Cisco Videoscape AnyRes Live Cross-Site Scripting Vulnerability

Cisco Videoscape AnyRes Live is a multi-format video encoder released by Cisco USA. A cross-site scripting vulnerability exists in the web-based administration interface of Cisco Videoscape AnyRes Live, which arises from the program's failure to adequately validate user-submitted input. A remote...

CVE-2018-6393

FreePBX 10.13.66-32bit and 14.0.1.24 SNG7-PBX-64bit-1712-2 allow post-authentication SQL injection via the order parameter. NOTE: the vendor disputes this issue because it is intentional that a user can "directly modify SQL tables ... or run shell scripts ... once ... logged in to the...

CVE-2017-3193

CVE-2017-3193 affects D-Link DIR-850L firmware 1.14B07 and 2.07.B05. A stack-based buffer overflow occurs in the web admin interface HNAP service. Exploitation involves sending a crafted POST to /HNAP1/ with modified HNAP_AUTH and SOAPAction headers, overflowing a buffer and potentially executing...

AXIS HTTP GET Heap Overflow

The remote AXIS device is affected by a heap overflow vulnerability in its web administration interface due to a flaw in handling of special characters. An unauthenticated remote attacker can exploit this vulnerability for denial of service and possibly remote code execution. C Tenable Network...

CVE-2017-13700

An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. There is XSS in the administration interface...

Design/Logic Flaw

An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. There is XSS in the administration interface...

CVE-2017-13700

An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. There is XSS in the administration interface...

CVE-2017-13700

The CVE-2017-13700 entry affects MOXA EDS-G512E devices (firmware version 5.1, build 16072215). The vulnerability is a cross-site scripting (XSS) flaw in the device’s administration interface. The available documents do not specify root cause details beyond the XSS description, nor do they provid...

Fuze Patches TPN Handset Vulnerabilties

Fuze, a maker of popular enterprise-grade voice-over-IP handsets, earlier this year patched three vulnerabilities that exposed user account information and enabled unauthorized authentication. The issues were made public today by researchers at Rapid7 who privately disclosed the flaws on April 12...

[SECURITY] Fedora 25 Update: glpi-9.1.5-1.fc25

GLPI is the Information Resource-Manager with an additional Administration- Interface. You can use it to build up a database with an inventory for your company computer, software, printers.... It has enhanced functions to make the daily life for the administrators easier, like a job-tracking-syst...

[SECURITY] Fedora 26 Update: glpi-9.1.5-1.fc26

GLPI is the Information Resource-Manager with an additional Administration- Interface. You can use it to build up a database with an inventory for your company computer, software, printers.... It has enhanced functions to make the daily life for the administrators easier, like a job-tracking-syst...

Barracuda Load Balancer Firmware < 6.0.1.006 - Remote Command Injection (Metasploit)

Exploit Title: Barracuda Load Balancer Firmware 'Barracuda Load Balancer Firmware %q This module exploits a remote command execution vulnerability in the Barracuda Load Balancer Firmware Version = v6.0.1.006 2016-08-19 by exploiting a vulnerability in the web administration interface. By sending ...

CVE-2017-1000030

Oracle, GlassFish Server Open Source Edition 3.0.1 build 22 is vulnerable to Java Key Store Password Disclosure vulnerability, that makes it possible to provide an unauthenticated attacker plain text password of administrative user and grant access to the web-based administration interface...

Cross site scripting

Oracle, GlassFish Server Open Source Edition 3.0.1 build 22 is vulnerable to Java Key Store Password Disclosure vulnerability, that makes it possible to provide an unauthenticated attacker plain text password of administrative user and grant access to the web-based administration interface...

CVE-2017-1000030

Removed by vendor...

Emby MediaServer Password Reset Vulnerability

Emby is a media server. A password reset vulnerability exists in Emby MediaServer. An attacker can exploit the vulnerability to gain unauthenticated and unauthorized access to the Emby MediaServer administration interface...

TrueConf Multiple Vulnerabilities (Jan 2017)

TrueConf is prone to multiple vulnerabilities. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

TrueConf Server 4.3.7 - Multiple Vulnerabilities

TrueConf Server v4.3.7 Multiple Remote Web Vulnerabilities Vendor: TrueConf LLC Product web page: https://www.trueconf.com Affected version: 4.3.7.12255 and 4.3.7.12219 Summary: TrueConf Server is a powerful, high-quality and highly secured video conferencing software server. It is specially...

Expression Engine 3.4.2: Code Reuse Attack

RIPS Analysis The analysis with RIPS took about 4 minutes. Overall, the code of Expression Engine seems to be very robust. Still our analysis results point out some vulnerabilities. RIPS detected mainly possibilities for a malicious user to embed HTML and JavaScript code via the administration...

Eir D1000 Wireless Router - WAN Side Remote Command Injection (Metasploit)

Eir D1000 Wireless Router - WAN Side Remote Command Injection Metasploit =begin Exploit Title: Eir D1000 Wireless Router - WAN Side Remote Command Injection Date: 7th November 2016 Exploit Author: Kenzo Website: https://devicereversing.wordpress.com Tested on Firmware version: 2.00AADU.520150909...