CVE-2007-4043

The file.cgi component in Secure Computing SecurityReporter (also known as Network Security Analyzer) versions prior to 4.6.3 contains an authentication bypass vulnerability. Remote attackers can exploit this by providing a name parameter ending with a %00.gif sequence. Additionally, a separate d...

CVE-2007-3986

CVE-2007-3986 affects Secure Computing SecurityReporter (aka Network Security Analyzer) 4.6.3. The issue is in the file.cgi component where the name parameter can specify an eventcache directory and a non-GIF file, bypassing authentication by setting the $dontvalidate variable. A separate travers...

CVE-2007-3985

The CVE-2007-3985 issue affects Secure Computing SecurityReporter (aka Network Security Analyzer) version 4.6.3, where the file.cgi script fails to sanitize the name parameter. This enables a directory traversal attack (".." in the name) allowing remote attackers to download arbitrary files from ...