP-DATA prior to 8.0.0, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors to the DSS Mobile or DLP report catalog. The root cause is not more precisely defined in the provided documents,...