Securifi Almond Cross-Site Scripting Vulnerability

The Securifi Almond is a wireless router with a touch screen. A cross-site scripting vulnerability in the Securifi Almond, Almond+, and Almond 2015 using firmware version AL-R096 can be exploited by a remote attacker to take control of the device as the admin user, execute arbitrary code, or chan...

CVE-2017-10720

Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the desktop application used to connect to the device suffers from a stack overflow if more than 26 characters are passed to it as the Wi-Fi name. This application is installe...

Stack overflow

Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the desktop application used to connect to the device suffers from a stack overflow if more than 26 characters are passed to it as the Wi-Fi password. This application is...

CVE-2017-10720

Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the desktop application used to connect to the device suffers from a stack overflow if more than 26 characters are passed to it as the Wi-Fi name. This application is installe...

CVE-2017-10722

Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the desktop application used to connect to the device suffers from a stack overflow if more than 26 characters are passed to it as the Wi-Fi password. This application is...

Legrand BTicino Driver Manager F454 1.0.51 CSRF Change Password Exploit

Summary Audio/video web server for the remote control of the system using web pages or the MY HOME portal. The device can operate as a gateway for the use of the MHVisual and Virtual Configurator software - 6 DIN modules. It replaces item F453 and F453AV. Description The application interface...

CVE-2018-18286

SQL injection vulnerabilities in CMG Suite 8.4 SP2 and earlier, could allow an unauthenticated attacker to conduct an SQL injection attack due to insufficient input validation for the changepwd interface. A successful exploit could allow an attacker to extract sensitive information from the...

CVE-2019-6279

ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 have an Incorrect Access Control vulnerability via the cgi-bin/webproc?getpage=html/index.html subpage=wlsecurity URI, allowing an Attacker to change the Wireless Security Password...

Facebook And Google Reviews System For Business 1.0 CSRF

Exploit Title: Facebook And Google Reviews System For Businesses - Cross-Site Request Forgery Date: 2018-12-13 Exploit Author: Veyselxan Vendor Homepage: https://codecanyon.net/item/facebook-and-google-reviews-system-for-businesses/22793559?srank=38 Version: v1 REQUIRED Tested on: Linux 1 Poof Of...

CVE-2018-19318

SRCMS 3.0.0 allows CSRF via admin.php?m=Admin&c=manager&a=update to change the username and password of the super administrator account...

Faraday v3.2 - Collaborative Penetration Test and Vulnerability Management Platform

Here is a list of all the goodies in Faraday v3.2: Workspace names- with numbers! With this new version, workspaces’ names are now allowed to start with numbers before they could only start with letters. Search unconfirmed vulns In this version was added the filter to be able to show unconfirmed...

Eaton UPS 9PX 8000 SP Cross-Site Request Forgery Vulnerability

The Eaton UPS 9PX 8000 SP is a power management device from Eaton USA. A cross-site request forgery vulnerability exists in the change-password feature in the Eaton UPS 9PX 8000 SP, which can be exploited by a remote attacker to force an administrator logged in to the device to unknowingly perfor...

CVE-2018-9281

An issue was discovered on Eaton UPS 9PX 8000 SP devices. The administration panel is vulnerable to a CSRF attack on the change-password functionality. This vulnerability could be used to force a logged-in administrator to perform a silent password update. The affected forms are also vulnerable t...

Cross site scripting

An issue was discovered on Eaton UPS 9PX 8000 SP devices. The administration panel is vulnerable to a CSRF attack on the change-password functionality. This vulnerability could be used to force a logged-in administrator to perform a silent password update. The affected forms are also vulnerable t...

Open Microscopy Environment OMERO.web Information Disclosure Vulnerability

Open Microscopy Environment OMERO.web is a set of open source image management platform for Web applications. The platform supports a variety of image file formats , and image management , viewing and editing operations . An information disclosure vulnerability exists in the login form and change...

CVE-2018-14078

Wi2be SMART HP WMT R1.2.20201400922 allows unauthorized remote attackers to reset the admin password via the /ConfigWizard/ChangePwd.esp?2admin URL Attackers can login using the "admin" username with password "admin" after a successful attack...

CVE-2018-1000633

The Open Microscopy Environment OMERO.web version prior to 5.4.7 contains an Information Exposure Through Log Files vulnerability in the login form and change password form that can result in User's password being revealed. Attacker can log in as that user. This attack appear to be exploitable vi...

Command injection

Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands...

CVE-2018-0707

Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands...

Teradek VidiU Pro 3.0.3 CSRF Change Password Exploit

Summary The Teradek VidiU gives you the freedom to broadcast live high definition video directly to the Web without a PC. Whether you're streaming out of a video switcher or wirelessly from your camera, VidiU allows you to go live when you want, where you want. VidiU offers API level integration...