All the vulnerabilites related to f5 - firepass_4100
Vulnerability from fkie_nvd
Published
2006-07-13 00:05
Modified
2024-11-21 00:13
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in F5 Networks FirePass 4100 5.x allow remote attackers to inject arbitrary web script or HTML via unspecified "writable form fields and hidden fields," including "authentication frontends."
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| f5 | firepass_4100 | 5.4.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:f5:firepass_4100:5.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "85AE9E11-C5F0-462E-AEFA-68ABE3B6AB0D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in F5 Networks FirePass 4100 5.x allow remote attackers to inject arbitrary web script or HTML via unspecified \"writable form fields and hidden fields,\" including \"authentication frontends.\""
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en F5 Networks FirePass 4100 5.x permiten a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s de \"campos de formulario escribibles y ocultos\" no especificados incluyendo \"interfaces frontales de autenticaci\u00f3n\"."
}
],
"id": "CVE-2006-3550",
"lastModified": "2024-11-21T00:13:52.567",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2006-07-13T00:05:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047635.html"
},
{
"source": "cve@mitre.org",
"url": "http://securityreason.com/securityalert/1237"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1016431"
},
{
"source": "cve@mitre.org",
"url": "http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=2352"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/439033/100/0/threaded"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/18799"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2006/2678"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27547"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047635.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/1237"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1016431"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=2352"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/439033/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/18799"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2006/2678"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27547"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2008-03-05 23:44
Modified
2024-11-21 00:40
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass 4100 SSL VPN 5.4.1 through 5.5.2 and 6.0 through 6.0.1, when pre-logon sequences are enabled, allow remote attackers to inject arbitrary web script or HTML via the query string to (1) my.activation.php3 and (2) my.logon.php3.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| f5 | firepass_4100 | 5.4.1 | |
| f5 | firepass_4100 | 5.4.2 | |
| f5 | firepass_4100 | 5.4.3 | |
| f5 | firepass_4100 | 5.4.4 | |
| f5 | firepass_4100 | 5.4.5 | |
| f5 | firepass_4100 | 5.4.6 | |
| f5 | firepass_4100 | 5.4.7 | |
| f5 | firepass_4100 | 5.4.8 | |
| f5 | firepass_4100 | 5.4.9 | |
| f5 | firepass_4100 | 5.5.0 | |
| f5 | firepass_4100 | 5.5.1 | |
| f5 | firepass_4100 | 5.5.2 | |
| f5 | firepass_4100 | 6.0 | |
| f5 | firepass_4100 | 6.0.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:f5:firepass_4100:5.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1D7B7CDD-2146-4B46-BCCC-A2E724F668C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:f5:firepass_4100:5.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "85AE9E11-C5F0-462E-AEFA-68ABE3B6AB0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:f5:firepass_4100:5.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A60081E6-94C5-4A8E-B95D-5131DAFF9537",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:f5:firepass_4100:5.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "7FB490F1-237B-494F-9315-BE6A2920B693",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:f5:firepass_4100:5.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "8A396D79-468A-4C32-8090-AED20AD7E4A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:f5:firepass_4100:5.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "EE197C0E-34AD-46AD-8359-713BA2034512",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:f5:firepass_4100:5.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "A90B5729-2F85-475B-AC7D-B9EEC15B0524",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:f5:firepass_4100:5.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "D595F076-822D-4A99-9838-18B9A28A323A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:f5:firepass_4100:5.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "1D609CB0-72B0-4CCC-8351-897801B57B17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:f5:firepass_4100:5.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "74BFE0EE-9554-4C6C-AB24-DC8AA50AF7A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:f5:firepass_4100:5.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8C79823A-E8DF-4F67-BB6D-4901E007D636",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:f5:firepass_4100:5.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A7EF2BA6-CA87-421B-A2DB-D74A16C1A845",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:f5:firepass_4100:6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A4F8E7C1-84F6-42A4-9534-7C822F625240",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:f5:firepass_4100:6.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3F108EAE-0CC6-41C9-978B-B596F0981A5F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass 4100 SSL VPN 5.4.1 through 5.5.2 and 6.0 through 6.0.1, when pre-logon sequences are enabled, allow remote attackers to inject arbitrary web script or HTML via the query string to (1) my.activation.php3 and (2) my.logon.php3."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en F5 FirePass 4100 SSL VPN 5.4.1 hasta 5.5.2 y 6.0 hasta 6.0.1, cuando las secuencias pre-logon est\u00e1n activadas, permiten a atacantes remotos inyectar web script o HMTL de su elecci\u00f3n a trav\u00e9s de la cadena de consulta de (1) my.activation.php3 y (2) my.logon.php3."
}
],
"id": "CVE-2007-6704",
"lastModified": "2024-11-21T00:40:48.460",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2008-03-05T23:44:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/27904"
},
{
"source": "cve@mitre.org",
"url": "http://securityreason.com/securityalert/3712"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/38980"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/38981"
},
{
"source": "cve@mitre.org",
"url": "http://www.procheckup.com/Vulnerability_PR07-14.php"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.procheckup.com/Vulnerability_PR07-15a.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/484411/100/0/threaded"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/484413/100/0/threaded"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/492511/100/0/threaded"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/26659"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/26661"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id?1019031"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38785"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38795"
},
{
"source": "cve@mitre.org",
"url": "https://support.f5.com/kb/en-us/solutions/public/7000/900/SOL7923.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/27904"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/3712"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/38980"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/38981"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.procheckup.com/Vulnerability_PR07-14.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.procheckup.com/Vulnerability_PR07-15a.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/484411/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/484413/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/492511/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/26659"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/26661"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id?1019031"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38785"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38795"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://support.f5.com/kb/en-us/solutions/public/7000/900/SOL7923.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-06-06 22:30
Modified
2024-11-21 00:32
Severity ?
