彙總 netsweeper 相關全部產品的 CVE 與安全漏洞情報，包括 CVSS、EPSS、公開時間與漏洞情報資料。
常見弱點模式包括 SQL 注入、路徑處理缺陷、CSRF與開放重定向，在 生產負載與軟體部署 使用場景中可能帶來 工作階段劫持、資料外洩與檔案覆寫 等風險。
相關漏洞資料主要來源於公開漏洞披露與安全公告，可用於評估歷史漏洞暴露面與修補優先順序。
| CVE | 摘要 | 來源 | 最高 CVSS | EPSS % | 公開時間 | 更新時間 |
|---|---|---|---|---|---|---|
| CVE-2020-13167 | Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php (with certain Referer headers) launches a command line with client-supplied parameters, and allows injection of shell metacharacters. | [email protected] | 9.8 | 93.55% | 2020-05-19 | 2024-11-21 |
| CVE-2014-9617 | Open redirect vulnerability in remotereporter/load_logfiles.php in Netsweeper before 4.0.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter. | [email protected] | 6.1 | 26.19% | 2020-02-19 | 2024-11-21 |
| CVE-2014-9615 | Cross-site scripting (XSS) vulnerability in Netsweeper 4.0.4 allows remote attackers to inject arbitrary web script or HTML via the url parameter to webadmin/deny/index.php. | [email protected] | 6.1 | 15.70% | 2020-02-19 | 2024-11-21 |
| CVE-2014-9614 | The Web Panel in Netsweeper before 4.0.5 has a default password of branding for the branding account, which makes it easier for remote attackers to obtain access via a request to webadmin/. | [email protected] | 9.8 | 69.54% | 2020-02-19 | 2024-11-21 |
| CVE-2014-9613 | Multiple SQL injection vulnerabilities in Netsweeper before 2.6.29.10 allow remote attackers to execute arbitrary SQL commands via the (1) login parameter to webadmin/auth/verification.php or (2) dpid parameter to webadmin/deny/index.php. | [email protected] | 9.8 | 5.65% | 2020-02-19 | 2024-11-21 |
| CVE-2014-9612 | SQL injection vulnerability in remotereporter/load_logfiles.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to execute arbitrary SQL commands via the server parameter. | [email protected] | 9.8 | 6.24% | 2020-02-19 | 2024-11-21 |
| CVE-2014-9609 | Directory traversal vulnerability in webadmin/reporter/view_server_log.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to list directory contents via a .. (dot dot) in the log parameter in a stats action. | [email protected] | 5.3 | 31.20% | 2020-02-19 | 2024-11-21 |
| CVE-2014-9608 | Cross-site scripting (XSS) vulnerability in webadmin/policy/group_table_ajax.php/ in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO. | [email protected] | 6.1 | 25.74% | 2020-02-19 | 2024-11-21 |
| CVE-2014-9607 | Cross-site scripting (XSS) vulnerability in remotereporter/load_logfiles.php in Netsweeper 4.0.3 and 4.0.4 allows remote attackers to inject arbitrary web script or HTML via the url parameter. | [email protected] | 6.1 | 8.96% | 2020-02-19 | 2024-11-21 |
| CVE-2014-9606 | Multiple cross-site scripting (XSS) vulnerabilities in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) server parameter to remotereporter/load_logfiles.php, (2) customctid parameter to webadmin/policy/category_table_ajax.php, (3) urllist parameter to webadmin/alert/alert.php, (4) QUERY_STRING to webadmin/ajaxfilemanager/ajax_get_file_listing.php, or (5) PATH_INFO to webadmin/policy/policy_table_ajax.ph | [email protected] | 6.1 | 9.41% | 2020-02-19 | 2024-11-21 |
| CVE-2014-9619 | Unrestricted file upload vulnerability in webadmin/ajaxfilemanager/ajaxfilemanager.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote authenticated users with admin privileges on the Cloud Manager web console to execute arbitrary PHP code by uploading a file with a double extension, then accessing it via a direct request to the file in webadmin/deny/images/, as demonstrated by secuid0.php.gif. | [email protected] | 7.2 | 6.46% | 2017-09-19 | 2026-05-13 |
| CVE-2014-9618 | The Client Filter Admin portal in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and subsequently create arbitrary profiles via a showdeny action to the default URL. | [email protected] | 9.8 | 68.17% | 2017-09-19 | 2026-05-13 |
| CVE-2014-9616 | Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to obtain sensitive information by making a request that redirects to the deny page. | [email protected] | 7.5 | 0.32% | 2017-09-19 | 2026-05-13 |
| CVE-2014-9611 | Netsweeper before 4.0.5 allows remote attackers to bypass authentication and create arbitrary accounts and policies via a request to webadmin/nslam/index.php. | [email protected] | 9.8 | 28.62% | 2017-09-19 | 2026-05-13 |
| CVE-2014-9610 | Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and remove IP addresses from the quarantine via the ip parameter to webadmin/user/quarantine_disable.php. | [email protected] | 5.3 | 13.36% | 2017-09-19 | 2026-05-13 |
| CVE-2014-9605 | WebUpgrade in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and create a system backup tarball, restart the server, or stop the filters on the server via a ' (single quote) character in the login and password parameters to webupgrade/webupgrade.php. NOTE: this was originally reported as an SQL injection vulnerability, but this may be inaccurate. | [email protected] | 9.4 | 8.69% | 2015-09-04 | 2026-05-06 |
| CVE-2012-3859 | Unspecified vulnerability in the WebAdmin Portal in Netsweeper has unknown impact and attack vectors, a different vulnerability than CVE-2012-2446 and CVE-2012-2447. | [email protected] | 10.0 | 7.43% | 2012-07-09 | 2026-04-29 |
| CVE-2012-2447 | Cross-site request forgery (CSRF) vulnerability in accountmgr/adminupdate.php in the WebAdmin Portal in Netsweeper allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts via an add action. | [email protected] | 6.8 | 0.11% | 2012-07-09 | 2026-04-29 |
| CVE-2012-2446 | Cross-site scripting (XSS) vulnerability in tools/local_lookup.php in the WebAdmin Portal in Netsweeper allows remote attackers to inject arbitrary web script or HTML via the group parameter in a lookup action. | [email protected] | 4.3 | 0.31% | 2012-07-09 | 2026-04-29 |