2823 matches found
Smartshop 1 - Cross-Site Request Forgery
Exploit Title: Smartshop 1 - Cross site request forgery Date: 2018-06-02 Exploit Author: L0RD or [email protected] Software Link: https://github.com/smakosh/Smartshop/archive/master.zip Vendor Homepage: https://www.behance.net/gallery/49080415/Smartshop-Free-e-commerce-website Version...
CVE-2018-7950
The iBMC Intelligent Baseboard Management Controller of some Huawei servers have a JSON injection vulnerability due to insufficient input validation. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Successful exploit may allow attackers to...
Input validation
The iBMC Intelligent Baseboard Management Controller of some Huawei servers have a JSON injection vulnerability due to insufficient input validation. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Successful exploit may allow attackers to...
CVE-2018-7951
The CVE-2018-7951 issue affects the iBMC of some Huawei servers. It arises from insufficient input validation and enables an authenticated, remote attacker to perform a JSON injection that can change the administrator password, potentially granting system management privileges. The Huawei advisor...
PHPMyWind 5.5前台存在sql注入，可重置管理员密码
...
D-Link DIR-815 Information Disclosure Vulnerability
D-Link DIR-815 is a wireless router product from AUO D-Link. An information disclosure vulnerability exists in the D-Link DIR-815 with firmware prior to version 2.07.B01, which originates from the program storing the administrative password in plaintext. A remote attacker could exploit this...
CVE-2018-11527
An issue was discovered in CScms v4.1. A Cross-site request forgery CSRF vulnerability in plugins/sys/admin/Sys.php allows remote attackers to change the administrator's username and password via /admin.php/sys/editpasssave...
Huawei 1288H V5 and 2288H V5 JSON Injection Vulnerability (CNVD-2018-10504)
The Huawei 1288H V5 and 2288H V5 are both rackmount server units from Huawei, a Chinese company. A security vulnerability exists in Huawei 1288H V5 and 2288H V5 version V100R005C00, which originates from the program failing to adequately validate input. A remote attacker can exploit the...
Huawei 1288H and 2288H Rack Server JSON Injection Vulnerability
Huawei 1288H V5 and 2288H V5 are both rack routers that can be widely used for cloud virtualization, database, big data and other loads. A JSON injection vulnerability exists in the V100R005C00 software of the Huawei 1288H V5 and 2288H V5. The vulnerability stems from the program failing to...
CVE-2018-7902
Affected products: Huawei 1288H V5 and 288H V5 with software V100R005C00. Vulnerability: JSON injection in iBMC/server component due to insufficient input validation, allowing an authenticated, remote attacker to inject JSON and modify the administrator password, potentially gaining the system ma...
CVE-2013-3018
The AXIS webapp in deploy-tomcat/axis in IBM Tivoli Application Dependency Discovery Manager TADDM 7.1.2 and 7.2.0 through 7.2.1.4 allows remote attackers to obtain sensitive configuration information via a direct request, as demonstrated by happyaxis.jsp. IBM X-Force ID: 84354. Recent assessment...
Design/Logic Flaw
An exploitable clear text transmission of password vulnerability exists in the web server and telnet functionality of Moxa EDR-810 V4.1 build 17030317. An attacker can look at network traffic to get the admin password for the device. The attacker can then use the credentials to login as admin...
CVE-2018-10989
Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices are distributed by some ISPs with a default password of "password" for the admin account that is used over an unencrypted http://192.168.0.1 connection, which might allow remote attackers to bypass intended access restrictions by...
D-Link DIR-868L Cross-Site Request Forgery Vulnerability
D-Link DIR-868L is a wireless router product from AUO D-Link. A cross-site request forgery vulnerability exists in the hedwig.cgi and pigwidgeon.cgi files in the D-Link DIR-868L. A remote attacker can exploit this vulnerability to change the Admin password...
CVE-2018-10957
CSRF exists on D-Link DIR-868L devices, leading to for example a change to the Admin password. hedwig.cgi and pigwidgeon.cgi are two of the affected components...
CVE-2018-10957
CVE-2018-10957 affects the D-Link DIR-868L router. The vulnerability is a CSRF in the affected components hedwig.cgi and pigwidgeon.cgi that can allow a remote attacker to perform actions such as changing the Admin password. Impact is described across multiple sources; no official patch/version i...
PT-2018-3909 · D Link · D-Link Dir-868L
Name of the Vulnerable Software and Affected Versions: D-Link DIR-868L affected versions not specified Description: The issue is related to a CSRF Cross-Site Request Forgery attack, which can be exploited by a remote attacker. This could allow the attacker to perform actions such as changing the...
CVE-2018-10723
Directus 6.4.9 has a hardcoded admin password for the Admin account because of an INSERT statement in api/schema.sql...
