PortWise SSL VPN 4.6 – ‘reloadFrame’ Cross-Site Scripting

Exploit Database
196 阅读

作者： George Christopoulos

日期： 2010-02-18
类别：
- remote
平台：
- multiple
来源：https://www.exploit-db.com/exploits/33653/

source: https://www.securityfocus.com/bid/38308/info

PortWise SSL VPN is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

PortWise SSL VPN 4.6 is vulnerable; other versions may also be affected.

https://www/example.com/wa/auth?&authmech=Assess&reloadFrame=%22;%3Cscript%3Eblah%3C/script%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

last Exploits
PortWise SSL VPN 4.6 – ‘reloadFrame’ Cross-Site Scripting的更多信息

AWebServer GhostBuilding 18 – Denial of Service (DoS)：
Raspberry Pi 5.10 – Default Credentials：
Sysax Multi Server 5.50 – Create Folder Buffer Overflow：
RealNetworks Realplayer – QCP Parsing Heap Overflow (Metasploit)：
OpenVAS Manager 4.0 – Authentication Bypass：
Polycom HDX – Telnet Authentication Bypass (Metasploit)：
Apache Struts 2.0.0 < 2.2.1.1 - XWork 's:submit' HTML Tag Cross-Site Scripting：
EasyFTP Server 1.7.0.11 – ‘LIST’ Stack Buffer Overflow (Metasploit)：