Design/Logic Flaw

The NETGEAR ProSafe Plus Configuration Utility creates configuration backup files containing cleartext passwords, which might allow remote attackers to obtain sensitive information by reading a file...

Netgear ProSafe Plus Configuration Utility writes out plaintext passwords to backup configuration files

Overview The Netgear ProSafe Plus Configuration Utility exposes password information via the configuration backup file. Description CWE-200- Information Exposure The Netgear ProSafe Plus Configuration Utility provides a feature to back up switch configuration. In the backup file, the device...

CVE-2014-5247

The UpgradeBeforeConfigurationChange function in lib/client/gntcluster.py in Ganeti 2.10.0 before 2.10.7 and 2.11.0 before 2.11.5 uses world-readable permissions for the configuration backup file, which allows local users to obtain SSL keys, remote API credentials, and other sensitive information...

CVE-2014-5247

Ganeti 2.10.0 prior to 2.10.7 and 2.11.0 prior to 2.11.5 are affected by CVE-2014-5247. The vulnerability arises from the _UpgradeBeforeConfigurationChange function in lib/client/gnt_cluster.py, which stores the configuration backup with world-readable permissions. This exposure allows local user...

CVE-2014-5247

The UpgradeBeforeConfigurationChange function in lib/client/gntcluster.py in Ganeti 2.10.0 before 2.10.7 and 2.11.0 before 2.11.5 uses world-readable permissions for the configuration backup file, which allows local users to obtain SSL keys, remote API credentials, and other sensitive information...

Command injection

The UpgradeBeforeConfigurationChange function in lib/client/gntcluster.py in Ganeti 2.10.0 before 2.10.7 and 2.11.0 before 2.11.5 uses world-readable permissions for the configuration backup file, which allows local users to obtain SSL keys, remote API credentials, and other sensitive information...

ZyXEL Router P-660HN-T1A - Login Bypass

No description provided by source. Exploit Title: ZyXEL Router P-660HN-T1A - Login Bypass Date: 11/03/2013 Exploit Author: Michael Grifalconi [email protected] Vendor Homepage: http://www.zyxel.com/productsservices/p660hntxaseries.shtml?t=p Version: 3.40BYF.5 - Last avaiable If someo...

WebTitan 4.01 Build 68 SQL Injection / Command Execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple critical vulnerabilities product: WebTitan vulnerable version: 4.01 Build 68 fixed version: 4.04 impact: critical...

ZYXEL P-660HN-T1A Router - Authentication Bypass

Exploit Title: ZyXEL Router P-660HN-T1A - Login Bypass Date: 11/03/2013 Exploit Author: Michael Grifalconi Vendor Homepage: http://www.zyxel.com/productsservices/p660hntxaseries.shtml?t=p Version: 3.40BYF.5 - Last avaiable If someone is logged on the web interface of the router, the attacker coul...

ZYXEL P-660HN-T1A Router - Authentication Bypass

ZYXEL P-660HN-T1A Router - Authentication Bypass Exploit Title: ZyXEL Router P-660HN-T1A - Login Bypass Date: 11/03/2013 Exploit Author: Michael Grifalconi Vendor Homepage: http://www.zyxel.com/productsservices/p660hntxaseries.shtml?t=p Version: 3.40BYF.5 - Last avaiable If someone is logged on t...

ZyXEL Router P-660HN-T1A - Login Bypass Vulnerability

Exploit for hardware platform in category web applications Exploit Title: ZyXEL Router P-660HN-T1A - Login Bypass Date: 11/03/2013 Exploit Author: Michael Grifalconi Vendor Homepage: http://www.zyxel.com/productsservices/p660hntxaseries.shtml?t=p Version: 3.40BYF.5 - Last avaiable If someone is...

[jSQL Injection v0.5] Java tool for automatic database injection

jSQL Injection is a lightweight application used to find database information from a distant server. jSQL is free, open source and cross-platform Windows, Linux, Mac OS X, Solaris. jSQL Injection change log - version 0.5 0.5 SQL shell Uploader 0.4 Admin page checker and preview Brute forcer md5...

Moderate: Red Hat Security Advisory: redhat-ds-base security and bug fix update

Updated redhat-ds-base packages that fix one security issue and several bugs are now available for Red Hat Directory Server 8.2. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detail...

FOSCAM IP-Cameras Improper Access Restrictions

Advisory ID Internal CORE-2013-0613 1. Advisory Information Title: FOSCAM IP-Cameras Improper Access Restrictions Advisory ID: CORE-2013-0613 Advisory URL:http://www.coresecurity.com/advisories/foscam-ip-cameras-improper-access-restrictions Date published: 2013-07-23 Date of last update:...

[jSQL Injection v0.4] Java tool for automatic database injection

jSQL Injection is a lightweight application used to find database information from a distant server. jSQL is free, open source and cross-platform Windows, Linux, Mac OS X, Solaris. Version 0.4 features: GET, POST, header, cookie methods Normal, error based, blind, time based algorithms Automatic...

Netgear DGN2200B - 'pppoe.cgi' Remote Command Execution (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'Netgear DGN2200B pppoe.cgi Remote...

Netgear DGN2200B pppoe.cgi Remote Command Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'Netgear DGN2200B pppoe.cgi Remote...

Netgear DGN2200B pppoe.cgi Remote Command Execution Vulnerability

Some Netgear Routers are vulnerable to an authenticated OS command injection on their web interface. Default credentials for the web interface are admin/admin or admin/password. Since it is a blind os command injection vulnerability, there is no output for the executed command when using the cmd...

Netgear DGN2200B pppoe.cgi Remote Command Execution

Some Netgear Routers are vulnerable to an authenticated OS command injection on their web interface. Default credentials for the web interface are admin/admin or admin/password. Since it is a blind os command injection vulnerability, there is no output for the executed command when using the cmd...

[JSQL v0.3] Java Tool for Automatic Database Injection

jSQL Injection is a lightweight application used to find database information from a distant server. jSQL is free, open source and cross-platform Windows, Linux, Mac OS X, Solaris. Version 0.2 features: GET, POST, header, cookie methods normal, error based, blind, time based algorithms automatic...