532 matches found
Debian: Security Advisory (DSA-3391-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Wordpress EZ Google Analytics Plugin 4.1.6 - Persistant XSS Vulnerability
Exploit for php platform in category web applications Title : Wordpress Plugin : EZ Google Analytics 4.1.6 - Persistant XSS vulnerability Author : ZwX Date : 15/02/2015 Downoload : https://downloads.wordpress.org/plugin/ez-google-analytics.4.1.06.zip Vendor : http://wordpress.ieonly.com Tested on...
Netgear Router Vulnerabilities Public Exploits
A vulnerability in Netgear routers, already disclosed by two sets of researchers at different security companies, has been publicly exploited. Netgear, meanwhile, has yet to release patched firmware, despite apparently having built one and confirmed with one of the companies that privately...
GLPI 0.85.5 - Arbitrary File Upload / Filter Bypass / Remote Code Execution
Exploit Title: GLPI 0.85.5 RCE through file upload filter bypass Date: September 7th, 2015 Exploit Author: Raffaele Forte Vendor Homepage: http://www.glpi-project.org/ Software Link: https://forge.glpi-project.org/attachments/download/2093/glpi-0.85.5.tar.gz Version: GLPI 0.85.5 Tested on: CentOS...
Barracuda Web Filter <= 5.0.0.012 Remote Command Execution
The remote Barracuda Web Filter device is running a firmware version at or prior to 5.0.0.012. It is, therefore, affected by a remote command execution vulnerability in the web administration interface. An authenticated, remote attacker can exploit this, via a specially crafted request to...
CVE-2015-6754
Cross-site scripting XSS vulnerability in the administration interface in the Path Breadcrumbs module 7.x-3.x before 7.x-3.3 for Drupal allows remote authenticated users with the "Administer Path Breadcrumbs" permission to inject arbitrary web script or HTML via unspecified vectors...
Cross site scripting
Cross-site scripting XSS vulnerability in the administration interface in the Path Breadcrumbs module 7.x-3.x before 7.x-3.3 for Drupal allows remote authenticated users with the "Administer Path Breadcrumbs" permission to inject arbitrary web script or HTML via unspecified vectors...
Hardcoded credentials
Actiontec GT784WN modems with firmware before NCS01-1.0.13 have hardcoded credentials, which makes it easier for remote attackers to obtain root access by connecting to the web administration interface...
CVE-2015-2904
Actiontec GT784WN modems with firmware before NCS01-1.0.13 have hardcoded credentials, which makes it easier for remote attackers to obtain root access by connecting to the web administration interface...
PT-2015-3362 · D Link · Dir-815
Name of the Vulnerable Software and Affected Versions: D-Link DIR-815 versions prior to 2.03.B02 Description: The issue is related to insufficient input validation in the remote administration interface, allowing remote attackers to execute arbitrary commands via specially crafted HTTP requests...
CVE-2015-3368
Cross-site scripting XSS vulnerability in the administration user interface in the Classified Ads module before 6.x-3.1 and 7.x-3.x before 7.x-3.1 for Drupal allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via a category name...
Barracuda Firmware 5.0.0.012 - (Authenticated) Remote Command Execution (Metasploit)
Barracuda Firmware 5.0.0.012 - Authenticated Remote Command Execution Metasploit Exploit Title: Barracuda Firmware 'Barracuda Firmware %q This module exploits a remote command execution vulnerability in the Barracuda Firmware Version 'xort', metasploit module , 'Version' = '$Revision: 12345 $',...
Barracuda Firmware <= 5.0.0.012 reporting Post Auth Remote Root Exploit
This Metasploit module exploits a remote command execution vulnerability in Barracuda Firmware versions 5.0.0.012 and below by exploiting a vulnerability in the web administration interface. By sending a specially crafted request it's possible to inject system commands while escalating to root do...
[SECURITY] Fedora 21 Update: glpi-0.84.8-4.fc21
GLPI is the Information Resource-Manager with an additional Administration- Interface. You can use it to build up a database with an inventory for your company computer, software, printers.... It has enhanced functions to make the daily life for the administrators easier, like a job-tracking-syst...
[SECURITY] Fedora 20 Update: glpi-0.84.8-4.fc20
GLPI is the Information Resource-Manager with an additional Administration- Interface. You can use it to build up a database with an inventory for your company computer, software, printers.... It has enhanced functions to make the daily life for the administrators easier, like a job-tracking-syst...
Phabricator: SSRF vulnerability (access to metadata server on EC2 and OpenStack)
In bug 50537, haquaman reported a SSRF vulnerability in the meme creation section of Phabricator. Ticket T6755 was created and the HackerOne issue was closed as "Won't fix". T6755 states that "attackers can use the machine's ability to access the network, which may allow them to find services and...
ManageEngine NetFlow Analyzer Default Credentials
The remote ManageEngine NetFlow Analyzer web administration interface uses a known set of default credentials. An attacker can use these to gain access to the system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...
Fortinet FortiWeb CSRF Vulnerability (FG-IR-14-013)
Fortinet FortiWeb is prone to multiple cross-site request forgery CSRF vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
[SECURITY] Fedora 21 Update: glpi-0.84.8-3.fc21
GLPI is the Information Resource-Manager with an additional Administration- Interface. You can use it to build up a database with an inventory for your company computer, software, printers.... It has enhanced functions to make the daily life for the administrators easier, like a job-tracking-syst...
[SECURITY] Fedora 20 Update: glpi-0.84.8-3.fc20
GLPI is the Information Resource-Manager with an additional Administration- Interface. You can use it to build up a database with an inventory for your company computer, software, printers.... It has enhanced functions to make the daily life for the administrators easier, like a job-tracking-syst...