CVE-2016-5055

CVE-2016-5055 affects OSRAM SYLVANIA Osram Lightify Pro prior to 2016-07-26, with XSS in the username field and the Wireless Client Mode configuration page. NVD data lists CVSS2/3 base scores (4.3/6.1) and NETWORK attack vector; impact includes partial integrity and low confidentiality, with user...

The vulnerability of the GNU Mailman mailing system allows a hacker to gain access to the authentication data of arbitrary users.

The vulnerability of the GNU Mailman system’s user configuration page relates to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to remotely access the authentication data of arbitrary users through modified requests. As a result, the access to the...

Liferay Portal 6.2 EE SP13 Cross Site Scripting

Hey guys, during a penatrationtest I have found an unknown persistent xss in liferay portal backend. General Information Manufacture description: Liferay Portal is an enterprise-web-platform for the development of business solutions, which provides quick results and long-term values. Details ·...

Sinapsi eSolar Light Plaintext Password Disclosure Vulnerability

Sinapsi eSolar Light is a monitoring system for use within solar applications from the Italian company Sinapsi. A security vulnerability in Sinapsi eSolar Light allows a remote attacker to read the HTML source code in the mail-configuration page to obtain a clear-text password and use it for...

Code injection

Sinapsi eSolar Light with firmware before 2.0.3970schsl2.2.85 allows attackers to discover cleartext passwords by reading the HTML source code of the mail-configuration page...

CVE-2015-3949

Sinapsi eSolar Light with firmware before 2.0.3970schsl2.2.85 allows attackers to discover cleartext passwords by reading the HTML source code of the mail-configuration page...

wordpress <= 3.3.1 - Multiple Vulnerabilities

No description provided by source. Trustwave's SpiderLabs Security Advisory TWSL2012-002: Multiple Vulnerabilities in WordPress https://www.trustwave.com/spiderlabs/advisories/TWSL2012-002.txt Published: 1/24/12 Version: 1.0 Vendor: WordPress http://wordpress.org/ Product: WordPress Version...

Sql injection

SQL injection vulnerability in the manage configuration page admconfigreport.php in MantisBT 1.2.13 through 1.2.16 allows remote authenticated administrators to execute arbitrary SQL commands via the filterconfigid parameter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Mobile Tools module 6.x-2.x before 6.x-2.3 for Drupal allow remote attackers to inject arbitrary web script or HTML via the 1 Mobile URL field or 2 Desktop URL field to the General configuration page, or the 3 message to the Mobile Tools...

PT-2012-2964 · WordPress +1 · Wordpress +1

Name of the Vulnerable Software and Affected Versions: WordPress versions 3.3.1 and earlier Description: The issue allows remote attackers to use WordPress as a proxy for brute-force attacks or denial of service attacks via the dbhost parameter. This is possible because the installation component...

Authentication flaw

The NetGear ProSafe WNAP210 with firmware 2.0.12 allows remote attackers to bypass authentication and obtain access to the configuration page by visiting recreate.php and then visiting index.php...

CVE-2011-0759

Multiple cross-site request forgery CSRF vulnerabilities in the configuration page in the Recaptcha aka WP-reCAPTCHA plugin 2.9.8.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that disable the CAPTCHA requirement or insert cross-site scripting...

USR5463 wireless router crossite scripting

Crossite scripting via configuration page...

CVE-2009-4845

The CVE-2009-4845 entry concerns ToutVirtual VirtualIQ Pro 3.2 build 7882, where the configuration page stores SSH credentials in cleartext. The root cause is exposure of usernames and passwords via the configuration UI, enabling remote attackers to obtain sensitive information without exploiting...

CVE-2009-4845

The configuration page in ToutVirtual VirtualIQ Pro 3.2 build 7882 contains cleartext SSH credentials, which allows remote attackers to obtain sensitive information by reading the username and password fields...

CVE-2007-2033

Summary (CVE-2007-2033) : Cisco Wireless Control System (WCS) is affected by an unspecified vulnerability in versions before 4.0.81.0. The issue allows remote authenticated users to read any configuration page by changing the group membership of user accounts (Bug ID CSCse78596). The NVD entry li...

SolidState 0.4 - Multiple Remote File Inclusions

SolidState 0.4 - Multiple Remote File Inclusions ::::::::: :::::::::: ::: ::: ::::::::::: ::: :+: :+: :+: :+: :+: :+: :+: +:+ +:+ +:+ +:+ +:+ +:+ +:+ ++ +:+ +++:++ ++ +:+ ++ ++ ++ ++ ++ ++ ++ ++ ++ + + + +++ + + ::::::::::: :::::::::: ::: :::: :::: :+: :+: :+: :+: +:+:+: :+:+:+ +:+ +:+ +:+ +:+ +:...

axis700.txt

Infosec Security Vulnerability Report No: Infosec.20000207.axis700.a ===================================== Vulnerability Summary --------------------- Problem: Bypassing authentication on Axis 700 Network Scanner; By modifying an URL, outsiders can access administrator URLs without entering...