Summary
my.activation.php3 in F5 FirePass 4100 SSL VPN allows remote attackers to execute arbitrary shell commands via shell metacharacters in the username parameter.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| f5 | firepass_4100 | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:f5:firepass_4100:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B8BA182D-6515-45F9-A73B-A1F4749ECA72",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "my.activation.php3 in F5 FirePass 4100 SSL VPN allows remote attackers to execute arbitrary shell commands via shell metacharacters in the username parameter."
},
{
"lang": "es",
"value": "my.activation.php3 en F5 FirePass 4100 SSL VPN permite a atacantes remotos ejecutar \u00f3rdenes de l\u00ednea de comandos de su elecci\u00f3n mediante metacaracteres de l\u00ednea de comandos en el par\u00e1metro username."
}
],
"id": "CVE-2007-3097",
"lastModified": "2024-11-21T00:32:24.133",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-06-06T22:30:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/25563"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/35246"
},
{
"source": "cve@mitre.org",
"url": "http://www.s21sec.com/avisos/s21sec-035-en.txt"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/470444/100/0/threaded"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/24306"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id?1018190"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/2073"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34708"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/25563"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/35246"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.s21sec.com/avisos/s21sec-035-en.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/470444/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/24306"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id?1018190"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/2073"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34708"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-11-15 00:46
Modified
2024-11-21 00:39
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in download_plugin.php3 in F5 Firepass 4100 SSL VPN 5.4 through 5.5.2 and 6.0 through 6.0.1 allows remote attackers to inject arbitrary web script or HTML via the backurl parameter.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| f5 | firepass_4100 | 5.4 | |
| f5 | firepass_4100 | 5.4.1 | |
| f5 | firepass_4100 | 5.4.2 | |
| f5 | firepass_4100 | 5.4.3 | |
| f5 | firepass_4100 | 5.4.4 | |
| f5 | firepass_4100 | 5.4.5 | |
| f5 | firepass_4100 | 5.4.6 | |
| f5 | firepass_4100 | 5.4.7 | |
| f5 | firepass_4100 | 5.4.8 | |
| f5 | firepass_4100 | 5.4.9 | |
| f5 | firepass_4100 | 5.5.0 | |
| f5 | firepass_4100 | 5.5.1 | |
| f5 | firepass_4100 | 6.0 | |
| f5 | firepass_4100 | 6.0.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:f5:firepass_4100:5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "A5035A65-9C7D-4F61-B4D5-774BD427E932",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:f5:firepass_4100:5.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1D7B7CDD-2146-4B46-BCCC-A2E724F668C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:f5:firepass_4100:5.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "85AE9E11-C5F0-462E-AEFA-68ABE3B6AB0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:f5:firepass_4100:5.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A60081E6-94C5-4A8E-B95D-5131DAFF9537",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:f5:firepass_4100:5.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "7FB490F1-237B-494F-9315-BE6A2920B693",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:f5:firepass_4100:5.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "8A396D79-468A-4C32-8090-AED20AD7E4A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:f5:firepass_4100:5.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "EE197C0E-34AD-46AD-8359-713BA2034512",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:f5:firepass_4100:5.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "A90B5729-2F85-475B-AC7D-B9EEC15B0524",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:f5:firepass_4100:5.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "D595F076-822D-4A99-9838-18B9A28A323A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:f5:firepass_4100:5.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "1D609CB0-72B0-4CCC-8351-897801B57B17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:f5:firepass_4100:5.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "74BFE0EE-9554-4C6C-AB24-DC8AA50AF7A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:f5:firepass_4100:5.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8C79823A-E8DF-4F67-BB6D-4901E007D636",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:f5:firepass_4100:6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A4F8E7C1-84F6-42A4-9534-7C822F625240",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:f5:firepass_4100:6.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3F108EAE-0CC6-41C9-978B-B596F0981A5F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in download_plugin.php3 in F5 Firepass 4100 SSL VPN 5.4 through 5.5.2 and 6.0 through 6.0.1 allows remote attackers to inject arbitrary web script or HTML via the backurl parameter."
},
{
"lang": "es",
"value": "Vulnerabilidad de secuencia de comandos en sitios cruzados (XSS) en download_plugin.php3 en F5 Firepass 4100 SSL VPN 5.4 hasta la 5.5.2 y 6.0 hasta la 6.0.1 permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s del par\u00e1metro backurl."
