Advisories (Vulnerabilities) & Papers

In 2008 ProCheckUp published more vulnerabilities than any other UK penetration testing company.

The combination of ProCheckNet's response-driven AI technology and our experienced security consultants has led to the discovery of many security vulnerabilities and advisories during penetration testing assignments.

Over the years, ProCheckUp have been credited with finding vulnerabilities and advisories in products from vendors such as:

Microsoft - Aruba Networks - IBM - Novell - BEA Systems - Whale Communications - Netscape - Hummingbird - Apache- F5 Networks - GoAhead - Sun Microsystems

2010 2009 2008 2007 2006 2005 2004 2003 2002 2001

2010

09/06/2010	PR09-16	Juniper Secure Access series (Juniper IVE) XSS
21/05/2010	PR10-03	Authenticated XSS within the Apache Axis2 administration console
20/05/2010	PR10-01	Unauthenticated File Retrieval (traversal) within 3Com* iMC (Intelligent Management Center)
20/05/2010	PR10-02	Various XSS and information disclosure flaws within 3Com* iMC (Intelligent Management Center)
17/02/2010	PR09-04	Cross-Site Scriting on Portwise SSL VPN v4.6
03/02/2010	PR09-20	XSS on CommonSpot server
28/01/2010	PR09-15	XSS injection vulnerability within HP System Management Homepage (Insight Manager)
18/01/2010	PR09-02	Multiple Cross-Site Scripting (XSS) / Cross Domain redirects and Server path information disclosure on SAP BusinessObjects version 12

2009

06/11/2009	PR08-07	XSS vulnerabilities and Webroot disclosure within BBC Betsie
09/10/2009	PR09-13	Internet Explorer version 8 Cross Site Scripting Filter can be bypassed using text files
25/09/2009	PR09-07	Multiple XSS/HTML injection vulnerabilities on Activedition 4.0.0
22/09/2009	PR09-08	Juniper JunOS JWeb (Juniper Web Management) XSS
22/09/2009	PR09-09	Juniper JunOS JWeb (Juniper Web Management) authenticated XSS
22/09/2009	PR09-10	Juniper JunOS JWeb (Juniper Web Management) authenticated XSS
21/09/2009	PR09-06	Lyris Listmanager Security Research
07/09/2009	PR08-04	Two XSS vulnerabilities on Ringtail Casebook
07/09/2009	PR08-08	Several XSS on Orion Application server 2.0 to 2.0.8
07/09/2009	PR08-17	Broadvision CMS vulnerable to session fixation and disclosure of session IDs (DRAFT)
24/04/2009	PR09-03	XSS with mod_perl perl_status utility
24/04/2009	PR09-05	ScreenOS remote information disclosure on Juniper Netscreen ScreenOS Firewalls
30/01/2009	PR08-21	CSRF on Novell GroupWise WebAccess allows email theft and other attacks
30/01/2009	PR08-22	Persistent XSS on Novell GroupWise WebAccess
30/01/2009	PR08-23	XSS on Novell GroupWise WebAccess
14/01/2009	PR08-19	XSS on Cisco IOS HTTP Server

