Mailcow 0.14 - Cross-Site Request Forgery Vulnerability

Exploit for php platform in category web applications + Credits: John Page a.k.a hyp3rlinx Vendor: ============= mailcow.email mailcow.github.io Product: =========== The integrated mailcow UI allows administrative work on your mail server instance as well as separated domain administrator and...

CVE-2017-8050

Tenable Appliance 4.4.0, and possibly prior, contains a flaw in the Web UI that allows for the unauthorized manipulation of the admin password...

Design/Logic Flaw

Tenable Appliance 4.4.0, and possibly prior, contains a flaw in the Web UI that allows for the unauthorized manipulation of the admin password...

CVE-2017-8050

Tenable Appliance 4.4.0, and possibly prior, contains a flaw in the Web UI that allows for the unauthorized manipulation of the admin password...

Trend Micro Threat Discovery Appliance admin_sys_time.cgi Remote Command Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Trend Micro Threat Discovery Appliance adminsystime.cgi Remote Command Execution', 'Description' = %q This module exploits two...

Unauthorized Access Vulnerability in MyPower-WNC6600 Series Wireless Controller

WNC6600 series is a new generation of wireless controller Access Controller -AC independently developed by Mapletree Technology Co. The wireless controller can centrally manage Fit APs and wireless clients. Unauthorized access vulnerability exists in MyPower-WNC6600 series wireless controllers,...

Trend Micro Threat Discovery Appliance remote code execution（CVE-2016-7547）

A command injection in the adminsystime. the cgi interface that allows for an attacker to gain remote code execution CVE-2016-7547. Vulnerability linkage: https://www.seebug.org/vuldb/ssvid-92938 This module requires Metasploit: http://metasploit.com/download Current source:...

CVE-2016-5066

Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 have weak passwords for admin, rauser, sconsole, and user...

Default credentials

TRENDnet WiFi Baby Cam TV-IP743SIC has a password of admin for the backdoor root account...

Default credentials

iBaby M3S has a password of admin for the backdoor admin account...

CVE-2015-2880

CVE-2015-2880 affects the TRENDnet WiFi Baby Cam TV-IP743SIC. A backdoor root account exists with the password admin, enabling privilege acquisition on a networked device. NVD metrics: CVSSv3 base score 8.8 (HIGH), vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; CVSSv2 base 9.0 (HIGH). Public source...

Trend Micro Threat Discovery Appliance admin_sys_time.cgi Remote Command Execution

This module exploits two vulnerabilities the Trend Micro Threat Discovery Appliance. The first is an authentication bypass vulnerability via a file delete in logoff.cgi which resets the admin password back to 'admin' upon a reboot CVE-2016-7552. The second is a cmdi flaw using the timezone...

D-Link DIR 615 HW Cross-Site Request Forgery Vulnerability

D-Link DIR 615 is a wireless router product from AUO D-Link. A cross-site request forgery vulnerability exists in the D-Link DIR 615 HW: T1 router using firmware prior to version 20.09. A remote attacker can send a specially crafted request to exploit this vulnerability to change the administrato...

Apache Ambari Information Disclosure Vulnerability (CNVD-2017-04734)

Apache Ambari is a set of tools for configuring, managing and monitoring Apache Hadoop clusters from the Apache Apache Software Foundation, USA. The tool supports visualization and analysis of job and task execution, support for system alerts, and more. A security vulnerability exists in Apache...

CVE-2017-6803

Multiple cross-site request forgery CSRF vulnerabilities in the web interface in the Scheduler in SolarWinds formerly Serv-U FTP Voyager 16.2.0 allow remote attackers to hijack the authentication of users for requests that 1 change the admin password, 2 terminate the scheduler, or 3 possibly...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the web interface in the Scheduler in SolarWinds formerly Serv-U FTP Voyager 16.2.0 allow remote attackers to hijack the authentication of users for requests that 1 change the admin password, 2 terminate the scheduler, or 3 possibly...

FTP Voyager Scheduler 16.2.0 - Cross-Site Request Forgery Vulnerability

Exploit for php platform in category web applications !-- + Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/FTP-VOYAGER-SCHEDULER-CSRF-REMOTE-CMD-EXECUTION.txt + ISR: ApparitionSec Vendor: ============== solarwinds.com...

CVE-2017-5633

Multiple cross-site request forgery CSRF vulnerabilities on the D-Link DI-524 Wireless Router with firmware 9.01 allow remote attackers to 1 change the admin password, 2 reboot the device, or 3 possibly have unspecified other impact via crafted requests to CGI programs...

CVE-2017-5633

Multiple cross-site request forgery CSRF vulnerabilities on the D-Link DI-524 Wireless Router with firmware 9.01 allow remote attackers to 1 change the admin password, 2 reboot the device, or 3 possibly have unspecified other impact via crafted requests to CGI programs...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities on the D-Link DI-524 Wireless Router with firmware 9.01 allow remote attackers to 1 change the admin password, 2 reboot the device, or 3 possibly have unspecified other impact via crafted requests to CGI programs...