2018 matches found
WeiPHP version 3.0 suffers from information leakage vulnerability
WeiPHP is an open source WeChat public platform development framework to build a personal WeChat public account operation platform. WeiPHP 3.0 version of the information leakage vulnerability, WeiPHP 3.0 installation will generate log files, background account passwords stored in plaintext form i...
Ubiquiti Inc.: Code Execution in restricted CLI of EdgeSwitch
In EdgeSwitch 1.7.3 and prior, an user with admin credentials can make use of specially crafted commands to execute arbitrary shell instructions, bypassing the SSH/TELNET CLI interface. A command injection vulnerability existed in the restricted CLI of the EdgeSwitch. Exploiting this vulnerabilit...
Conceptronic CIPCAMPTIWL Cross-Site Request Forgery Vulnerability
Conceptronic CIPCAMPTIWL is a wireless network camera product from Conceptronic Germany. A cross-site request forgery vulnerability exists in the hy-cgi/user.cgi file in Conceptronic CIPCAMPTIWL version 3 0.61.30.21. A remote attacker could exploit this vulnerability to change the administrator...
PACSOne Server 6.6.2 DICOM Web Viewer - Directory Trasversal
Exploit Title: PACSOne Server 6.6.2 DICOM Web Viewer Directory Trasversal / Local File Inclusion Date: 08/14/2017 Software Link: http://www.pacsone.net/download.htm Google Dork: inurl:pacs/login.php inurl:pacsone/login.php inurl:pacsone filetype:php home inurl:pacsone filetype:php login Version:...
ManageEngine EventLog Analyzer - Multiple Vulnerabilities (2)
Exploit for multiple platform in category web applications Multiple vulnerabilities in ManageEngine EventLog Analyzer Discovered by Pedro Ribeiro email protected, Agile Information Security ========================================================================== Disclosure: 05/11/2014 / Last...
Ubiquiti Inc.: Unrestricted File System Access via Twig Template Injection on dev-ucrm-billing-demo.ubnt.com
The researcher found a Local File inclusion vulnerability, this could be exploited by using Twig templates available on the system. This vulnerability only have the potential to affect dev-ucrm-billing-demo.ubnt.com, although is limited by the restricted environment docker with don't allow any...
CVE-2017-3186
ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC use non-random default credentials across all devices. A remote attacker can take complete control of a device using default admin credentials...
Shenzhen Jixiang Tengda Technology Co., Ltd. enterprise router with override access vulnerability
Shenzhen Jixiang Tengda Technology Co., Ltd. is a high-tech enterprise integrating independent research and development, production and sales of network equipment. Shenzhen Jixiang Tengda Technology Co., Ltd. enterprise router has an overstepping access vulnerability. Attackers can use this...
CVE-2017-12351
A vulnerability in the guest shell feature of Cisco NX-OS System Software could allow an authenticated, local attacker to read and send packets outside the scope of the guest shell container. An attacker would need valid administrator credentials to perform this attack. The vulnerability is due t...
EMC Unisphere For VMAX vApp Manager ORBServlet Remote Credential Creation Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of EMC Unisphere For VMAX vApp Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ORBServlet. The vulnerability is caused by improper...
pfSense Default Admin Credentials (HTTP)
In pfSense it is possible to gain administrative access via default credentials. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
D-Link DIR Router Authenication Bypass
The remote D-Link DIR router does not properly enforce authentication when a remote user makes a crafted POST request to getcfg.php or version.php. An attacker can use this weakness to recover the administrator username and password. C Tenable Network Security, Inc. include"compat.inc"; if...
Complain Management System - Hard-Coded Credentials / Blind SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title : Complain Management System Blind SQL Injection Date: 10 October 2017 Exploit Author: havysec Tested on: ubuntu14.04 Vendor: https://sourceforge.net/projects/complain-management-system/ Version: not supplied Download Software:...
Unauthorized Access Vulnerability in Shenzhen Yellow River Digital Histream Product Network Camera
Histream Network Camera provides customers with complete network video surveillance products and total solutions. Shenzhen Yellow River digital Histream products network camera has unauthorized access vulnerability, attackers can use the vulnerability to directly obtain the management user name a...
Technicolor TC7337 - SSID Persistent Cross-Site Scripting Vulnerability
Exploit for php platform in category web applications // Device : Technicolor TC7337 // Vulnerable URL : https://your.rou.ter.ip/wlscanresults.html // XSS through SSID : ' Exactly 32 bytes uu // ^ // 5char domains are running | 'src' does not requires quotes , and passing the URL with ony '//' //...
Fusion K2 Wireless Router Has Logic Flaw Vulnerability
Fusion Route Android app is an app for managing Fusion routers. A logic flaw vulnerability exists in the Fusion K2 wireless router. An attacker can exploit this vulnerability to obtain the router administrator username and password in the unlogged-in state and then take control of the router...
CVE-2017-6709
A vulnerability in the AutoVNF tool for the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to access administrative credentials for Cisco Elastic Services Controller ESC and Cisco OpenStack deployments in an affected system. The vulnerability exists because the...
Foscam camera ONVIF GetStreamUri administrator credentials disclosure vulnerability
Foscam camera is a webcam that pushes messages to your phone and also enables video Baidu cloud storage directly through WIFI. Foscam camera ONVIF GetStreamUri has an administrator credential disclosure vulnerability that allows an unauthenticated attacker to extract the administrator username an...
WordPress FTP/SSH Forms Function Cross-Site Request Forgery Vulnerability
WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in the WordPress FTP/SSH forms feature. The vulnerability can be used to...