CVE-2016-5650

ZModo ZP-NE14-S and ZP-IBH-13W devices do not enforce a WPA2 configuration setting, which allows remote attackers to trigger association with an arbitrary access point by using a recognized SSID value...

CVE-2016-5650

CVE-2016-5650 affects ZModo ZP-NE14-S and ZP-IBH-13W cameras/DVRs. The vulnerability arises because these devices do not enforce a WPA2 configuration setting, enabling a remote attacker to induce association with an arbitrary access point by presenting a recognized SSID value. Public sources conf...

CVE-2016-5650: Improper Access Control

ZModo ZP-NE14-S and ZP-IBH-13W devices do not enforce a WPA2 configuration setting, which allows remote attackers to trigger association with an arbitrary access point by using a recognized SSID value...

samba: Incorrect ACL get/set allowed on symlink path

A flaw was found in the way Samba handled ACLs on symbolic links. An authenticated user could use this flaw to gain access to an arbitrary file or directory by overwriting its ACL...

Vulnerabilities Identified in Dolphin, Mercury Android Browsers

Vulnerabilities exist in two fairly popular alternative browsers for Android – Dolphin and Mercury — that depending on the browser could result in either remote code execution or arbitrary read/write access. Mobile security researcher Benjamin Watson, who blogs under the guise of Rotlogix...

SiteFactory CMS 5.5.9 Path Traversal File Vulnerability

Exploit for php platform in category web applications |||||||||||||| + Title: SiteFactory CMS 5.5.9 Path Traversal File = \ , + Date: 19-8-2015 = | + Autor Guillermo Garcia Marcos = / + Vendor: http://www.mindbite.se/ / \ o\ + Dork : inurl:/sitefactory/assets/ | | \ \ + info: The file parameter i...

WordPress Plugin WP E-Commerce Shop Styling 2.5 - Arbitrary File Download

WordPress Plugin WP E-Commerce Shop Styling 2.5 - Arbitrary File Download Title: Remote file download vulnerability in wordpress plugin wp-ecommerce-shop-styling v2.5 Author: Larry W. Cashdollar, @larry0 Date: 2015-07-05 Download Site: https://wordpress.org/plugins/wp-ecommerce-shop-styling Vendo...

Internet Bug Bounty: SoapClient's __call() type confusion through unserialize()

https://bugs.php.net/bug.php?id=69085 Description: ------------ SoapClient's call method is prone to a type confusion vulnerability which can be used to gain remote code execution through unsafe unserialize calls. In soap.c:2906 if zendhashfindZOBJPROPPthisptr, "defaultheaders",...

Design/Logic Flaw

The Sponsor Portal in Cisco Identity Services Engine ISE allows remote authenticated users to obtain access to an arbitrary sponsor's guest account via a modified HTTP request, aka Bug ID CSCur64400...

JVN#61593104: ARROWS Me F-11D vulnerability where arbitrary areas may be accessed

ARROWS Me F-11D contains a vulnerability where arbitrary areas on the device may be accessed. Impact An attacker with local access may obtain or alter contents in the flash memory of the device. Solution Apply an Update Apply the update according to the information provided by the provider...

Frox 0.7.18 Arbitrary Configuration File Access Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/14711/info Frox is prone to a vulnerability that permits read access to arbitrary files. Successful exploitation of this vulnerability will grant the attacker read access to arbitrary files on the system in the security...

Network Tool 0.2 PHPNuke Addon Metacharacter Filtering Command Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/3552/info Network Tool is a PHPNuke addon, written and maintained by Rick Fournier. It is designed to offer network features such as nmap, traceroute, and ping from a web interface. A problem with the package has been...

WordPress Persuasion 主题'dl-skin.php'任意文件访问漏洞

BUGTRAQ ID: 64501 Persuasion是一款强大的商业主题。 Persuasion 2.0、2.3版本没有有效过滤用户输入，攻击者可利用此漏洞下载或删除任意文件。 0 mysitemyway persuasion 2.3 mysitemyway persuasion 2.0 厂商补丁： mysitemyway ----------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://mysitemyway.com/theme/persuasion-wordpress-theme/ Exploit Title:...

[ISecAuditors Security Advisories] SQL Injection vulnerability in "Project'Or RIA" allow arbitrary access to the database and the file system

============================================= INTERNET SECURITY AUDITORS ALERT 2013-017 - Original release date: July 26th, 2013 - Last revised: July 26th, 2013 - Discovered by: Vicente Aguilera Diaz - Severity: 6.8/10 CVSSv2 Base Scored - CVE-ID: CVE-2013-6164...

Project'Or RIA 3.4.0 - 'objectDetail.php?objectId' SQL Injection

============================================= INTERNET SECURITY AUDITORS ALERT 2013-017 - Original release date: July 26th, 2013 - Last revised: July 26th, 2013 - Discovered by: Vicente Aguilera Diaz - Severity: 6.8/10 CVSSv2 Base Scored - CVE-ID: CVE-2013-6164...

SA-CONTRIB-2012-130 - Jstool - Multiple Vulnerabilities

Javascript Tool enables administrators to edit any javascript file online from an admin panel. The module does not protect its menu paths, which contain sensitive information about all javascript files on the site and their contents. The module does not validate filenames which can lead to...

XODA Document Management System 0.4.5 - Cross-Site Scripting / Arbitrary File Upload

Exploit Title: XODA Document Management System Stored XSS & Arbitrary File Upload Vulnerability. Date: 21/08/2012 Exploit Author: Shai rod @NightRang3r Vendor Homepage: http://xoda.org/ Software Link: http://sourceforge.net/projects/xoda/files/xoda/xoda-0.4.5/ Version: 0.4.5 Gr33Tz: @aviadgolan ,...

Plixer Scrutinizer NetFlow and sFlow Analyzer 9 - Default MySQL Credential (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 "Plixer Scrutinize...

CVE-2010-5099

The fileDenyPattern functionality in the PHP file inclusion protection API in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly filter file types, which allows remote attackers to bypass intended access restrictions and access arbitrary PHP files, as...

CVE-2009-3897

CVE-2009-3897 affects Dovecot 1.2.x before 1.2.8, where during installation the base_dir-related directories (and possibly the base_dir itself) are created with mode 0777. This permits a local attacker to access or replace the authentication socket and potentially access arbitrary user accounts. ...