Show filters
19 Total Results
Displaying 1-10 of 19
Sort by:
Attacker Value
Moderate
CVE-2020-13167
Disclosure Date: May 19, 2020 (last updated February 21, 2025)
Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php (with certain Referer headers) launches a command line with client-supplied parameters, and allows injection of shell metacharacters.
0
Attacker Value
Unknown
CVE-2014-9617
Disclosure Date: February 19, 2020 (last updated February 21, 2025)
Open redirect vulnerability in remotereporter/load_logfiles.php in Netsweeper before 4.0.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.
0
Attacker Value
Unknown
CVE-2014-9615
Disclosure Date: February 19, 2020 (last updated February 21, 2025)
Cross-site scripting (XSS) vulnerability in Netsweeper 4.0.4 allows remote attackers to inject arbitrary web script or HTML via the url parameter to webadmin/deny/index.php.
0
Attacker Value
Unknown
CVE-2014-9614
Disclosure Date: February 19, 2020 (last updated February 21, 2025)
The Web Panel in Netsweeper before 4.0.5 has a default password of branding for the branding account, which makes it easier for remote attackers to obtain access via a request to webadmin/.
0
Attacker Value
Unknown
CVE-2014-9612
Disclosure Date: February 19, 2020 (last updated February 21, 2025)
SQL injection vulnerability in remotereporter/load_logfiles.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to execute arbitrary SQL commands via the server parameter.
0
Attacker Value
Unknown
CVE-2014-9609
Disclosure Date: February 19, 2020 (last updated February 21, 2025)
Directory traversal vulnerability in webadmin/reporter/view_server_log.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to list directory contents via a .. (dot dot) in the log parameter in a stats action.
0
Attacker Value
Unknown
CVE-2014-9606
Disclosure Date: February 19, 2020 (last updated February 21, 2025)
Multiple cross-site scripting (XSS) vulnerabilities in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) server parameter to remotereporter/load_logfiles.php, (2) customctid parameter to webadmin/policy/category_table_ajax.php, (3) urllist parameter to webadmin/alert/alert.php, (4) QUERY_STRING to webadmin/ajaxfilemanager/ajax_get_file_listing.php, or (5) PATH_INFO to webadmin/policy/policy_table_ajax.php/.
0
Attacker Value
Unknown
CVE-2014-9613
Disclosure Date: February 19, 2020 (last updated February 21, 2025)
Multiple SQL injection vulnerabilities in Netsweeper before 2.6.29.10 allow remote attackers to execute arbitrary SQL commands via the (1) login parameter to webadmin/auth/verification.php or (2) dpid parameter to webadmin/deny/index.php.
0
Attacker Value
Unknown
CVE-2014-9608
Disclosure Date: February 19, 2020 (last updated February 21, 2025)
Cross-site scripting (XSS) vulnerability in webadmin/policy/group_table_ajax.php/ in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
0
Attacker Value
Unknown
CVE-2014-9607
Disclosure Date: February 19, 2020 (last updated February 21, 2025)
Cross-site scripting (XSS) vulnerability in remotereporter/load_logfiles.php in Netsweeper 4.0.3 and 4.0.4 allows remote attackers to inject arbitrary web script or HTML via the url parameter.
0