}
],
"id": "CVE-2007-5979",
"lastModified": "2024-11-21T00:39:05.637",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-11-15T00:46:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/38665"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/27647"
},
{
"source": "cve@mitre.org",
"url": "http://securityreason.com/securityalert/3364"
},
{
"source": "cve@mitre.org",
"url": "http://www.procheckup.com/Vulnerability_PR07-13.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/483601/100/0/threaded"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/26412"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securitytracker.com/id?1018937"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/3847"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38439"
},
{
"source": "cve@mitre.org",
"url": "https://support.f5.com/kb/en-us/solutions/public/7000/400/sol7498.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/38665"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/27647"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/3364"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.procheckup.com/Vulnerability_PR07-13.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/483601/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/26412"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securitytracker.com/id?1018937"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/3847"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38439"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://support.f5.com/kb/en-us/solutions/public/7000/400/sol7498.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-01-12 05:04
Modified
2024-11-21 00:25
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass SSL VPN allow remote attackers to inject arbitrary web script or HTML via (1) the xcho parameter to my.logon.php3; the (2) topblue, (3) midblue, (4) wtopblue, and certain other Custom color parameters in a per action to vdesk/admincon/index.php; the (5) h321, (6) h311, (7) h312, and certain other Front Door custom text color parameters in a per action to vdesk/admincon/index.php; the (8) ua parameter in a bro action to vdesk/admincon/index.php; the (9) app_param and (10) app_name parameters to webyfiers.php; (11) double eval functions; (12) JavaScript contained in an <FP_DO_NOT_TOUCH> element; and (13) the vhost parameter to my.activation.php. NOTE: it is possible that this candidate overlaps CVE-2006-3550.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| f5 | firepass_4100 | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:f5:firepass_4100:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B8BA182D-6515-45F9-A73B-A1F4749ECA72",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass SSL VPN allow remote attackers to inject arbitrary web script or HTML via (1) the xcho parameter to my.logon.php3; the (2) topblue, (3) midblue, (4) wtopblue, and certain other Custom color parameters in a per action to vdesk/admincon/index.php; the (5) h321, (6) h311, (7) h312, and certain other Front Door custom text color parameters in a per action to vdesk/admincon/index.php; the (8) ua parameter in a bro action to vdesk/admincon/index.php; the (9) app_param and (10) app_name parameters to webyfiers.php; (11) double eval functions; (12) JavaScript contained in an \u003cFP_DO_NOT_TOUCH\u003e element; and (13) the vhost parameter to my.activation.php. NOTE: it is possible that this candidate overlaps CVE-2006-3550."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de tipo cross-site scripting (XSS) en F5 FirePass SSL VPN permiten a atacantes remotos inyectar script web o HTML arbitrario por medio de (1) el par\u00e1metro xcho en el archivo my.logon.php3; los par\u00e1metros (2) topblue, (3) midblue, (4) wtopblue y ciertos otros par\u00e1metros de color personalizados en una acci\u00f3n per en el archivo vdesk/admincon/index.php; los par\u00e1metros (5) h321, (6) h311, (7) h312 y ciertos otros par\u00e1metros de color de texto personalizados de la Front Door en una acci\u00f3n per en el archivo vdesk/admincon/index.php; el (8) par\u00e1metro ua en una acci\u00f3n bro en el archivo vdesk/admincon/index.php; los par\u00e1metros (9) app_param y (10) app_name en el archivo webyfiers.php; (11) funciones de doble eval; (12) JavaScript contenido en un elemento (FP_DO_NOT_TOUCH); y (13) el par\u00e1metro vhost en el archivo my.activation.php. NOTA: es posible que este candidato se solapa con CVE-2006-3550."
}
],
"id": "CVE-2007-0186",
"lastModified": "2024-11-21T00:25:12.017",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-01-12T05:04:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051651.html"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/23627"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/23643"
},
{
"source": "cve@mitre.org",
"url": "http://www.mnin.org/advisories/2007_firepass.pdf"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/32737"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/32738"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/32739"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/32740"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/32741"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/32742"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/32743"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/21957"
},
{
"source": "cve@mitre.org",
"url": "https://tech.f5.com/home/solutions/sol6919.html"
},
{
"source": "cve@mitre.org",
"url": "https://tech.f5.com/home/solutions/sol6920.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051651.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/23627"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/23643"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mnin.org/advisories/2007_firepass.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/32737"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/32738"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/32739"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/32740"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/32741"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/32742"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/32743"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/21957"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://tech.f5.com/home/solutions/sol6919.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://tech.f5.com/home/solutions/sol6920.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2008-04-30 16:17
Modified
2024-11-21 00:45
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in installControl.php3 in F5 FirePass 4100 SSL VPN 5.4.2-5.5.2 and 6.0-6.2 allows remote attackers to inject arbitrary web script or HTML via the query string. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| f5 | firepass_4100 | * | |
| f5 | firepass_ssl_vpn | 5.4.2 | |
| f5 | firepass_ssl_vpn | 5.5.2 | |
| f5 | firepass_ssl_vpn | 6.0 | |
| f5 | firepass_ssl_vpn | 6.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:f5:firepass_4100:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B8BA182D-6515-45F9-A73B-A1F4749ECA72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:f5:firepass_ssl_vpn:5.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "00CB3458-5459-4E40-AE68-0FC73FD0C089",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:f5:firepass_ssl_vpn:5.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "4976941E-BDAA-4AD2-AB70-7B4A2E134246",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:f5:firepass_ssl_vpn:6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "01AFA837-B856-482A-8192-5E92FD40EA65",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:f5:firepass_ssl_vpn:6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E81599EA-E8A4-49CB-858E-1FCED94DA71F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in installControl.php3 in F5 FirePass 4100 SSL VPN 5.4.2-5.5.2 and 6.0-6.2 allows remote attackers to inject arbitrary web script or HTML via the query string. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information."
},
{
"lang": "es",
"value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en installControl.php3 de F5 FirePass 4100 SSL VPN 5.4.2-5.5.2 y 6.0-6.2 permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s de la cadena query. NOTA: el origen de esta informaci\u00f3n es desconocido; los detalles se han obtenido \u00fanicamente de informaci\u00f3n de terceros."
}
],
"id": "CVE-2008-2030",
"lastModified": "2024-11-21T00:45:55.730",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2008-04-30T16:17:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://downloads.securityfocus.com/vulnerabilities/exploits/28902.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/29931"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/28902"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42078"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://downloads.securityfocus.com/vulnerabilities/exploits/28902.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/29931"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/28902"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42078"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-03-22 02:02
Modified
2024-11-21 00:08
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in my.support.php3 in F5 Firepass 4100 SSL VPN 5.4.2 allows remote attackers to inject arbitrary web script or HTML via the s parameter.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| f5 | firepass_4100 | 5.4.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:f5:firepass_4100:5.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "85AE9E11-C5F0-462E-AEFA-68ABE3B6AB0D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in my.support.php3 in F5 Firepass 4100 SSL VPN 5.4.2 allows remote attackers to inject arbitrary web script or HTML via the s parameter."
