CVE

Id
23543  
CVE No.
CVE-2007-0186  
Status
Candidate  
Description
Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass SSL VPN allow remote attackers to inject arbitrary web script or HTML via (1) the xcho parameter to my.logon.php3; the (2) topblue, (3) midblue, (4) wtopblue, and certain other Custom color parameters in a per action to vdesk/admincon/index.php; the (5) h321, (6) h311, (7) h312, and certain other Front Door custom text color parameters in a per action to vdesk/admincon/index.php; the (8) ua parameter in a bro action to vdesk/admincon/index.php; the (9) app_param and (10) app_name parameters to webyfiers.php; (11) double eval functions; (12) JavaScript contained in an <FP_DO_NOT_TOUCH> element; and (13) the vhost parameter to my.activation.php. NOTE: it is possible that this candidate overlaps CVE-2006-3550.  
Phase
Assigned (20070110)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
227985 23543 CVE-2007-0186 FULLDISC:20070106 NNL-Labs & MNIN - F5 FirePass Security Advisory  View
227986 23543 CVE-2007-0186 URL:http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051651.html  View
227987 23543 CVE-2007-0186 MISC:http://www.mnin.org/advisories/2007_firepass.pdf  View
227988 23543 CVE-2007-0186 CONFIRM:https://tech.f5.com/home/solutions/sol6919.html  View
227989 23543 CVE-2007-0186 CONFIRM:https://tech.f5.com/home/solutions/sol6920.html  View
227990 23543 CVE-2007-0186 BID:21957  View
227991 23543 CVE-2007-0186 URL:http://www.securityfocus.com/bid/21957  View
227992 23543 CVE-2007-0186 OSVDB:32740  View
227993 23543 CVE-2007-0186 URL:http://www.osvdb.org/32740  View
227994 23543 CVE-2007-0186 OSVDB:32741  View
227995 23543 CVE-2007-0186 URL:http://www.osvdb.org/32741  View
227996 23543 CVE-2007-0186 OSVDB:32742  View
227997 23543 CVE-2007-0186 URL:http://www.osvdb.org/32742  View
227998 23543 CVE-2007-0186 OSVDB:32743  View
227999 23543 CVE-2007-0186 URL:http://www.osvdb.org/32743  View
228000 23543 CVE-2007-0186 OSVDB:32739  View
228001 23543 CVE-2007-0186 URL:http://www.osvdb.org/32739  View
228002 23543 CVE-2007-0186 OSVDB:32737  View
228003 23543 CVE-2007-0186 URL:http://www.osvdb.org/32737  View
228004 23543 CVE-2007-0186 OSVDB:32738  View
228005 23543 CVE-2007-0186 URL:http://www.osvdb.org/32738  View
228006 23543 CVE-2007-0186 SECUNIA:23627  View
228007 23543 CVE-2007-0186 URL:http://secunia.com/advisories/23627  View
228008 23543 CVE-2007-0186 SECUNIA:23643  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
52679 JVNDB-2007-001371 F5 FirePass における FirePass 管理コンソールなどのネットワークリソースに接続される脆弱性 F5 FirePass には、クライアントが IP アドレス表記にドット無しの Single Integer (dword) 表記を使用した際、ホストアクセス制限を適切に処理しないため、FirePass 管理コンソールおよびその他のネットワークリソースを使用される脆弱性が存在します。 CVE-2007-0188 23543 6.5 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-001371.html  View