CVSS: 5.4EPSS: 0%CPEs: 12EXPL: 1CVE-2018-5280
https://notcve.org/view.php?id=CVE-2018-5280
SonicWall SonicOS on Network Security Appliance (NSA) 2016 Q4 devices has XSS via the Configure SSO screens. SonicWall SonicOS en dispositivos Network Security Appliance (NSA) 2016 Q4 tiene Cross-Site Scripting (XSS) a través de las pantallas de configuración de SSO. • http://www.securityfocus.com/bid/102438 https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0001 https://www.vulnerability-lab.com/get_content.php?id=1725 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 2CVE-2015-3447
https://notcve.org/view.php?id=CVE-2015-3447
Multiple cross-site scripting (XSS) vulnerabilities in macIpSpoofView.html in Dell SonicWall SonicOS 7.5.0.12 and 6.x allow remote attackers to inject arbitrary web script or HTML via the (1) searchSpoof or (2) searchSpoofIpDet parameter. Múltiples vulnerabilidades de XSS en macIpSpoofView.html en Dell SonicWall SonicOS 7.5.0.12 y 6.x permiten a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través del parámetro (1) searchSpoof o (2) searchSpoofIpDet. • http://seclists.org/fulldisclosure/2015/Apr/97 http://www.securityfocus.com/archive/1/535393/100/0/threaded http://www.securityfocus.com/bid/74406 http://www.securitytracker.com/id/1032204 http://www.vulnerability-lab.com/get_content.php?id=1359 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 1CVE-2008-4918 – SonicWALL Content-Filtering Universal Script Injection Vulnerability
https://notcve.org/view.php?id=CVE-2008-4918
Cross-site scripting (XSS) vulnerability in SonicWALL SonicOS Enhanced before 4.0.1.1, as used in SonicWALL Pro 2040 and TZ 180 and 190, allows remote attackers to inject arbitrary web script or HTML into arbitrary web sites via a URL to a site that is blocked based on content filtering, which is not properly handled in the CFS block page, aka "universal website hijacking." Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en SonicWALL SonicOS Enhanced anterior a v4.0.1.1, como el utilizado en SonicWALL Pro 2040 y TZ 180 y 190; permite a atacantes remotos inyectar secuencias de comandos Web o HTML en sitios web de su elección a través de una URL a un sitio que se basa en el bloqueo de filtrado de contenidos; esto no se maneja adecuadamente en la página de bloqueo CFS. También se conoce como "secuestro universal del sitio web" (universal website hijacking). This vulnerability allows remote attackers to execute a script injection attack on arbitrary sites through vulnerable installations of SonicWALL. User interaction is required to exploit this vulnerability in that the target must visit a malicious web page or open a malicious web link. The specific flaw exists in the default error page displayed when a user requests access to a web site that is blocked based on the devices content-filtering rules. • https://www.exploit-db.com/exploits/32552 http://secunia.com/advisories/32498 http://securityreason.com/securityalert/4556 http://www.gnucitizen.org/blog/new-technique-to-perform-universal-website-hijacking http://www.securityfocus.com/archive/1/497948/100/0/threaded http://www.securityfocus.com/archive/1/497958/100/0/threaded http://www.securityfocus.com/archive/1/497968/100/0/threaded http://www.securityfocus.com/archive/1/497989/100/0/threaded http://www.securityfocus.com/archi • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •