asggeeks.blogg.se

An authenticated attacker may be able to upload a malicious file allowing the execution of arbitrary code.Īn Unquoted Search Path or Element issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web 6.5 and prior ALC WebCTRL, SiteScan Web 6.1 and prior ALC WebCTRL, i-Vu 6.0 and prior ALC WebCTRL, i-Vu, SiteScan Web 5.5 and prior and ALC WebCTRL, i-Vu, SiteScan Web 5.2 and prior.

An attacker could enter malicious input to WebCTRL, i-Vu, or SiteScan Web through a weakly configured XML parser causing the application to execute arbitrary code or disclose file contents from a server or connected network.Īn Unrestricted Upload of File with Dangerous Type issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web 6.5 and prior ALC WebCTRL, SiteScan Web 6.1 and prior ALC WebCTRL, i-Vu 6.0 and prior ALC WebCTRL, i-Vu, SiteScan Web 5.5 and prior and ALC WebCTRL, i-Vu, SiteScan Web 5.2 and prior.

This issue works by passing in a basic XSS payload to a vulnerable GET parameter that is reflected in the output without sanitization.ģ I-vu, Sitescan Web, Automatedlogic WebctrlĪn XXE issue was discovered in Automated Logic Corporation (ALC) Liebert SiteScan Web Version 6.5 and prior, ALC WebCTRL Version 6.5 and prior, and Carrier i-Vu Version 6.5 and prior. This issue impacts versions 6.5 and below.

The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks due to the operatorlocale GET parameter not being sanitized. The vulnerability allows an attacker to send a maliciously crafted URL which could result in redirecting the user to a malicious webpage or downloading a malicious file. Automated Logic's WebCtrl Server Version 6.1 'Help' index pages are vulnerable to open redirection.