CVE-2009-1593

CVE-2009-1593 – Armorlogic Profense Web Application Firewall is caused by the product not properly implementing the negative model, allowing XSS via a modified SCRIPT end tag. Affected versions are Profense WAF before 2.2.22 and 2.4.x before 2.4.4. The issue is documented alongside other vulnerab...

CVE-2009-1594

Armorlogic Profense Web Application Firewall is affected by CVE-2009-1594 in the positive model (white-list) implementation. Affected versions are Profense before 2.2.22 and 2.4.x before 2.4.4. The vulnerability allows remote attackers to bypass protection mechanisms by using a URL-encoded newlin...

CVE-2009-0468

The CVE-2009-0468 entry describes multiple CSRF vulnerabilities in Profense Web Application Firewall (ajax.html) affecting version 2.6.2 and 2.6.3. An attacker could hijack administrator sessions to perform actions such as (1) shutdown the server, (2) ping packets, (3) enable network services, (4...

CVE-2009-0467

CVE-2009-0467 affects Profense Web Application Firewall 2.6.2 and 2.6.3. A cross-site scripting (XSS) vulnerability exists in proxy.html, where the proxy parameter in the deny_log manage action can be exploited to inject arbitrary web script or HTML. This is due to insufficient input handling in ...

CVE-2009-1745

Armorlogic Profense Web Application Firewall is affected: versions before 2.2.22 and 2.4.x before 2.4.4 use a default root password hash and allow password-based root logins over SSH. This enables remote attackers to obtain privileged access according to the CVE description. The vulnerability det...