CVSS: 6.5EPSS: 2%CPEs: 2EXPL: 4CVE-2015-5453 – Watchguard XCS - Remote Command Execution
https://notcve.org/view.php?id=CVE-2015-5453
Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to execute arbitrary commands via shell metacharacters in the id parameter to ADMIN/mailqueue.spl. Watchguard XCS 9.2 y 10.0 en versiones anteriores a build 150522 permite a usuarios remotos autenticados ejecutar comandos arbitrarios a través de metacarácteres de shell en el paramétro id en ADMIN/mailqueue.spl. • https://www.exploit-db.com/exploits/38346 http://packetstormsecurity.com/files/132498/Watchguard-XCS-10.0-SQL-Injection-Command-Execution.html http://packetstormsecurity.com/files/133721/Watchguard-XCS-Remote-Command-Execution.html http://www.rapid7.com/db/modules/exploit/freebsd/http/watchguard_cmd_exec http://www.security-assessment.com/files/documents/advisory/Watchguard-XCS-final.pdf http://www.securityfocus.com/bid/75516 http://www.watchguard.com/support/release-notes/xcs/10/en-US/EN_Release_No • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 4.3EPSS: 0%CPEs: 11EXPL: 2CVE-2014-0338
https://notcve.org/view.php?id=CVE-2014-0338
Multiple cross-site scripting (XSS) vulnerabilities in the firewall policy management pages in WatchGuard Fireware XTM before 11.8.3 allow remote attackers to inject arbitrary web script or HTML via the pol_name parameter. Múltiples vulnerabilidades de XSS en las páginas de gestión de política de firewall en WatchGuard Fireware XTM anterior a 11.8.3 permiten a atacantes remotos inyectar script Web o HTML arbitrarios a través del parámetro pol_name. • http://seclists.org/fulldisclosure/2014/Mar/154 http://watchguardsecuritycenter.com/2014/03/13/fireware-xtm-11-8-3-update-corrects-xss-flaw http://www.kb.cert.org/vuls/id/807134 http://www.securityfocus.com/bid/66210 http://www.securitytracker.com/id/1029924 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.3EPSS: 12%CPEs: 12EXPL: 4CVE-2013-6021 – Watchguard Firewall XTM 11.7.4u1 - Remote Buffer Overflow
https://notcve.org/view.php?id=CVE-2013-6021
Buffer overflow in WGagent in WatchGuard WSM and Fireware before 11.8 allows remote attackers to execute arbitrary code via a long sessionid value in a cookie. Desbordamiento de buffer en WGagent de WatchGuard WSM y Fireware anterior a la versión 11.8 permite a atacantes remotos ejecutar código arbitrario a través de un valor largo de sessionid en una cookie. • https://www.exploit-db.com/exploits/29273 http://osvdb.org/98752 http://watchguardsecuritycenter.com/2013/10/17/watchguard-dimension-and-fireware-xtm-11-8 http://watchguardsecuritycenter.com/2013/10/17/xtm-11-8-secfixes http://www.exploit-db.com/exploits/29273 http://www.kb.cert.org/vuls/id/233990 http://www.securityfocus.com/bid/63227 https://funoverip.net/2013/10/watchguard-cve-2013-6021-stack-based-buffer-overflow-exploit • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.3EPSS: 0%CPEs: 10EXPL: 0CVE-2013-5702 – Watchguard Server Center 11.7.4 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2013-5702
Multiple cross-site scripting (XSS) vulnerabilities in WebCenter in WatchGuard WSM and Fireware before 11.8 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters. Múltiples vulnerabilidades corss-site scripting (XSS) en WebCenter de Watchguard WSM y Fireware anterior a 11.8, permite a atancates remotos, inyectar script web o HTML de forma arbitraria a traves de vectores no especificados. Watchguard Server Center version 11.7.4 suffers from multiple reflective cross site scripting vulnerabilities. • http://watchguardsecuritycenter.com/2013/10/17/watchguard-dimension-and-fireware-xtm-11-8 http://watchguardsecuritycenter.com/2013/10/17/xtm-11-8-secfixes • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 4CVE-2013-5701 – Watchguard Server Center - Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2013-5701
Multiple untrusted search path vulnerabilities in (1) Watchguard Log Collector (wlcollector.exe) and (2) Watchguard WebBlocker Server (wbserver.exe) in WatchGuard Server Center 11.7.4, 11.7.3, and possibly earlier allow local users to gain privileges via a Trojan horse wgpr.dll file in the application's bin directory. Múltiples vulnerabilidades de ruta de búsqueda no confiable en (1) Watchguard Log Collector (wlcollector.exe) y (2) Watchguard WebBlocker Server (wbserver.exe) en WatchGuard Server Center 11.7.4, 11.7.3, y posiblemente anteriores versiones permiten a usuarios locales obtener privilegios a través de un caballo de troya en el archivo wgpr.dll en el directorio bin de la aplicación. Watchguard Server Center version 11.7.4 suffers from a dll hijacking vulnerability with wgpr.dll. • https://www.exploit-db.com/exploits/38752 http://seclists.org/fulldisclosure/2013/Sep/43 http://www.securitytracker.com/id/1028992 https://www.rcesecurity.com/2013/09/cve-2013-5701-watchguard-server-center-v11-7-4-wgpr-dll-local-privileges-escalation-vulnerability • CWE-264: Permissions, Privileges, and Access Controls •