}
],
"id": "CVE-2006-1357",
"lastModified": "2024-11-21T00:08:39.810",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-03-22T02:02:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/19337"
},
{
"source": "cve@mitre.org",
"url": "http://securityreason.com/securityalert/611"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1015798"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/428318/100/0/threaded"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/17175"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2006/1036"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25393"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/19337"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/611"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1015798"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/428318/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/17175"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2006/1036"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25393"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
cve-2008-2030
Vulnerability from cvelistv5
Published
2008-04-30 15:00
Modified
2024-08-07 08:49
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in installControl.php3 in F5 FirePass 4100 SSL VPN 5.4.2-5.5.2 and 6.0-6.2 allows remote attackers to inject arbitrary web script or HTML via the query string. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
References
| ▼ | URL | Tags |
|---|---|---|
| http://downloads.securityfocus.com/vulnerabilities/exploits/28902.html | x_refsource_MISC | |
| http://www.securityfocus.com/bid/28902 | vdb-entry, x_refsource_BID | |
| http://secunia.com/advisories/29931 | third-party-advisory, x_refsource_SECUNIA | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/42078 | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T08:49:56.935Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://downloads.securityfocus.com/vulnerabilities/exploits/28902.html"
},
{
"name": "28902",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/28902"
},
{
"name": "29931",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29931"
},
{
"name": "firepass-installcontrol-xss(42078)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42078"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-04-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in installControl.php3 in F5 FirePass 4100 SSL VPN 5.4.2-5.5.2 and 6.0-6.2 allows remote attackers to inject arbitrary web script or HTML via the query string. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-07T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://downloads.securityfocus.com/vulnerabilities/exploits/28902.html"
},
{
"name": "28902",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/28902"
},
{
"name": "29931",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29931"
},
{
"name": "firepass-installcontrol-xss(42078)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42078"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-2030",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in installControl.php3 in F5 FirePass 4100 SSL VPN 5.4.2-5.5.2 and 6.0-6.2 allows remote attackers to inject arbitrary web script or HTML via the query string. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://downloads.securityfocus.com/vulnerabilities/exploits/28902.html",
"refsource": "MISC",
"url": "http://downloads.securityfocus.com/vulnerabilities/exploits/28902.html"
},
{
"name": "28902",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/28902"
},
{
"name": "29931",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29931"
},
{
"name": "firepass-installcontrol-xss(42078)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42078"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-2030",
"datePublished": "2008-04-30T15:00:00",
"dateReserved": "2008-04-30T00:00:00",
"dateUpdated": "2024-08-07T08:49:56.935Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-3550
Vulnerability from cvelistv5
Published
2006-07-13 00:00
Modified
2024-08-07 18:30
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in F5 Networks FirePass 4100 5.x allow remote attackers to inject arbitrary web script or HTML via unspecified "writable form fields and hidden fields," including "authentication frontends."
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=2352 | x_refsource_MISC | |
| http://www.securityfocus.com/archive/1/439033/100/0/threaded | mailing-list, x_refsource_BUGTRAQ | |
| http://securitytracker.com/id?1016431 | vdb-entry, x_refsource_SECTRACK | |
| http://securityreason.com/securityalert/1237 | third-party-advisory, x_refsource_SREASON | |
| http://www.securityfocus.com/bid/18799 | vdb-entry, x_refsource_BID | |
| http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047635.html | mailing-list, x_refsource_FULLDISC | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/27547 | vdb-entry, x_refsource_XF | |
| http://www.vupen.com/english/advisories/2006/2678 | vdb-entry, x_refsource_VUPEN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T18:30:34.415Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=2352"
},
{
"name": "20060704 [scip_Advisory 2352] F5 FirePass 4100 prior 6.x multiple Cross Site Scripting",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/439033/100/0/threaded"
},
{
"name": "1016431",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1016431"
},
{
"name": "1237",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/1237"
},
{
"name": "18799",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/18799"
},
{
"name": "20060704 [scip_Advisory 2352] F5 FirePass 4100 prior 6.x multiple Cross Site Scripting",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047635.html"
},
{
"name": "firepass-multiple-xss(27547)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27547"
},
{
"name": "ADV-2006-2678",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/2678"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-07-04T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in F5 Networks FirePass 4100 5.x allow remote attackers to inject arbitrary web script or HTML via unspecified \"writable form fields and hidden fields,\" including \"authentication frontends.\""
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-18T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=2352"
},
{
"name": "20060704 [scip_Advisory 2352] F5 FirePass 4100 prior 6.x multiple Cross Site Scripting",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/439033/100/0/threaded"
},
{
"name": "1016431",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1016431"
},
{
"name": "1237",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/1237"
},
{
"name": "18799",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/18799"
},
{
"name": "20060704 [scip_Advisory 2352] F5 FirePass 4100 prior 6.x multiple Cross Site Scripting",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047635.html"
},
{
"name": "firepass-multiple-xss(27547)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27547"
},
{
"name": "ADV-2006-2678",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/2678"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-3550",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in F5 Networks FirePass 4100 5.x allow remote attackers to inject arbitrary web script or HTML via unspecified \"writable form fields and hidden fields,\" including \"authentication frontends.\""