2008

14/11/2008	PR07-40	Authentication Bypass, Passwords Leakage and SNMP Injection on 3Com AP 8760
10/11/2008	PR07-11	Cross-site Request Forgery (CSRF) on Sun Java System Identity Manager
10/11/2008	PR08-09	Unauthenticated File Retrieval on Sun Java System Identity Manager "ext" parameter
22/10/2008	Paper-04	SNMP Injection: Achieving Persistent HTML Injection via SNMP on Embedded Devices
09/10/2008	PR07-31	Unauthenticated SQL Injection, XSS and Username Enumeration on DPSnet Case Progress
09/10/2008	PR08-24	Proxim Tsunami MP.11 2411 vulnerable to SNMP Injection
21/08/2008	Paper-03	Bypassing ASP .NET "ValidateRequest" for Script Injection Attacks
21/08/2008	PR08-20	Microsoft ASP.NET ValidateRequest filters can be bypassed allowing XSS and HTML injection attacks
22/07/2008	PR08-13	Persistent Cross-site Scripting (XSS) on Moodle via blog entry title
22/07/2008	PR08-15	Several Webroot Disclosures on Moodle
22/07/2008	PR08-16	CSRF (Cross-site Request Forgery) on Moodle edit profile page
14/07/2008	Paper-02	Auditing mailing scripts for web app pentesters
23/04/2008	PR07-43	Cross-domain redirect on RSA Authentication Agent
23/04/2008	PR07-44	XSS on RSA Authentication Agent login page
13/03/2008	PR08-02	Plone CMS Security Research: CSRF and session management issues
28/02/2008	PR07-41	XSS on Juniper Networks Secure Access 2000
28/02/2008	PR07-42	Webroot disclosure on Juniper Networks Secure Access 2000
20/02/2008	PR08-05	ZyXEL Gateways Vulnerability Research: multiple vulnerabilities including privilege escalation, insecure SNMP permissions, session hijacking, weak authentication and disclosure of credentials
19/02/2008	PR06-12	XSS on BEA Plumtree Foundation and AquaLogic Interaction portals
19/02/2008	PR08-01	Several XSS, a cross-domain redirect and a webroot disclosure on Spyce - Python Server Pages (PSP)
22/01/2008	PR07-38	XSS on sIFR
08/01/2008	PR07-06	HTML Injection on Sun Java System Identity Manager 6.0 /7.x login page "cntry" parameter
08/01/2008	PR07-07	XSS on Sun Java System Identity Manager 6.0/7.x login page "lang" parameter
08/01/2008	PR07-08	XSS on Sun Java System Identity Manager 6.0/7.x "resultsForm" parameter
08/01/2008	PR07-09	XSS on Sun Java System Identity Manager 6.0/7.x "activeControl" parameter
08/01/2008	PR07-10	Frame Injection on Sun Java System Identity Manager 6.0/7.x "helpUrl" parameter
08/01/2008	PR07-12	Cross-domain redirect on Sun Java System Identity Manager 6.0/7.x

2007

05/12/2007	PR07-39	Multiple vulnerabilities on Absolute News Manager.NET 5.1 including file retrieval and SQL injection
30/11/2007	PR07-37	XSS on Apache HTTP Server 413 error pages via malformed HTTP method
28/11/2007	PR07-14	Cross-site Scripting (XSS) / HTML injection on F5 FirePass 4100 SSL VPN 'my.activation.php3' server-side script
28/11/2007	PR07-15	Cross-site Scripting (XSS) / HTML injection on F5 FirePass 4100 SSL VPN 'my.logon.php3' server-side script
26/11/2007	PR06-08	BEA Plumtree portal internal hostname disclosure vulnerability
26/11/2007	PR06-09	BEA Plumtree portal full version disclosure vulnerability
26/11/2007	PR06-11	BEA Plumtree portal search facility leaks usernames to unauthenticated users
15/11/2007	PR07-02	XSS on Liferay Portal Enterprise 4.1.1 login page ('login' parameter)
15/11/2007	PR07-26	Persistent XSS on Aruba 800 Mobility Controller's login page
27/09/2007	PR07-24, 25, 28	Owning Big Brother: Multiple vulnerabilities on Axis 2100 IP cameras
07/09/2007	PR07-13	Cross-site Scripting / HTML injection on F5 FirePass 4100 SSL VPN 'download_plugin.php3' server-side script
29/08/2007	PR07-23	Non-persistent Cross-site Scripting (XSS) on Absolute Poll Manager XE admin page
24/07/2007	PR07-18	Cross-site Scripting (XSS) / HTML injection on Webbler CMS admin login page (1)
24/07/2007	PR07-19	Cross-site Scripting (XSS) / HTML injection on Webbler CMS admin login page (2)
24/07/2007	PR07-20	Webroot disclosure on Webbler CMS
24/07/2007	PR07-21	Webbler CMS forms are susceptible to spamming and phishing abuses
05/04/2007	PR07-03	Microsoft ASP.NET request filtering can be bypassed allowing XSS and HTML injection attacks
22/01/2007	PR06-14	IP Phones based on Centrality Communications/Aredfox PA168 chipset weak session management vulnerability

2006

07/11/2006	PR05-06	Immediacy .NET CMS possibly vulnerable to Cross Site Scripting through a malformed cookie
31/10/2006	PR05-04	Cross Site Scripting Vulnerability In IBM Websphere
20/10/2006	Paper-01	Security implications of failing to correctly use filtering in .NET web applications
27/09/2006	PR06-03b	F5 Firepass 1000 SSL VPN version 5.5 vulnerable to Cross-Site Scripting
25/05/2006	PR06-01	SiteScape Forum webroot disclosure
25/05/2006	PR06-02	SiteScape Forum username enumeration

