CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 3CVE-2008-2030 – F5 Networks FirePass 4100 SSL VPN - 'installControl.php3' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2008-2030
Cross-site scripting (XSS) vulnerability in installControl.php3 in F5 FirePass 4100 SSL VPN 5.4.2-5.5.2 and 6.0-6.2 allows remote attackers to inject arbitrary web script or HTML via the query string. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en installControl.php3 de F5 FirePass 4100 SSL VPN 5.4.2-5.5.2 y 6.0-6.2 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de la cadena query. NOTA: el origen de esta información es desconocido; los detalles se han obtenido únicamente de información de terceros. • https://www.exploit-db.com/exploits/31698 http://downloads.securityfocus.com/vulnerabilities/exploits/28902.html http://secunia.com/advisories/29931 http://www.securityfocus.com/bid/28902 https://exchange.xforce.ibmcloud.com/vulnerabilities/42078 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 2.6EPSS: 0%CPEs: 14EXPL: 3CVE-2007-6704 – F5 Networks FirePass 4100 SSL VPN - 'Download_Plugin.php3' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2007-6704
Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass 4100 SSL VPN 5.4.1 through 5.5.2 and 6.0 through 6.0.1, when pre-logon sequences are enabled, allow remote attackers to inject arbitrary web script or HTML via the query string to (1) my.activation.php3 and (2) my.logon.php3. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en F5 FirePass 4100 SSL VPN 5.4.1 hasta 5.5.2 y 6.0 hasta 6.0.1, cuando las secuencias pre-logon están activadas, permiten a atacantes remotos inyectar web script o HMTL de su elección a través de la cadena de consulta de (1) my.activation.php3 y (2) my.logon.php3. • https://www.exploit-db.com/exploits/30834 https://www.exploit-db.com/exploits/30833 http://secunia.com/advisories/27904 http://securityreason.com/securityalert/3712 http://www.osvdb.org/38980 http://www.osvdb.org/38981 http://www.procheckup.com/Vulnerability_PR07-14.php http://www.procheckup.com/Vulnerability_PR07-15a.php http://www.securityfocus.com/archive/1/484411/100/0/threaded http://www.securityfocus.com/archive/1/484413/100/0/threaded http://www.securityfocus.com • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 1%CPEs: 14EXPL: 1CVE-2007-5979 – F5 FirePass 4100 SSL VPN - 'Download_Plugin.php3' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2007-5979
Cross-site scripting (XSS) vulnerability in download_plugin.php3 in F5 Firepass 4100 SSL VPN 5.4 through 5.5.2 and 6.0 through 6.0.1 allows remote attackers to inject arbitrary web script or HTML via the backurl parameter. Vulnerabilidad de secuencia de comandos en sitios cruzados (XSS) en download_plugin.php3 en F5 Firepass 4100 SSL VPN 5.4 hasta la 5.5.2 y 6.0 hasta la 6.0.1 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro backurl. • https://www.exploit-db.com/exploits/30755 http://osvdb.org/38665 http://secunia.com/advisories/27647 http://securityreason.com/securityalert/3364 http://www.procheckup.com/Vulnerability_PR07-13.php http://www.securityfocus.com/archive/1/483601/100/0/threaded http://www.securityfocus.com/bid/26412 http://www.securitytracker.com/id?1018937 http://www.vupen.com/english/advisories/2007/3847 https://exchange.xforce.ibmcloud.com/vulnerabilities/38439 https://support.f5.com/kb/en- • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2007-3097
https://notcve.org/view.php?id=CVE-2007-3097
my.activation.php3 in F5 FirePass 4100 SSL VPN allows remote attackers to execute arbitrary shell commands via shell metacharacters in the username parameter. my.activation.php3 en F5 FirePass 4100 SSL VPN permite a atacantes remotos ejecutar órdenes de línea de comandos de su elección mediante metacaracteres de línea de comandos en el parámetro username. • http://secunia.com/advisories/25563 http://www.osvdb.org/35246 http://www.s21sec.com/avisos/s21sec-035-en.txt http://www.securityfocus.com/archive/1/470444/100/0/threaded http://www.securityfocus.com/bid/24306 http://www.securitytracker.com/id?1018190 http://www.vupen.com/english/advisories/2007/2073 https://exchange.xforce.ibmcloud.com/vulnerabilities/34708 •
CVSS: 6.8EPSS: 4%CPEs: 1EXPL: 0CVE-2007-0186
https://notcve.org/view.php?id=CVE-2007-0186
Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass SSL VPN allow remote attackers to inject arbitrary web script or HTML via (1) the xcho parameter to my.logon.php3; the (2) topblue, (3) midblue, (4) wtopblue, and certain other Custom color parameters in a per action to vdesk/admincon/index.php; the (5) h321, (6) h311, (7) h312, and certain other Front Door custom text color parameters in a per action to vdesk/admincon/index.php; the (8) ua parameter in a bro action to vdesk/admincon/index.php; the (9) app_param and (10) app_name parameters to webyfiers.php; (11) double eval functions; (12) JavaScript contained in an <FP_DO_NOT_TOUCH> element; and (13) the vhost parameter to my.activation.php. NOTE: it is possible that this candidate overlaps CVE-2006-3550. Múltiples vulnerabilidades de tipo cross-site scripting (XSS) en F5 FirePass SSL VPN permiten a atacantes remotos inyectar script web o HTML arbitrario por medio de (1) el parámetro xcho en el archivo my.logon.php3; los parámetros (2) topblue, (3) midblue, (4) wtopblue y ciertos otros parámetros de color personalizados en una acción per en el archivo vdesk/admincon/index.php; los parámetros (5) h321, (6) h311, (7) h312 y ciertos otros parámetros de color de texto personalizados de la Front Door en una acción per en el archivo vdesk/admincon/index.php; el (8) parámetro ua en una acción bro en el archivo vdesk/admincon/index.php; los parámetros (9) app_param y (10) app_name en el archivo webyfiers.php; (11) funciones de doble eval; (12) JavaScript contenido en un elemento (FP_DO_NOT_TOUCH); y (13) el parámetro vhost en el archivo my.activation.php. NOTA: es posible que este candidato se solapa con CVE-2006-3550. • http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051651.html http://secunia.com/advisories/23627 http://secunia.com/advisories/23643 http://www.mnin.org/advisories/2007_firepass.pdf http://www.osvdb.org/32737 http://www.osvdb.org/32738 http://www.osvdb.org/32739 http://www.osvdb.org/32740 http://www.osvdb.org/32741 http://www.osvdb.org/32742 http://www.osvdb.org/32743 http://www.securityfocus.com/bid/21957 https://tech.f5.com/home& •