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=2352",
"refsource": "MISC",
"url": "http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=2352"
},
{
"name": "20060704 [scip_Advisory 2352] F5 FirePass 4100 prior 6.x multiple Cross Site Scripting",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/439033/100/0/threaded"
},
{
"name": "1016431",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1016431"
},
{
"name": "1237",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/1237"
},
{
"name": "18799",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/18799"
},
{
"name": "20060704 [scip_Advisory 2352] F5 FirePass 4100 prior 6.x multiple Cross Site Scripting",
"refsource": "FULLDISC",
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047635.html"
},
{
"name": "firepass-multiple-xss(27547)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27547"
},
{
"name": "ADV-2006-2678",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/2678"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-3550",
"datePublished": "2006-07-13T00:00:00",
"dateReserved": "2006-07-12T00:00:00",
"dateUpdated": "2024-08-07T18:30:34.415Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-1357
Vulnerability from cvelistv5
Published
2006-03-22 02:00
Modified
2024-08-07 17:12
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in my.support.php3 in F5 Firepass 4100 SSL VPN 5.4.2 allows remote attackers to inject arbitrary web script or HTML via the s parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/19337 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/17175 | vdb-entry, x_refsource_BID | |
| http://www.securityfocus.com/archive/1/428318/100/0/threaded | mailing-list, x_refsource_BUGTRAQ | |
| http://securityreason.com/securityalert/611 | third-party-advisory, x_refsource_SREASON | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/25393 | vdb-entry, x_refsource_XF | |
| http://www.vupen.com/english/advisories/2006/1036 | vdb-entry, x_refsource_VUPEN | |
| http://securitytracker.com/id?1015798 | vdb-entry, x_refsource_SECTRACK |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T17:12:20.557Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "19337",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/19337"
},
{
"name": "17175",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/17175"
},
{
"name": "20060321 XSS in Firepass 4100 SSL VPN v.5.4.2 (and probably others)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/428318/100/0/threaded"
},
{
"name": "611",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/611"
},
{
"name": "firepass-mysupport-xss(25393)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25393"
},
{
"name": "ADV-2006-1036",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/1036"
},
{
"name": "1015798",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1015798"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-03-21T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in my.support.php3 in F5 Firepass 4100 SSL VPN 5.4.2 allows remote attackers to inject arbitrary web script or HTML via the s parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-18T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "19337",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/19337"
},
{
"name": "17175",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/17175"
},
{
"name": "20060321 XSS in Firepass 4100 SSL VPN v.5.4.2 (and probably others)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/428318/100/0/threaded"
},
{
"name": "611",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/611"
},
{
"name": "firepass-mysupport-xss(25393)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25393"
},
{
"name": "ADV-2006-1036",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/1036"
},
{
"name": "1015798",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1015798"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-1357",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in my.support.php3 in F5 Firepass 4100 SSL VPN 5.4.2 allows remote attackers to inject arbitrary web script or HTML via the s parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "19337",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/19337"
},
{
"name": "17175",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/17175"
},
{
"name": "20060321 XSS in Firepass 4100 SSL VPN v.5.4.2 (and probably others)",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/428318/100/0/threaded"
},
{
"name": "611",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/611"
},
{
"name": "firepass-mysupport-xss(25393)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25393"
},
{
"name": "ADV-2006-1036",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/1036"
},
{
"name": "1015798",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1015798"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-1357",
"datePublished": "2006-03-22T02:00:00",
"dateReserved": "2006-03-21T00:00:00",
"dateUpdated": "2024-08-07T17:12:20.557Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-6704
Vulnerability from cvelistv5
Published
2008-03-05 23:00
Modified
2024-08-07 16:18
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass 4100 SSL VPN 5.4.1 through 5.5.2 and 6.0 through 6.0.1, when pre-logon sequences are enabled, allow remote attackers to inject arbitrary web script or HTML via the query string to (1) my.activation.php3 and (2) my.logon.php3.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T16:18:20.560Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "3712",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/3712"
},
{
"name": "20080523 PR07-15: Cross-site Scripting (XSS) / HTML injection on F5 FirePass 4100 SSL VPN \u0027my.logon.php3\u0027 server-side script",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/492511/100/0/threaded"
},
{
"name": "27904",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/27904"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.procheckup.com/Vulnerability_PR07-14.php"
},
{
"name": "38981",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/38981"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://support.f5.com/kb/en-us/solutions/public/7000/900/SOL7923.html"
},
{
"name": "firepass-myactivation-xss(38785)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38785"
},
{
"name": "26659",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/26659"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.procheckup.com/Vulnerability_PR07-15a.php"
},
{
"name": "firepass-mylogonphp3-xss(38795)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38795"
},
{
"name": "20071130 PR07-14: Cross-site Scripting (XSS) / HTML injection on F5 FirePass 4100 SSL VPN \u0027my.activation.php3\u0027 server-side script",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/484411/100/0/threaded"
},
{
"name": "38980",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/38980"
},
{
"name": "1019031",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1019031"
},
{
"name": "26661",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/26661"
},
{
