CVE-2015-4138: Exposure of Sensitive Information to an Unauthorized Actor

The WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 does not include the HTTPOnly flag in a Set-Cookie header for the administrator's cookie, which makes it easier for remote attackers to obtain potentially sensitive...

PT-2015-5940

Name of the Vulnerable Software and Affected Versions Blue Coat SSL Visibility Appliance versions 3.6.x through 3.8.x before 3.8.4 Description The issue concerns the WebUI component, which fails to set the secure flag for the administrator's cookie in an https session. This oversight makes it...

CVE-2015-2855: Exposure of Sensitive Information to an Unauthorized Actor

The WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 does not set the secure flag for the administrator's cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its...

CVE-2015-2853: Undefined Security Weakness

Session fixation vulnerability in the WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 allows remote attackers to hijack web sessions by providing a session ID...

CVE-2015-2852: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 allows remote attackers to hijack the authentication of administrators...

PT-2015-6428

Name of the Vulnerable Software and Affected Versions Blue Coat SSL Visibility Appliance versions 3.6.x through 3.8.x before 3.8.4 Description The issue concerns the WebUI component, which fails to include the HTTPOnly flag in a Set-Cookie header for the administrator's cookie. This omission make...

PT-2015-5939

Name of the Vulnerable Software and Affected Versions Blue Coat SSL Visibility Appliance versions 3.6.x through 3.8.x before 3.8.4 Description The issue concerns the WebUI component, which does not send a restrictive X-Frame-Options HTTP header. This allows remote attackers to conduct clickjackin...

CVE-2015-2854: Improper Input Validation

The WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 does not send a restrictive X-Frame-Options HTTP header, which allows remote attackers to conduct clickjacking attacks via vectors involving an IFRAME element...

WebUI 1.5b6 PHP Code Injection

| Title : WebUI 1.5b6 PHP code injection Vulnerability | Author : indoushka | email : [email protected] | Dork : c2002-2010 Young Consulting | Tested on: Win 8.1 fr pro / 22:30 15/05/2015 | Bug : PHP code injection | Download : https://github.com/baram01/webui/...

WebUI RCE Vulnerability

WebUI is prone to a remote command execution RCE vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WebUI 1.5b6 - Remote Code Execution

WebUI 1.5b6 - Remote Code Execution + Author: TUNISIAN CYBER + Title: WebUI Remote Code Execution Vulnerability + Date: 21-04-2015 + Vendor: https://github.com/baram01/webui/ + Type: WebAPP + Tested on: KaliLinux Debian + Twitter: @TCYB3R + Proof of concept: http://i.imgur.com/co9Qx0n.png...

WebUI v1.5b6 Remote Code Execution Vulnerability

Exploit for php platform in category web applications + Author: TUNISIAN CYBER + Title: WebUI Remote Code Execution Vulnerability + Date: 21-04-2015 + Vendor: https://github.com/baram01/webui/ + Type: WebAPP + Tested on: KaliLinux Debian + Twitter: @TCYB3R + Proof of concept:...

ipa security, bug fix, and enhancement update

4.1.0-18.0.1 - Replace login-screen-logo.png 20362818 - Drop subscription-manager requires for OL7 - Drop redhat-access-plugin-ipa requires for OL7 - Blank out header-logo.png product-name.png 4.1.0-18 - Fix ipa-pwd-extop global configuration caching 1187342 - group-detach does not add correct...

Symantec Data Center Security Server 'environment.jsp' Information Disclosure (SYM15-001)

The remote Symantec Data Center Security Server running on the remote host is affected by an information disclosure vulnerability in the '/webui/admin/environment.jsp' script, which discloses sensitive information about the server and software configuration. %NASLMINLEVEL 70300 C Tenable Network...

Cross site scripting

Cross-site scripting XSS vulnerability in the ajaxswing webui in the Management Console server in the management server in Symantec Critical System Protection SCSP 5.2.9 through MP6 and Symantec Data Center Security: Server Advanced SDCS:SA 6.0.x through 6.0 MP1 allows remote authenticated users ...

CVE-2014-9225

The ajaxswing webui in the management server in Symantec Critical System Protection SCSP 5.2.9 through MP6 and Symantec Data Center Security: Server Advanced SDCS:SA 6.0.x through 6.0 MP1 allows remote authenticated users to obtain sensitive server information via unspecified vectors...

CVE-2014-9224

CVE-2014-9224 is a cross-site scripting vulnerability in the ajaxswing webui of the Symantec Critical System Protection (SCSP) Management Console and Symantec Data Center Security: Server Advanced (SDCS:SA). It allows remote authenticated users to inject arbitrary web script or HTML, via unspecif...

PT-2015-4163

Name of the Vulnerable Software and Affected Versions Symantec Critical System Protection SCSP versions 5.2.9 through MP6 Symantec Data Center Security: Server Advanced SDCS:SA versions 6.0.x through 6.0 MP1 Description A cross-site scripting XSS issue exists in the ajaxswing webui component of t...

CVE-2014-9225: Exposure of Sensitive Information to an Unauthorized Actor

The ajaxswing webui in the management server in Symantec Critical System Protection SCSP 5.2.9 through MP6 and Symantec Data Center Security: Server Advanced SDCS:SA 6.0.x through 6.0 MP1 allows remote authenticated users to obtain sensitive server information via unspecified vectors...

CVE-2014-9224: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the ajaxswing webui in the Management Console server in the management server in Symantec Critical System Protection SCSP 5.2.9 through MP6 and Symantec Data Center Security: Server Advanced SDCS:SA 6.0.x through 6.0 MP1 allows remote authenticated users ...