Flatnuke3 File Manager Module Unauthorized Access Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/26155/info Flatnuke3 is prone to an unauthorized-access vulnerability because it fails to adequately verify administrative credentials while logging in via the 'File Manager' module. An attacker can exploit this...

Hesk 0.92/0.93 Session ID Authentication Bypass Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/14879/info Hesk is prone to an authentication bypass vulnerability. Successful exploitation will grant an attacker administrative access to the application. This can lead to unauthorized access of sensitive data,...

iDev Rentals 1.0 - Multiple Vulnerabilities

No description provided by source. Title: ====== iDev Rentals v1.0 - Multiple Web Vulnerabilities Date: ===== 2012-11-14 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=760 VL-ID: ===== 758 Common Vulnerability Scoring System: ==================================== 3.5...

HP JetDirect Printer SNMP JetAdmin Device Password Disclosure Vulnerability

No description provided by source. HP JetDirect J2552A/J2552B/J2591A/J3110A/J3111A/J3113A/J3263A/300.0 X Printer SNMP JetAdmin Device Password Disclosure Vulnerability source: http://www.securityfocus.com/bid/7001/info A problem with JetDirect printers could make it possible for a remote user to...

Сross-Site Request Forgery (CSRF) in TAO

Advisory ID: HTB23211 Product: TAO Vendor: Open Assessment Technologies S.A. Vulnerable Versions: 2.5.6 and probably prior Tested Version: 2.5.6 Advisory Publication: April 16, 2014 without technical details Vendor Notification: April 16, 2014 Public Disclosure: May 7, 2014 Vulnerability Type:...

Сross-Site Request Forgery (CSRF) in TAO

High-Tech Bridge Security Research Lab discovered vulnerability in TAO, which can be exploited to gain complete administrative control over the vulnerable application. 1 Сross-Site Request Forgery CSRF in TAO: CVE-2014-2989 The vulnerability exists due to insufficient verification of the HTTP...

OpenDocMan 1.2.7 - Multiple Vulnerabilities

Advisory ID: HTB23202 Product: OpenDocMan Vendor: Free Document Management Software Vulnerable Versions: 1.2.7 and probably prior Tested Version: 1.2.7 Advisory Publication: February 12, 2014 without technical details Vendor Notification: February 12, 2014 Vendor Patch: February 24, 2014 Public...

Alcatel OmniSwitch Default Credentials (telnet)

It is possible to log into the remote Alcatel OmniSwitch by providing the default credentials. A remote attacker could exploit this to gain administrative control of the remote device. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid70212; scriptversion"$Revision: 1.3...

Alcatel OmniSwitch Default Credentials (ftp)

It is possible to log into the remote Alcatel OmniSwitch by providing the default credentials via FTP. A remote attacker could exploit this to gain administrative control of the remote device. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid70210;...

Alcatel OmniSwitch Default Credentials (http)

It is possible to log into the remote Alcatel Switch by providing the default credentials. A remote attacker could exploit this to gain administrative control of this installation. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

Heap Corruption in Nitro Reader Could Allow Arbitrary Code Execution

Executive Summary Microsoft is providing notification of the discovery and remediation of a vulnerability affecting Nitro Pro version 7.5.0.22 and earlier versions and Nitro Reader version 2.5.0.36 and earlier versions. Microsoft discovered and disclosed the vulnerability under coordinated...

iDev Rentals 1.0 - Multiple Vulnerabilities

Title: ====== iDev Rentals v1.0 - Multiple Web Vulnerabilities Date: ===== 2012-11-14 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=760 VL-ID: ===== 758 Common Vulnerability Scoring System: ==================================== 3.5 Introduction: =============...

OpenStack Keystone Default Credentials

It is possible to log into the remote OpenStack Keystone instance by providing default credentials. Knowing these, an attacker can gain administrative control of the affected application and would then be able to read and write to Keystone, which is used as an identity provider by other services...

Symantec Message Filter Management Interface Default Credentials

Brightmail Control Center BCC is the administrative web interface for Symantec Message Filter. It is possible to log into the remote BCC by providing the default credentials. A remote attacker could exploit this to gain administrative control of the application. %NASLMINLEVEL 70300 C Tenable...

Liferay Portal Default Credentials

It is possible to log into the remote Liferay Portal by providing default credentials. Knowing these, an attacker can gain administrative control of the affected application server and, for example, install hostile plugins. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

RuggedCom Rugged Operating System Vulnerability

RuggedCom Rugged Operating System ROS, used in RuggedCom network infrastructure devices, contains a hard-coded user account with a predictable password. This user account cannot be manually disabled. An attacker who successfully guesses the password may be able to gain complete administrative...

SonicWALL ViewPoint Server Default Credentials

It is possible to log into SonicWALL ViewPoint Server by providing the default admin credentials. A remote attacker could exploit this to gain administrative control of the application. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

Vulnerability in its Identity Services Engine of Cisco

Vulnerability in its Identity Services Engine of Cisco Cisco is warning users of a critical vulnerability CVE-2011-3290 in its Identity Services Engine ISE. In its security advisory, the company says that the underlying database used by ISE, its identity and access control policy platform, contai...

Cisco Releases Security Advisory for Identity Services Engine

Cisco has released a security advisory to address a vulnerability in Cisco Identity Services Engine. Exploitation of this vulnerability may allow a remote attacker to gain complete administrative control of the device. US-CERT encourages users and administrators to review Cisco Security Advisory...

Rosewill RXS-3211 IP Camera Password Retriever

This module takes advantage of a protocol design issue with the Rosewill admin executable in order to retrieve passwords, allowing remote attackers to take administrative control over the device. Other similar IP Cameras such as Edimax, Hawking, Zonet, etc, are also believed to have the same flaw...