"name": "20071130 PR07-15: Cross-site Scripting (XSS) / HTML injection on F5 FirePass 4100 SSL VPN \u0027my.logon.php3\u0027 server-side script",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/484413/100/0/threaded"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-11-30T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass 4100 SSL VPN 5.4.1 through 5.5.2 and 6.0 through 6.0.1, when pre-logon sequences are enabled, allow remote attackers to inject arbitrary web script or HTML via the query string to (1) my.activation.php3 and (2) my.logon.php3."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-15T20:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "3712",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/3712"
},
{
"name": "20080523 PR07-15: Cross-site Scripting (XSS) / HTML injection on F5 FirePass 4100 SSL VPN \u0027my.logon.php3\u0027 server-side script",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/492511/100/0/threaded"
},
{
"name": "27904",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/27904"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.procheckup.com/Vulnerability_PR07-14.php"
},
{
"name": "38981",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/38981"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://support.f5.com/kb/en-us/solutions/public/7000/900/SOL7923.html"
},
{
"name": "firepass-myactivation-xss(38785)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38785"
},
{
"name": "26659",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/26659"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.procheckup.com/Vulnerability_PR07-15a.php"
},
{
"name": "firepass-mylogonphp3-xss(38795)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38795"
},
{
"name": "20071130 PR07-14: Cross-site Scripting (XSS) / HTML injection on F5 FirePass 4100 SSL VPN \u0027my.activation.php3\u0027 server-side script",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/484411/100/0/threaded"
},
{
"name": "38980",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/38980"
},
{
"name": "1019031",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1019031"
},
{
"name": "26661",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/26661"
},
{
"name": "20071130 PR07-15: Cross-site Scripting (XSS) / HTML injection on F5 FirePass 4100 SSL VPN \u0027my.logon.php3\u0027 server-side script",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/484413/100/0/threaded"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-6704",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass 4100 SSL VPN 5.4.1 through 5.5.2 and 6.0 through 6.0.1, when pre-logon sequences are enabled, allow remote attackers to inject arbitrary web script or HTML via the query string to (1) my.activation.php3 and (2) my.logon.php3."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "3712",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/3712"
},
{
"name": "20080523 PR07-15: Cross-site Scripting (XSS) / HTML injection on F5 FirePass 4100 SSL VPN \u0027my.logon.php3\u0027 server-side script",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/492511/100/0/threaded"
},
{
"name": "27904",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/27904"
},
{
"name": "http://www.procheckup.com/Vulnerability_PR07-14.php",
"refsource": "MISC",
"url": "http://www.procheckup.com/Vulnerability_PR07-14.php"
},
{
"name": "38981",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/38981"
},
{
"name": "https://support.f5.com/kb/en-us/solutions/public/7000/900/SOL7923.html",
"refsource": "CONFIRM",
"url": "https://support.f5.com/kb/en-us/solutions/public/7000/900/SOL7923.html"
},
{
"name": "firepass-myactivation-xss(38785)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38785"
},
{
"name": "26659",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/26659"
},
{
"name": "http://www.procheckup.com/Vulnerability_PR07-15a.php",
"refsource": "MISC",
"url": "http://www.procheckup.com/Vulnerability_PR07-15a.php"
},
{
"name": "firepass-mylogonphp3-xss(38795)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38795"
},
{
"name": "20071130 PR07-14: Cross-site Scripting (XSS) / HTML injection on F5 FirePass 4100 SSL VPN \u0027my.activation.php3\u0027 server-side script",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/484411/100/0/threaded"
},
{
"name": "38980",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/38980"
},
{
"name": "1019031",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1019031"
},
{
"name": "26661",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/26661"
},
{
"name": "20071130 PR07-15: Cross-site Scripting (XSS) / HTML injection on F5 FirePass 4100 SSL VPN \u0027my.logon.php3\u0027 server-side script",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/484413/100/0/threaded"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-6704",
"datePublished": "2008-03-05T23:00:00",
"dateReserved": "2008-03-05T00:00:00",
"dateUpdated": "2024-08-07T16:18:20.560Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-5979
Vulnerability from cvelistv5
Published
2007-11-15 00:00
Modified
2024-08-07 15:47
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in download_plugin.php3 in F5 Firepass 4100 SSL VPN 5.4 through 5.5.2 and 6.0 through 6.0.1 allows remote attackers to inject arbitrary web script or HTML via the backurl parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/archive/1/483601/100/0/threaded | mailing-list, x_refsource_BUGTRAQ | |
| http://www.securitytracker.com/id?1018937 | vdb-entry, x_refsource_SECTRACK | |
| http://securityreason.com/securityalert/3364 | third-party-advisory, x_refsource_SREASON | |
| http://osvdb.org/38665 | vdb-entry, x_refsource_OSVDB | |
| http://www.securityfocus.com/bid/26412 | vdb-entry, x_refsource_BID | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/38439 | vdb-entry, x_refsource_XF | |
| https://support.f5.com/kb/en-us/solutions/public/7000/400/sol7498.html | x_refsource_CONFIRM | |
| http://www.procheckup.com/Vulnerability_PR07-13.php | x_refsource_MISC | |
| http://www.vupen.com/english/advisories/2007/3847 | vdb-entry, x_refsource_VUPEN | |
| http://secunia.com/advisories/27647 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T15:47:00.617Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20071112 PR07-13: Cross-site Scripting / HTML injection on F5 FirePass 4100 SSL VPN \u0027download_plugin.php3\u0027 server-side script",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/483601/100/0/threaded"
},
{
"name": "1018937",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1018937"
},
{
"name": "3364",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/3364"
},
{
"name": "38665",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/38665"
},
{
"name": "26412",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/26412"
},
{
"name": "firepass-downloadplugin-xss(38439)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38439"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://support.f5.com/kb/en-us/solutions/public/7000/400/sol7498.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.procheckup.com/Vulnerability_PR07-13.php"
},
{
"name": "ADV-2007-3847",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/3847"
},
{
"name": "27647",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/27647"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-11-12T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in download_plugin.php3 in F5 Firepass 4100 SSL VPN 5.4 through 5.5.2 and 6.0 through 6.0.1 allows remote attackers to inject arbitrary web script or HTML via the backurl parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-15T20:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20071112 PR07-13: Cross-site Scripting / HTML injection on F5 FirePass 4100 SSL VPN \u0027download_plugin.php3\u0027 server-side script",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/483601/100/0/threaded"
