CVE-2016-10177

An issue was discovered on the D-Link DWR-932B router. Undocumented TELNET and SSH services provide logins to admin with the password admin and root with the password 1234...

Design/Logic Flaw

The NETGEAR WNR2000v5 router leaks its serial number when performing a request to the /BRSnetgearsuccess.html URI. This serial number allows a user to obtain the administrator username and password, when used in combination with the CVE-2016-10176 vulnerability that allows resetting the answers t...

Polycom VVX Web Interface Privilege Escalation

Exploit Title: Polycom VVX Web Interface - Change Admin Password as User Date: January 26, 2017 Exploit Author: Mike Brown Vendor Homepage: http://www.polycom.com/ Software Link: http://downloads.polycom.com/voice/voip/ucswreleasesmatrix.html Version: Polycom vvx 410 UC Software Version: 5.3.1.04...

Polycom VVX Web Interface Forced Admin Password Change Vulnerability

Polycom is a global leader in standards-based unified communications UC solutions for telepresence, video and voice. The Polycom VVX web interface can be forced to change the admin password vulnerability, which requires a user to access the "user" account in the web interface of a Polycom VoIP...

Polycom VVX Web Interface - Change Admin Password

Polycom VVX Web Interface - Change Admin Password Exploit Title: Polycom VVX Web Interface - Change Admin Password as User Date: January 26, 2017 Exploit Author: Mike Brown Vendor Homepage: http://www.polycom.com/ Software Link: http://downloads.polycom.com/voice/voip/ucswreleasesmatrix.html...

Polycom VVX Web Interface - Change Admin Password Vulnerability

Exploit for hardware platform in category web applications Exploit Title: Polycom VVX Web Interface - Change Admin Password as User Date: January 26, 2017 Exploit Author: Mike Brown Vendor Homepage: http://www.polycom.com/ Software Link:...

ntopng Web Interface 2.4.160627 Cross Site Request Forgery Vulnerability

ntopng Web Interface version 2.4.160627 suffers from a cross site request forgery token bypass vulnerability. + + Credits / Discovery: John Page AKA Hyp3rlinX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/NTOPNG-CSRF-TOKEN-BYPASS.txt + ISR: ApparitionSEC...

SentryHD 02.01.12e - Local Privilege Escalation

SentryHD 02.01.12e - Local Privilege Escalation ''' Exploit Title: SentryHD 02.01.12e Privilege Escalation Date: 18-01-2017 Software Link: http://www.minutemanups.com/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: local 1...

FMyLife Clone Script (Pro Edition) 1.1 - Cross-Site Request Forgery (Add Admin)

FMyLife Clone Script Pro Edition 1.1 - Cross-Site Request Forgery Add Admin Vulnerability: Add Admin Exploit Add/Edit/Delete/ Category, Admin Vs... Google Dork: FMyLife Clone Script Date:10.01.2017 Vendor Homepage: http://alstrasoft.com/fmylife-pro.htm Script Name: FMyLife Clone Script Pro Editio...

Netgear DGN2200 / DGND3700 / WNDR4500 Information Disclosure Vulnerability

Netgear models DGN2200, DGND3700, and WNDR4500 suffer from multiple information disclosure vulnerabilities, one of which leaks the admin password. Title: Netgear DGN2200, DGND3700 and WNDR4500 Multiple Information Disclosure Vulnerabilities Author: Mandar jadhav Vendor Homepage:...

ntopng Default Admin Credentials (HTTP)

This script detects default admin credentials for ntopng via HTTP. Copyright C 2016 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

CSRF vulnerability in icms backend

iCMS is an efficient content management system for small and medium-sized websites. A csrf vulnerability exists in the latest version of iCMS. Because the token is not validated in the /app/admincp/account.app.php dosave operation, an attacker can modify the administrator account password by...

NETGEAR WNR2000v5 - Remote Code Execution

NETGEAR WNR2000v5 - Remote Code Execution Remote code execution in NETGEAR WNR2000v5 - by Pedro Ribeiro [email protected] / Agile Information Security Released on 20/12/2016 NOTE: this exploit is "alpha" quality and has been deprecated. Please see the modules accepted into the Metasploit framework...

MikroTik RouterOS Admin Password Change (CVE-2015-2350)

A vulnerability exists in MicroTik RouterOS, allowing an attacker to force an end-user to carry out undesired actions on the web application where the user is currently authenticated...

Advantech SUSIAccess Server Local Elevation of Privilege Vulnerability

SUSIAccess is an easy-to-use remote device management software solution. A local elevation of privilege vulnerability exists in Advantech SUSIAccess Server. Since the admin password is stored on the system and encrypted using a hard-coded static key in the program. An attacker can exploit the...

CVE-2016-5967

The installation component in IBM Rational Asset Analyzer RAA 6.1.0 before FP10 allows local users to discover the WAS Admin password by reading IM native logs...

CVE-2016-5967

The installation component in IBM Rational Asset Analyzer RAA 6.1.0 before FP10 allows local users to discover the WAS Admin password by reading IM native logs...

Information disclosure

The installation component in IBM Rational Asset Analyzer RAA 6.1.0 before FP10 allows local users to discover the WAS Admin password by reading IM native logs...

CVE-2016-5967

The installation component in IBM Rational Asset Analyzer RAA 6.1.0 before FP10 allows local users to discover the WAS Admin password by reading IM native logs...

Trend Micro Smart Protection Server Exec Remote Code Injection

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'openssl' require 'base64' class MetasploitModule "Trend Micro Smart Protection Server Exec Remote Code Injection", 'Description' = %q This...