Belkin Router N150 1.00.08, 1.00.09 - Path Traversal Vulnerability

Exploit for hardware platform in category web applications Title: Path Traversal Vulnerability Product: Belkin Router N150 Author: Rahul Pratap Singh Website: https://0x62626262.wordpress.com Contact: Linkedin: https://in.linkedin.com/in/rahulpratapsingh94 Twitter: @0x62626262 Vendor Homepage:...

Endian Firewall Proxy Password Change Command Execution (CVE-2015-5082)

A command injection vulnerability has been reported in Endian Firewall. The vulnerability is due to an input validation error in a CGI script. A remote, authenticated attacker can exploit this vulnerability by sending crafted HTTP requests to the target. Successful exploitation could lead to remo...

X_CART Shopping Cart Version Detection

Detects the installed version of XCART Shopping Cart. This script sends an HTTP GET request and tries to get the version from the response. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

PT-2015-3057

Name of the Vulnerable Software and Affected Versions Endian Firewall versions prior to 3.0 Description The issue is related to the lack of input validation in the Endian Firewall. It allows a remote attacker to execute arbitrary commands by passing metacharacters through the NEW PASSWORD 1 or NE...

NetScaler Gateway Stuck at cgi/setclient After Log On

NetScaler Gateway stuck at cgi/setclient after log on...

Web Application Scanning Consolidation / Info Reporting

The script consolidates and reports various information for web application formerly called SPDX-FileCopyrightText: 2015 SCHUTZWERK GmbH SPDX-FileCopyrightText: New / improved code since 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by...

Synology Video Station 1.5-0757 Command Injection / SQL Injection

------------------------------------------------------------------------ Synology Video Station command injection and multiple SQL injection vulnerabilities ------------------------------------------------------------------------ Han Sahin, September 2015...

Synology Video Station 1.5-0757 - Multiple Vulnerabilities

Synology Video Station 1.5-0757 - Multiple Vulnerabilities ------------------------------------------------------------------------ Synology Video Station command injection and multiple SQL injection vulnerabilities ------------------------------------------------------------------------ Han Sahi...

Synology Video Station 1.5-0757 - Multiple Vulnerabilities

------------------------------------------------------------------------ Synology Video Station command injection and multiple SQL injection vulnerabilities ------------------------------------------------------------------------ Han Sahin, September 2015...

Amazon Linux: Security Advisory (ALAS-2011-5)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Amazon Linux: Security Advisory (ALAS-2015-474)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Endian Firewall Proxy Password Change Command Injection

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit4 'Endian Firewall Proxy Password Change Command Injection', 'Description' = %q This module exploits an OS command injection...

Endian Firewall Proxy Password Change Command Injection Exploit

This Metasploit module exploits an OS command injection vulnerability in a web-accessible CGI script used to change passwords for locally-defined proxy user accounts. Valid credentials for such an account are required. Command execution will be in the context of the "nobody" account, but this...

Extmail /cgi/env.cgi 信息泄露

Extmail /cgi/env.cgi 敏感信息泄露POC:http://xxx.com/extmail/cgi/env.cgi...

Endian Firewall - Password Change Command Injection (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit4 'Endian Firewall Proxy Password Change Command Injection', 'Description' = %q This module exploits an OS command injection...

Star-net SVG6000 /cgi-bin/Form_AddPlusUser 安全模式绕过

No description provided by source...

CVE-2014-6616

Cross-site scripting XSS vulnerability in Softing FG-100 PROFIBUS Single Channel FG-100-PB with firmware FG-x00-PBV2.02.0.00 allows remote attackers to inject arbitrary web script or HTML via the DEVICENAME parameter to cgi-bin/CFGhttp/...

PT-2015-3910

Name of the Vulnerable Software and Affected Versions Softing FG-100 PROFIBUS Single Channel FG-100-PB with firmware FG-x00-PB V2.02.0.00 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the DEVICE NAME parameter to the...

CVE-2014-6616: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Softing FG-100 PROFIBUS Single Channel FG-100-PB with firmware FG-x00-PBV2.02.0.00 allows remote attackers to inject arbitrary web script or HTML via the DEVICENAME parameter to cgi-bin/CFGhttp/...

Edimax PS-1206MF - Web Admin Auth Bypass Vulnerability

Exploit for hardware platform in category web applications Title: Edimax PS-1206MF - Web Admin Auth Bypass Date: 30.08.15 Vendor: edimax.com Firmware version: 4.8.25 Author: Smash Contact: smash at devilteam.pl HTTP authorization is not being properly verified while sendind POST requests to .cgi,...