CVE-2015-2854

The WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 does not send a restrictive X-Frame-Options HTTP header, which allows remote attackers to conduct clickjacking attacks via vectors involving an IFRAME element...

CVE-2015-2855

The WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 does not set the secure flag for the administrator's cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its...

WebUI 1.5b6 PHP Code Injection

| Title : WebUI 1.5b6 PHP code injection Vulnerability | Author : indoushka | email : [email protected] | Dork : c2002-2010 Young Consulting | Tested on: Win 8.1 fr pro / 22:30 15/05/2015 | Bug : PHP code injection | Download : https://github.com/baram01/webui/...

WebUI RCE Vulnerability

WebUI is prone to a remote command execution RCE vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WebUI v1.5b6 Remote Code Execution Vulnerability

Exploit for php platform in category web applications + Author: TUNISIAN CYBER + Title: WebUI Remote Code Execution Vulnerability + Date: 21-04-2015 + Vendor: https://github.com/baram01/webui/ + Type: WebAPP + Tested on: KaliLinux Debian + Twitter: @TCYB3R + Proof of concept:...

WebUI 1.5b6 - Remote Code Execution

WebUI 1.5b6 - Remote Code Execution + Author: TUNISIAN CYBER + Title: WebUI Remote Code Execution Vulnerability + Date: 21-04-2015 + Vendor: https://github.com/baram01/webui/ + Type: WebAPP + Tested on: KaliLinux Debian + Twitter: @TCYB3R + Proof of concept: http://i.imgur.com/co9Qx0n.png...

ipa security, bug fix, and enhancement update

4.1.0-18.0.1 - Replace login-screen-logo.png 20362818 - Drop subscription-manager requires for OL7 - Drop redhat-access-plugin-ipa requires for OL7 - Blank out header-logo.png product-name.png 4.1.0-18 - Fix ipa-pwd-extop global configuration caching 1187342 - group-detach does not add correct...

Symantec Data Center Security Server 'environment.jsp' Information Disclosure (SYM15-001)

The remote Symantec Data Center Security Server running on the remote host is affected by an information disclosure vulnerability in the '/webui/admin/environment.jsp' script, which discloses sensitive information about the server and software configuration. %NASLMINLEVEL 70300 C Tenable Network...

Cross site scripting

Cross-site scripting XSS vulnerability in the ajaxswing webui in the Management Console server in the management server in Symantec Critical System Protection SCSP 5.2.9 through MP6 and Symantec Data Center Security: Server Advanced SDCS:SA 6.0.x through 6.0 MP1 allows remote authenticated users ...

CVE-2014-9224

CVE-2014-9224 is a cross-site scripting vulnerability in the ajaxswing webui of the Symantec Critical System Protection (SCSP) Management Console and Symantec Data Center Security: Server Advanced (SDCS:SA). It allows remote authenticated users to inject arbitrary web script or HTML, via unspecif...

CVE-2014-9225

The ajaxswing webui in the management server in Symantec Critical System Protection SCSP 5.2.9 through MP6 and Symantec Data Center Security: Server Advanced SDCS:SA 6.0.x through 6.0 MP1 allows remote authenticated users to obtain sensitive server information via unspecified vectors...

IBM Network Security Protection XGS WebUI Detection

Binary data ibmxgswebuidetect.nbin...

Cisco Identity Services Engine WebUI Detection

Binary data ciscoisewebuidetect.nbin...

CVE-2014-3809: Reflected XSS in Alcatel Lucent 1830 PSS-32/16/4

SWISSCOM CSIRT ADVISORY - http://www.swisscom.com/security CVE ID: CVE-2014-3809 Product: 1830 Photonic Service Switch PSS-32/16/4 Vendor: Alcatel-Lucent Subject: Reflected Cross-site Scripting - XSS Effect: Remotely exploitable Author: Stephan Rickauer stephan.rickauer at swisscom.com Date:...

Cisco TelePresence Conductor WebUI Detection

Binary data ciscotelepresenceconductorwebuidetect.nbin...

CVE-2014-5395

CVE-2014-5395 describes CSRF vulnerabilities in Huawei HiLink devices: HiLink E3276 and E3236 TCPU (before V200R002B470D13SP00C00) and WebUI (before V100R007B100D03SP01C03), E5180s-22 (before 21.270.21.00.00), and E586Bs-2 (before 21.322.10.00.889). The underlying issue is cross-site request forg...

CVE-2014-6616 Softing FG-100 Webui XSS

COMPASS SECURITY ADVISORY http://www.csnc.ch/en/downloads/advisories.html Product: Softing FG-100 PB Vendor: Softing AG www.softing.com CVD ID: CVE-2014-6616 Subject: XSS Risk: High Effect: Remotely exploitable Author: Johannes Klick Daniel Marzin Ingmar Rosenhagen Date: 05.11.2014 Introduction:...

Centreon SQL Injection / Command Injection

Multiple unauthenticated SQL injections and unauthenticated remote command injection in Centreon SQL injections: ------------------ POST http://server/centreon/include/configuration/configObject/traps/GetXMLTrapsForVendor.php POST DATA mnftrid=1 or 1=1 union all select version,2 -- / POST...

Centreon SQL Injection / Command Injection Vulnerability

Centreon SQL InjectioCentreon versions 2.5.2 and below and Centreon Enterprise Server versions 2.2 and below and 3.0 and below suffer from remote SQL injection and remote command injection vulnerabilities.n / Command Injection Multiple unauthenticated SQL injections and unauthenticated remote...

ArubaOS 6.3.1.11 / 6.4.2.1 SSH Authentication Bypass

The version of ArubaOS has an unspecified vulnerability that allows a remote attacker to obtain limited administrative privileges without valid credentials. The vulnerability affects access over SSH. However, access through WebUI and the serial port is not affected, and the vulnerability does not...