Sonicwall Scrutinizer vulnerabilities
7 known vulnerabilities affecting sonicwall/scrutinizer.
Total CVEs
7
CISA KEV
0
Public exploits
6
Exploited in wild
1
Severity breakdown
CRITICAL1HIGH1MEDIUM5
Vulnerabilities
Page 1 of 1
CVE-2012-2626P2MEDIUMCVSS 5.0ExploitedPoCfixed in 9.5.02012-07-31
CVE-2012-2626 [MEDIUM] CWE-287 CVE-2012-2626: cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9
cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 does not require token authentication, which allows remote attackers to add administrative accounts via a userprefs action.
nvd
CVE-2012-3951P2HIGHCVSS 7.5PoC≤ 9.0.1.198992012-07-31
CVE-2012-3951 [HIGH] CWE-89 CVE-2012-3951: The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier h
The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default password of admin for the (1) scrutinizer and (2) scrutremote accounts, which allows remote attackers to execute arbitrary SQL commands via a TCP session.
nvd
CVE-2014-4977P2MEDIUMCVSS 6.5PoCv11.0.12014-07-16
CVE-2014-4977 [MEDIUM] CWE-89 CVE-2014-4977: Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticat
Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) selectedUserGroup parameter in a create new user request to cgi-bin/admin.cgi or the (2) user_id parameter in the changeUnit function, (3) methodDetail parameter in the methodDetail function, or (4)
nvd
CVE-2012-2962P3MEDIUMCVSS 6.5PoCfixed in 9.5.22012-07-30
CVE-2012-2962 [MEDIUM] CWE-89 CVE-2012-2962: SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scruti
SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2 allows remote authenticated users to execute arbitrary SQL commands via the q parameter.
nvd
CVE-2012-2627P3CRITICALCVSS 9.4PoCfixed in 9.5.02012-07-31
CVE-2012-2627 [CRITICAL] CVE-2012-2627: d4d/uploader.php in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.
d4d/uploader.php in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allows remote attackers to create or overwrite arbitrary files in %PROGRAMFILES%\Scrutinizer\snmp\mibs\ via a multipart/form-data POST request.
nvd
CVE-2012-3848P4MEDIUMCVSS 4.3PoCfixed in 9.5.02012-07-31
CVE-2012-3848 [MEDIUM] CWE-79 CVE-2012-3848: Multiple cross-site scripting (XSS) vulnerabilities in the web console in Plixer Scrutinizer (aka De
Multiple cross-site scripting (XSS) vulnerabilities in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to d4d/exporters.php, (2) the HTTP Referer header to d4d/exporters.php, or (3) unspecified input to d4d/contextMenu.php.
nvd
CVE-2014-4976P4MEDIUMCVSS 5.5v11.0.12014-07-16
CVE-2014-4976 [MEDIUM] CWE-264 CVE-2014-4976: Dell SonicWall Scrutinizer 11.0.1 allows remote authenticated users to change user passwords via the
Dell SonicWall Scrutinizer 11.0.1 allows remote authenticated users to change user passwords via the user ID in the savePrefs parameter in a change password request to cgi-bin/admin.cgi.
nvd