source: https://www.securityfocus.com/bid/57949/info The Dell SonicWALL Scrutinizer is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible. Dell SonicWALL Scrutinizer 10.1.0 and prior versions are vulnerable. Alarm > New Board & Policy Manager - [BBSearchText] Search item Review: Dashboard > Flow Expert > Mytab - [Mytab Name]
Flow Expert Configure Flow Analytics CrossCheckExample Cisco PfRTraining <[PERSISTENT INJECTED SCRIPT CODE!]">%20%20%20%20"><[PERSISTENT INJECTED SCRIPT CODE!]") < Add a tab
MyView (CGI) > Value - [newName] {"newName":"<[PERSISTENT INJECTED SCRIPT CODE!]"> \"><[PERSISTENT INJECTED SCRIPT CODE!]") <"} Review: Admin > Admin > New Users & New Group - [groupname, up_availGroups & username - Place in Usergroup - Listing]
User Preferences
New User

​​​​​

Users

admin

Admin > Admin > Mapping/Maps (CGI) - Dashboard Status - [groupMembers, Type, Checkbox Linklike, indexColumn,name,ObjectName & settings groups]
Group NameTypeMembershipMap Status
GoogleMembership
​​​​​
Type​​​​​ ​​​​​
Map TypeBackground
Google-
Object Name TypeMembership
GroupMembership​​​​​