ZYCOO IP Phone System - Remote Command Execution

Vulnerable hardware : ZYCOO IP phone system Vendor : zycoo.com Author : Ahmed sultan @0x4148 Email : [email protected] Summary : According to the vendor's site , CooVox Series IP Phone System is the most innovative solution for VoIP telecommunication in SMB Small and Medium-sized Business market...

SonicWALL Global Management System (GMS) / Analyzer GMC Service XML External Entity (XXE) Injection

The SonicWALL Global Management System GMS / Analyzer running on the remote host is affected by an XML external entity XXE injection vulnerability in the GMC service due to an incorrectly configured XML parser accepting XML entities from an untrusted source. An unauthenticated, remote attacker ca...

CVE-2016-0361

IBM General Parallel File System GPFS 3.5 before 3.5.0.29 efix 6 and 4.1.1 before 4.1.1.4 efix 9, when the Spectrum Scale GUI is used with DB2 on Linux, UNIX and Windows, allows remote authenticated users to obtain sensitive information via unspecified vectors, as demonstrated by discovering ADMI...

Davolink DV-2051 - Multiple Vulnerabilities

Davolink DV-2051 - Multiple Vulnerabilities =================================================================== Title: Unauthenticated admin password change Product: Davolink modem Tested model: DV-2051 Vulnerability Type: Missing Function Level Access Control CWE-306 Risk Level: High Solution...

Davolink DV-2051 - Multiple Vulnerabilities

=================================================================== Title: Unauthenticated admin password change Product: Davolink modem Tested model: DV-2051 Vulnerability Type: Missing Function Level Access Control CWE-306 Risk Level: High Solution Status: No fix available Discovered and...

UPC Hungary Administrative Password / Insecure Transit

UPC network problems -------------------- Platforms / Firmware confirmed affected: - UPC Hungary network Problems -------- Network and device configuration problems Administration password is sent to the device in plain in the configuration file Administration password, which is used also for the...

The vulnerability of the Zyxel ZLD operating system allows a remote attacker to escalate their privileges.

Exploiting a vulnerability in the operating system of the Zyxel ZyWALL USG 300 network interface card allows a malicious actor to upload and download device configuration files without additional authentication. As a result, the malicious actor can view or modify the administrator’s password...

Fortinet FortiWeb CSRF Vulnerability (FG-IR-16-010)

Fortinet FortiWeb is prone to a cross-site request forgery CSRF vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

WebCalendar 1.2.7 CSRF Bypass

Credits: John Page aka HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/WEBCALENDAR-V1.2.7-CSRF-PROTECTION-BYPASS.txt + ISR: ApparitionSec Vendor: ========================== www.k5n.us/webcalendar.php Product: ================== WebCalendar v1.2.7...

WebCalendar 1.2.7 - Multiple Vulnerabilities

Credits: John Page aka HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/WEBCALENDAR-V1.2.7-CSRF-PROTECTION-BYPASS.txt + ISR: ApparitionSec Vendor: ========================== www.k5n.us/webcalendar.php Product: ================== WebCalendar v1.2.7...

FortiWeb CSRF Vulnerability

A CSRF vulnerability could allow attackers to change admin password with crafted forms...

BDCOM Boda BSR2800-08C Multiservice Router has a Design Flaw Vulnerability

BDCOM BODA BSR2800-08C Multi-Service Router is a new generation of switched multi-service router platform developed by Shanghai BODA Data Communication Co. The platform adopts 64-bit multi-core processor + high-speed switching engine + FPGA supporting design scheme with excellent performance. A...

Meteocontrol WEB’log - Admin Password Disclosure

No description provided by source...

ArticleSetup 1.00 Cross Site Request Forgery

...

ArticleSetup 1.00 - Cross-Site Request Forgery (Change Admin Password)

Exploit for php platform in category web applications 0day.today 2018-03-05...

ArticleSetup 1.00 - Cross-Site Request Forgery (Change Admin Password)

ArticleSetup 1.00 - Cross-Site Request Forgery Change Admin Password...

ArticleSetup 1.00 - Cross-Site Request Forgery (Change Admin Password)

...

PHP Realestate Script Script 4.9.0 - SQL Injection

Exploit Title: Property Agent RealeState Script Sql Injection Date: 2015-05-27 Exploit Author: Meisam Monsef [email protected] or [email protected] Vendor Homepage: http://www.phpscriptsmall.com/product/php-realestate-script/ Version: 4.9.0 Exploit :...

Meteocontrol WEB’log - Admin Password Disclosure (Metasploit)

Meteocontrol WEB’log - Admin Password Disclosure Metasploit Exploit Title: Meteocontrol WEB'log - Extract Admin password Discovered by: Karn Ganeshen Vendor Homepage: http://www.meteocontrol.com/en/ Versions Reported: All Meteocontrol WEB'log versions CVE-ID: CVE-2016-2296 Meteocontrol WEB'log -...

Observium 0.16.7533 - Cross-Site Request Forgery

Observium 0.16.7533 - Cross-Site Request Forgery & retype password instead of having to insert the older password. such an attack would look like this: -- Change admin password...