Default credentials

Bludit prior to 3.9.1 allows a non-privileged user to change the password of any account, including admin. This occurs because of bl-kernel/admin/controllers/user-password.php Insecure Direct Object Reference a modified username POST parameter...

NUUO NVRMini 2 3.9.1 - 'sscanf' Stack Overflow

!/usr/bin/python Exploit Title: NUUO NVRMini2 3.9.1 'sscanf' stack overflow Google Dork: n/a Date: Advisory Published: Nov 18 Exploit Author: @0x00string Vendor Homepage: nuuo.com Software Link: https://www.nuuo.com/ProductNode.php?node=2 Version: 3.9.1 and prior Tested on: 3.9.1 CVE :...

Hardcoded credentials

VVX products with software versions including and prior to, UCS 5.9.2 with Better Together over Ethernet Connector BToE application 3.9.1, use hard-coded credentials to establish connections between the host application and the device...

Joomla! cross-site scripting vulnerability (CNVD-2019-14557)

Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. A cross-site scripting vulnerability exists in modbanners in Joomla! versions 2.5...

Joomla! cross-site scripting vulnerability (CNVD-2019-14554)

Joomla! is a globally recognized content management system developed using PHP language and MySQL database, which can be implemented on various platforms such as Linux, Windows, MacOSX and so on. A cross-site scripting vulnerability exists in comcontact in Joomla! versions 2.5.0 through 3.9.1,...

CVE-2018-19864

NUUO NVRmini2 Network Video Recorder firmware through 3.9.1 allows remote attackers to execute arbitrary code or cause a denial of service buffer overflow, resulting in ability to read camera feeds or reconfigure the device...

NUUO NVRMini2 3.9.1 - Authenticated Command Injection Exploit

Exploit for php platform in category web applications Exploit Title: NUUO NVRMini2 Authenticated Command Injection Exploit Author: Artem Metla Vendor Homepage: https://www.nuuo.com/ProductNode.php?node=2 Version: 3.9.1 Tested on: NUUO NVRMini2 with firmware 3.9.1 CVE : CVE-2018-15716 Advisory:...

NUUO NVRMini2 3.9.1 - (Authenticated) Command Injection

NUUO NVRMini2 3.9.1 - Authenticated Command Injection Exploit Title: NUUO NVRMini2 Authenticated Command Injection Date: December 3, 2018 Exploit Author: Artem Metla Vendor Homepage: https://www.nuuo.com/ProductNode.php?node=2 Version: 3.9.1 Tested on: NUUO NVRMini2 with firmware 3.9.1 CVE :...

Command injection

NUUO NVRMini2 version 3.9.1 is vulnerable to authenticated remote command injection. An attacker can send crafted requests to upgradehandle.php to execute OS commands as root...

NUUO NVR < 3.9.1 Multiple Vulnerabilities

NUUO Network Video Recorder NVR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nuuo:nuuo";...

XSS in review file paths

We have identified a XSS vulnerability introduced in Crucible 3.9.0. Fix was included in 3.9.1 version released publicly on September 10th, 2015...

WordPress 3.6 - 3.9.1 XXE in GetID3 Library

...

WordPress 3.0 - 3.9.1 Authenticated Cross-Site Scripting (XSS) in Multisite

...

WordPress 3.9 & 3.9.1 Unlikely Code Execution

...

Multiple WordPress Plugins (TimThumb 2.8.13 / WordThumb 1.07) - 'WebShot' Remote Code Execution

| | / | \ | |/ |/ | / | | | | | | | | | | | | | / \ | | | || || | |\ | || | | / | | |/|| ||// \| Wordpress TimThumb 2.8.13 WebShot Remote Code Execution 0-day Affected website : a lot Wordpress Themes, Plugins, 3rd party components Exploit Author : @u0x Pichaya Morimoto Release dates :...

Wordpress 3.9.1 - CSRF Vulnerability

Exploit for php platform in category web applications EXPLOIT TITLE:Wordpress 3.9.1-CSRF vulnerability DATE:21st June,2014 Author:Avinash Kumar Thapa URL: localhost/wordpress/ PATCH/FIX:Not fixed yet. Technical Details: This is the new version released by Wordpress. version is 3.9.1Latest Cross...

Updated wordpress package fixes multiple vulnerabilities

Updated wordpress package fixes security vulnerabilities: WordPress before 3.7.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php CVE-2014-0165. The wpvalidateauthcookie...

CVE-2011-3283

Cisco Carrier Routing System 3.9.1 is affected by a vulnerability that allows remote attackers to cause a denial of service (Metro subsystem crash) through a fragmented GRE packet (Bug ID CSCts14887). The available sources specify the affected product and version and the attack vector as network-...

Cisco Security Advisory: Cisco XR 12000 Series Shared Port Adapters Interface Processor Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco Security Advisory: Cisco XR 12000 Series Shared Port Adapters Interface Processor Vulnerability Advisory ID: cisco-sa-20110525-iosxrspa Revision 1.0 For Public Release 2011 May 25 1600 UTC GMT...

CVE-2005-1278

The isisprint function, as called by isoclnsprint, in tcpdump 3.9.1 and earlier allows remote attackers to cause a denial of service infinite loop via a zero length, as demonstrated using a GRE packet...