Vulnerabilities (CVE)

Filtered by vendor Armorlogic Subscribe

Filtered by product Profense Web Application Firewall

Total 5 CVE

CVE	Vendors	Products	Updated	CVSS v2	CVSS v3
CVE-2009-1745	1 Armorlogic	1 Profense Web Application Firewall	2024-11-21	10.0 HIGH	N/A
Armorlogic Profense Web Application Firewall before 2.2.22, and 2.4.x before 2.4.4, has a default root password hash, and permits password-based root logins over SSH, which makes it easier for remote attackers to obtain access.
CVE-2009-1594	1 Armorlogic	1 Profense Web Application Firewall	2024-11-21	7.5 HIGH	N/A
Armorlogic Profense Web Application Firewall before 2.2.22, and 2.4.x before 2.4.4, does not properly implement the "positive model," which allows remote attackers to bypass certain protection mechanisms via a %0A (encoded newline), as demonstrated by a %0A in a cross-site scripting (XSS) attack URL.
CVE-2009-1593	1 Armorlogic	1 Profense Web Application Firewall	2024-11-21	4.3 MEDIUM	N/A
Armorlogic Profense Web Application Firewall before 2.2.22, and 2.4.x before 2.4.4, does not properly implement the "negative model," which allows remote attackers to conduct cross-site scripting (XSS) attacks via a modified end tag of a SCRIPT element.
CVE-2009-0468	1 Armorlogic	1 Profense Web Application Firewall	2024-11-21	6.8 MEDIUM	N/A
Multiple cross-site request forgery (CSRF) vulnerabilities in ajax.html in Profense Web Application Firewall 2.6.2 and 2.6.3 allow remote attackers to hijack the authentication of administrators for requests that (1) shutdown the server, (2) send ping packets, (3) enable network services, (4) configure a proxy server, and (5) modify other settings via parameters in the query string.
CVE-2009-0467	1 Armorlogic	1 Profense Web Application Firewall	2024-11-21	4.3 MEDIUM	N/A
Cross-site scripting (XSS) vulnerability in proxy.html in Profense Web Application Firewall 2.6.2 and 2.6.3 allows remote attackers to inject arbitrary web script or HTML via the proxy parameter in a deny_log manage action.