CVE-2017-11634

The CVE-2017-11634 issue affects Wireless IP Camera 360 devices. Remote attackers can read a weakly encoded admin password by connecting to TCP port 9527 and inspecting the debugging information; for example, nTBCS19C corresponds to the password 123456. The vulnerability has a high/critical impac...

CVE-2017-11634

An issue was discovered on Wireless IP Camera 360 devices. Remote attackers can discover a weakly encoded admin password by connecting to TCP port 9527 and reading the password field of the debugging information, e.g., nTBCS19C corresponds to a password of 123456...

TrendNET Router Device Information Disclosure Vulnerability

TEW-751DR\TEW-752DRU\TEW-733GR is a router product from TrendNET Trends. An information disclosure vulnerability exists in TrendNET router devices, which can be exploited by an attacker to obtain the admin user password without logging in...

NoneCms Cross-Site Request Forgery Vulnerability

NoneCms is a simple and compact open-source content management system that can be used to quickly build corporate sites, personal blogs, and support mobile. A cross-site request forgery vulnerability exists in application/admin/controller/Admin.php in NoneCms 1.3.0. Attackers can use this...

CVE-2018-7219

application/admin/controller/Admin.php in NoneCms 1.3.0 has CSRF, as demonstrated by changing an admin password or adding an account via a public/index.php/admin/admin/edit.html request...

Cross site request forgery (csrf)

application/admin/controller/Admin.php in NoneCms 1.3.0 has CSRF, as demonstrated by changing an admin password or adding an account via a public/index.php/admin/admin/edit.html request...

Code injection

A vulnerability in the web interface of Cisco RV132W ADSL2+ Wireless-N VPN Routers and Cisco RV134W VDSL2 Wireless-AC VPN Routers could allow an unauthenticated, remote attacker to view configuration parameters for an affected device, which could lead to the disclosure of confidential information...

CVE-2018-6408

An issue was discovered on Conceptronic CIPCAMPTIWL V3 0.61.30.21 devices. CSRF exists in hy-cgi/user.cgi, as demonstrated by changing an administrator password or adding a new administrator account...

CVE-2018-5976

Cross Site Request Forgery CSRF exists in RSVP Invitation Online 1.0 via function/account.php, as demonstrated by modifying the admin password...

Cross site request forgery (csrf)

Cross Site Request Forgery CSRF exists in RSVP Invitation Online 1.0 via function/account.php, as demonstrated by modifying the admin password...

CVE-2018-5976

Cross Site Request Forgery CSRF exists in RSVP Invitation Online 1.0 via function/account.php, as demonstrated by modifying the admin password...

RSVP Invitation Online 1.0 - Cross-Site Request Forgery (Update Admin) Vulnerability

Exploit for php platform in category web applications 0day.today 2018-03-17...

Asus Unauthenticated LAN Remote Command Execution

Vulnerabilities Summary The following advisory describes two 2 vulnerabilities found in AsusWRT Version 3.0.0.4.380.7743. The combination of the vulnerabilities leads to LAN remote command execution on any Asus router. AsusWRT is “THE POWERFUL USER-FRIENDLY INTERFACE – The enhanced ASUSWRT...

RSVP Invitation Online 1.0 - Cross-Site Request Forgery (Update Admin)

...

CVE-2018-6000

An issue was discovered in AsusWRT before 3.0.0.4.38410007. The dovpnuploadpost function in router/httpd/web.c in vpnupload.cgi provides functionality for setting NVRAM configuration values, which allows attackers to set the admin password and launch an SSH daemon or enable infosvr command mode,...

AsusWRT Router < 3.0.0.4.380.7743 - LAN Remote Code Execution

Unauthenticated LAN remote code execution in AsusWRT Discovered by Pedro Ribeiro [email protected], Agile Information Security ================================================================================= Disclosure: 22/01/2018 / Last updated: 25/01/2018 Background and summary AsusWRT is the...

YzmCMS_v3.6 Arbitrary File Deletion Vulnerability

YzmCMS is a lightweight and open source content management system based on PHP+Mysql architecture, running on Linux, Windows, MacOSX, Solaris and other platforms. YzmCMSv3.6 has an arbitrary file deletion vulnerability. Attackers by cracking the background default account password , construct URL...

CVE-2014-5334

FreeNAS before 9.3-M3 has a blank admin password, which allows remote attackers to gain root privileges by leveraging a WebGui login...

CVE-2014-5334

CVE-2014-5334 affects FreeNAS prior to 9.3-M3, where the WebGUI can be accessed with a blank admin password. This allows remote attackers to gain root privileges via the WebGUI login. The description explicitly states the administrator password may be blank, enabling web-based authentication bypa...

CVE-2017-15112

In keycloak-http-client-install prior to version 0.8, the admin password could be provided through a command-line argument. This might result in the password being leaked through shell history, or becoming visible to a local attacker at the time the program is running...