},
{
"name": "1018937",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1018937"
},
{
"name": "3364",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/3364"
},
{
"name": "38665",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/38665"
},
{
"name": "26412",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/26412"
},
{
"name": "firepass-downloadplugin-xss(38439)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38439"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://support.f5.com/kb/en-us/solutions/public/7000/400/sol7498.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.procheckup.com/Vulnerability_PR07-13.php"
},
{
"name": "ADV-2007-3847",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/3847"
},
{
"name": "27647",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/27647"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-5979",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in download_plugin.php3 in F5 Firepass 4100 SSL VPN 5.4 through 5.5.2 and 6.0 through 6.0.1 allows remote attackers to inject arbitrary web script or HTML via the backurl parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20071112 PR07-13: Cross-site Scripting / HTML injection on F5 FirePass 4100 SSL VPN \u0027download_plugin.php3\u0027 server-side script",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/483601/100/0/threaded"
},
{
"name": "1018937",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1018937"
},
{
"name": "3364",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/3364"
},
{
"name": "38665",
"refsource": "OSVDB",
"url": "http://osvdb.org/38665"
},
{
"name": "26412",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/26412"
},
{
"name": "firepass-downloadplugin-xss(38439)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38439"
},
{
"name": "https://support.f5.com/kb/en-us/solutions/public/7000/400/sol7498.html",
"refsource": "CONFIRM",
"url": "https://support.f5.com/kb/en-us/solutions/public/7000/400/sol7498.html"
},
{
"name": "http://www.procheckup.com/Vulnerability_PR07-13.php",
"refsource": "MISC",
"url": "http://www.procheckup.com/Vulnerability_PR07-13.php"
},
{
"name": "ADV-2007-3847",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/3847"
},
{
"name": "27647",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/27647"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-5979",
"datePublished": "2007-11-15T00:00:00",
"dateReserved": "2007-11-14T00:00:00",
"dateUpdated": "2024-08-07T15:47:00.617Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-3097
Vulnerability from cvelistv5
Published
2007-06-06 22:00
Modified
2024-08-07 14:05
Severity ?
EPSS score ?
Summary
my.activation.php3 in F5 FirePass 4100 SSL VPN allows remote attackers to execute arbitrary shell commands via shell metacharacters in the username parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securitytracker.com/id?1018190 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/25563 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.s21sec.com/avisos/s21sec-035-en.txt | x_refsource_MISC | |
| http://www.securityfocus.com/archive/1/470444/100/0/threaded | mailing-list, x_refsource_BUGTRAQ | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/34708 | vdb-entry, x_refsource_XF | |
| http://www.vupen.com/english/advisories/2007/2073 | vdb-entry, x_refsource_VUPEN | |
| http://www.securityfocus.com/bid/24306 | vdb-entry, x_refsource_BID | |
| http://www.osvdb.org/35246 | vdb-entry, x_refsource_OSVDB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T14:05:29.274Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1018190",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1018190"
},
{
"name": "25563",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/25563"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.s21sec.com/avisos/s21sec-035-en.txt"
},
{
"name": "20070604 S21Sec-035: F5 FirePass command execution vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/470444/100/0/threaded"
},
{
"name": "firepass-myactivation-command-execution(34708)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34708"
},
{
"name": "ADV-2007-2073",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/2073"
},
{
"name": "24306",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/24306"
},
{
"name": "35246",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/35246"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-06-04T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "my.activation.php3 in F5 FirePass 4100 SSL VPN allows remote attackers to execute arbitrary shell commands via shell metacharacters in the username parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-16T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1018190",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1018190"
},
{
"name": "25563",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/25563"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.s21sec.com/avisos/s21sec-035-en.txt"
},
{
"name": "20070604 S21Sec-035: F5 FirePass command execution vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/470444/100/0/threaded"
},
{
"name": "firepass-myactivation-command-execution(34708)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34708"
},
{
"name": "ADV-2007-2073",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/2073"
},
{
"name": "24306",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/24306"
},
{
"name": "35246",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/35246"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-3097",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "my.activation.php3 in F5 FirePass 4100 SSL VPN allows remote attackers to execute arbitrary shell commands via shell metacharacters in the username parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1018190",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1018190"
},
{
"name": "25563",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/25563"
},
{
"name": "http://www.s21sec.com/avisos/s21sec-035-en.txt",
"refsource": "MISC",
"url": "http://www.s21sec.com/avisos/s21sec-035-en.txt"
},
{
"name": "20070604 S21Sec-035: F5 FirePass command execution vulnerability",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/470444/100/0/threaded"
},
{
"name": "firepass-myactivation-command-execution(34708)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34708"
},
{
"name": "ADV-2007-2073",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/2073"
},
{
"name": "24306",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/24306"
},
{
"name": "35246",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/35246"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-3097",
"datePublished": "2007-06-06T22:00:00",
"dateReserved": "2007-06-06T00:00:00",
"dateUpdated": "2024-08-07T14:05:29.274Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-0186
Vulnerability from cvelistv5
Published
2007-01-11 02:00
Modified
2024-08-07 12:12
