CVEvulnerability
CVE-2015-6004
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2015-12-27
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 6.5 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-89
Description
Multiple SQL injection vulnerabilities in IPSwitch WhatsUp Gold before 16.4 allow remote attackers to execute arbitrary SQL commands via (1) the UniqueID (aka sUniqueID) parameter to WrFreeFormText.asp in the Reports component or (2) the Find Device parameter.
Affected configurations
• progress whatsup gold (<= 16.3)
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- http://twitter.com/ipswitch/statuses/677558623229317121 Vendor Advisory
- http://www.securityfocus.com/bid/79506 www.securityfocus.com
- http://www.securitytracker.com/id/1034833 www.securitytracker.com
- https://community.rapid7.com/community/infosec/blog/2015/12/16/multiple-disclosures-for-multiple-network-management-systems Exploit
- https://www.kb.cert.org/vuls/id/176160 Third Party Advisory, US Government Resource
- http://twitter.com/ipswitch/statuses/677558623229317121 Vendor Advisory
- http://www.securityfocus.com/bid/79506 www.securityfocus.com
- http://www.securitytracker.com/id/1034833 www.securitytracker.com
- https://community.rapid7.com/community/infosec/blog/2015/12/16/multiple-disclosures-for-multiple-network-management-systems Exploit
- https://www.kb.cert.org/vuls/id/176160 Third Party Advisory, US Government Resource