2005

09/11/2005	PR05-11	Mambo CMS vulnerable to a remote file downloading attack
01/11/2005	PR04-12	Ringtail Casebook 6.1.0 Cross-Site Scripting vulnerability
01/11/2005	PR04-13	Ringtail Casebook 6.1.0 Information Disclosure vulnerability

2004

03/11/2004	PR04-08	MailPost vulnerable file system information disclosure via HTTP GET request
03/11/2004	PR04-09	MailPost discloses sensitive system information when operating in debug mode
03/11/2004	PR04-10	MailPost vulnerable to cross-site scripting in the 'append' variable passed to the file as part of an HTTP GET request
03/11/2004	PR04-11	MailPost vulnerable to cross-site scripting via an executable requested with a trailing slash appended to the filename
14/01/2004	PR03-07	Whale Communications e-Gap security appliance discloses source code via HTTP TRACE Method

2003

07/10/2003	PR03-02	Hummingbird CyberDOCS sets insecure permissions on script source code files
07/10/2003	PR03-03	Hummingbird CyberDOCS error page discloses web server installation path
07/10/2003	PR03-04	Hummingbird CyberDOCS vulnerable to SQL injection
07/10/2003	PR03-05	Hummingbird CyberDOCS contains multiple cross-site scripting vulnerabilities
13/05/2003	PR03-01	Phorum Download File Disclosure Vulnerability (BID 7569)
13/05/2003	PR03-01-10	Phorum Register.PHP Connection Proxying Vulnerability (BID 7581)
13/05/2003	PR03-01-11	Phorum Login.PHP Connection Proxying Vulnerability (BID 7583)
13/05/2003	PR03-01-12	Phorum Register.PHP Existing User HTML Injection Vulnerability (BID 7584)
13/05/2003	PR03-01-2	Phorum Multiple Path Disclosure Vulnerabilities (BID 7571)
13/05/2003	PR03-01-3	Phorum Register.PHP Cross-Site Scripting Vulnerability (BID 7572)
13/05/2003	PR03-01-4	Phorum Post.PHP Cross-Site Scripting Vulnerability (BID 7573)
13/05/2003	PR03-01-5	Phorum Edit User Profile Arbitrary Command Execution Vulnerability (BID 7574)
13/05/2003	PR03-01-6	Phorum Common.PHP Cross-Site Scripting Vulnerability (BID 7576)
13/05/2003	PR03-01-7	Phorum login.PHP Cross Site Scripting Vulnerability (BID 7577)
13/05/2003	PR03-01-8	Phorum UserAdmin Arbitrary Command Execution Vulnerability (BID 7578)
13/05/2003	PR03-01-9	Phorum Stats Program Arbitrary Command Execution Vulnerability (BID 7579)

2002

17/12/2002	PR02-13	GoAhead Web Server discloses source code of ASP files via crafted URL
04/12/2002	PR02-15	Netscape Enterprise Server Manager web log viewer delayed JavaScript execution
29/05/2002	PR02-01	Novell NetWare default installation contains sample files that disclose sensitive server information
29/05/2002	PR02-03	Novell NetWare default installation contains sample files that disclose sensitive server information
29/05/2002	PR02-05	Apache Tomcat default installation contains sample files that disclose sensitive server information
29/05/2002	PR02-06	Apache Tomcat default installation contains sample files that disclose sensitive server information
29/05/2002	PR02-07	Apache Tomcat default installation contains sample files that disclose sensitive server information
15/03/2002	PR02-08	XDMCP allows remote control access
08/01/2002	PR01-04	Netscape ?wp-html-rend denial of service attack
08/01/2002	PR01-05	Netscape publishing wp-force-auth command

2001

20/11/2001	PR01-03	Linux-Mandrake Apache default configuration enables directory browsing
20/11/2001	PR01-06	Linux-Mandrake Apache default configuration enables management interface on 8200/tcp
20/11/2001	PR01-07	Linux-Mandrake Apache default configuration sample programs disclose server information
22/10/2001	PR01-01	Unicode directory transversal in RSA SecurID WebID
22/10/2001	PR01-02	Debug mode flaw in RSA SecurID WebID