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass SSL VPN allow remote attackers to inject arbitrary web script or HTML via (1) the xcho parameter to my.logon.php3; the (2) topblue, (3) midblue, (4) wtopblue, and certain other Custom color parameters in a per action to vdesk/admincon/index.php; the (5) h321, (6) h311, (7) h312, and certain other Front Door custom text color parameters in a per action to vdesk/admincon/index.php; the (8) ua parameter in a bro action to vdesk/admincon/index.php; the (9) app_param and (10) app_name parameters to webyfiers.php; (11) double eval functions; (12) JavaScript contained in an <FP_DO_NOT_TOUCH> element; and (13) the vhost parameter to my.activation.php. NOTE: it is possible that this candidate overlaps CVE-2006-3550.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.mnin.org/advisories/2007_firepass.pdf | x_refsource_MISC | |
| http://secunia.com/advisories/23627 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.osvdb.org/32738 | vdb-entry, x_refsource_OSVDB | |
| https://tech.f5.com/home/solutions/sol6920.html | x_refsource_CONFIRM | |
| https://tech.f5.com/home/solutions/sol6919.html | x_refsource_CONFIRM | |
| http://www.osvdb.org/32739 | vdb-entry, x_refsource_OSVDB | |
| http://secunia.com/advisories/23643 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.osvdb.org/32737 | vdb-entry, x_refsource_OSVDB | |
| http://www.osvdb.org/32743 | vdb-entry, x_refsource_OSVDB | |
| http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051651.html | mailing-list, x_refsource_FULLDISC | |
| http://www.osvdb.org/32740 | vdb-entry, x_refsource_OSVDB | |
| http://www.osvdb.org/32741 | vdb-entry, x_refsource_OSVDB | |
| http://www.osvdb.org/32742 | vdb-entry, x_refsource_OSVDB | |
| http://www.securityfocus.com/bid/21957 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T12:12:17.273Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.mnin.org/advisories/2007_firepass.pdf"
},
{
"name": "23627",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/23627"
},
{
"name": "32738",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/32738"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://tech.f5.com/home/solutions/sol6920.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://tech.f5.com/home/solutions/sol6919.html"
},
{
"name": "32739",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/32739"
},
{
"name": "23643",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/23643"
},
{
"name": "32737",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/32737"
},
{
"name": "32743",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/32743"
},
{
"name": "20070106 NNL-Labs \u0026 MNIN - F5 FirePass Security Advisory",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051651.html"
},
{
"name": "32740",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/32740"
},
{
"name": "32741",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/32741"
},
{
"name": "32742",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/32742"
},
{
"name": "21957",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/21957"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-01-05T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass SSL VPN allow remote attackers to inject arbitrary web script or HTML via (1) the xcho parameter to my.logon.php3; the (2) topblue, (3) midblue, (4) wtopblue, and certain other Custom color parameters in a per action to vdesk/admincon/index.php; the (5) h321, (6) h311, (7) h312, and certain other Front Door custom text color parameters in a per action to vdesk/admincon/index.php; the (8) ua parameter in a bro action to vdesk/admincon/index.php; the (9) app_param and (10) app_name parameters to webyfiers.php; (11) double eval functions; (12) JavaScript contained in an \u003cFP_DO_NOT_TOUCH\u003e element; and (13) the vhost parameter to my.activation.php. NOTE: it is possible that this candidate overlaps CVE-2006-3550."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2007-01-17T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.mnin.org/advisories/2007_firepass.pdf"
},
{
"name": "23627",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/23627"
},
{
"name": "32738",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/32738"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://tech.f5.com/home/solutions/sol6920.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://tech.f5.com/home/solutions/sol6919.html"
},
{
"name": "32739",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/32739"
},
{
"name": "23643",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/23643"
},
{
"name": "32737",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/32737"
},
{
"name": "32743",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/32743"
},
{
"name": "20070106 NNL-Labs \u0026 MNIN - F5 FirePass Security Advisory",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051651.html"
},
{
"name": "32740",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/32740"
},
{
"name": "32741",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/32741"
},
{
"name": "32742",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/32742"
},
{
"name": "21957",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/21957"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-0186",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass SSL VPN allow remote attackers to inject arbitrary web script or HTML via (1) the xcho parameter to my.logon.php3; the (2) topblue, (3) midblue, (4) wtopblue, and certain other Custom color parameters in a per action to vdesk/admincon/index.php; the (5) h321, (6) h311, (7) h312, and certain other Front Door custom text color parameters in a per action to vdesk/admincon/index.php; the (8) ua parameter in a bro action to vdesk/admincon/index.php; the (9) app_param and (10) app_name parameters to webyfiers.php; (11) double eval functions; (12) JavaScript contained in an \u003cFP_DO_NOT_TOUCH\u003e element; and (13) the vhost parameter to my.activation.php. NOTE: it is possible that this candidate overlaps CVE-2006-3550."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.mnin.org/advisories/2007_firepass.pdf",
"refsource": "MISC",
"url": "http://www.mnin.org/advisories/2007_firepass.pdf"
},
{
"name": "23627",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/23627"
},
{
"name": "32738",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/32738"
},
{
"name": "https://tech.f5.com/home/solutions/sol6920.html",
"refsource": "CONFIRM",
"url": "https://tech.f5.com/home/solutions/sol6920.html"
},
{
"name": "https://tech.f5.com/home/solutions/sol6919.html",
"refsource": "CONFIRM",
"url": "https://tech.f5.com/home/solutions/sol6919.html"
},
{
"name": "32739",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/32739"
},
{
"name": "23643",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/23643"
},
{
"name": "32737",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/32737"
},
{
"name": "32743",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/32743"
},
{
"name": "20070106 NNL-Labs \u0026 MNIN - F5 FirePass Security Advisory",
"refsource": "FULLDISC",
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051651.html"
},
{
"name": "32740",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/32740"
},
{
"name": "32741",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/32741"
},
{
"name": "32742",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/32742"
},
{
"name": "21957",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/21957"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-0186",
"datePublished": "2007-01-11T02:00:00",
"dateReserved": "2007-01-10T00:00:00",
"dateUpdated": "2024-08-07T12:12:17.273Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}