CVE-2015-2878

Multiple cross-site request forgery CSRF vulnerabilities in Hexis HawkEye G 3.0.1.4912 allow remote attackers to hijack the authentication of administrators for requests that 1 add arbitrary accounts via the name parameter to interface/rest/accounts/json; turn off the 2 Url matching, 3 DNS Inject...

CVE-2015-2878

Multiple cross-site request forgery CSRF vulnerabilities in Hexis HawkEye G 3.0.1.4912 allow remote attackers to hijack the authentication of administrators for requests that 1 add arbitrary accounts via the name parameter to interface/rest/accounts/json; turn off the 2 Url matching, 3 DNS Inject...

Mikogo 5.4.1.160608 - Local Credentials Disclosure

!/usr/bin/env python Mikogo 5.4.1.160608 Local Credentials Disclosure Vendor: Snapview GmbH Product web page: https://www.mikogo.com Affected version: 5.4.1.160608 Summary: Mikogo is a desktop sharing software application for web conferencing and remote support, and is provided by the online...

Mikogo 5.4.1.160608 - Local Credentials Disclosure

Mikogo 5.4.1.160608 - Local Credentials Disclosure !/usr/bin/env python Mikogo 5.4.1.160608 Local Credentials Disclosure Vendor: Snapview GmbH Product web page: https://www.mikogo.com Affected version: 5.4.1.160608 Summary: Mikogo is a desktop sharing software application for web conferencing and...

NetSarang Xlpd 5 Backdoor Trojan (ShadowPad)

The Xlpd 5,a line printer daemon for Windows, installed on the remote host has a nssock2.dll file identified by its MD5 hash that is infected with a trojan backdoor. The affected file includes an encrypted payload that could be remotely activated by a knowledgeable attacker. C Tenable Network...

Code injection

Acronis True Image up to and including version 2017 Build 8053 performs software updates using HTTP. Downloaded updates are only verified using a server-provided MD5 hash...

CVE-2017-3219

Acronis True Image up to and including version 2017 Build 8053 performs software updates using HTTP. Downloaded updates are only verified using a server-provided MD5 hash...

CVE-2017-3219

Acronis True Image up to and including version 2017 Build 8053 performs software updates using HTTP. Downloaded updates are only verified using a server-provided MD5 hash...

Uniview NVR - Password Disclosure

Uniview NVR - Password Disclosure Uniview NVR remote passwords disclosure Author: B1t The Uniview NVR web application does not enforce authorizations on the main.cgi file when requesting json data. It says that you can do anything without authentication, however you must know the request structur...

Uniview NVR - Password Disclosure

Uniview NVR remote passwords disclosure Author: B1t The Uniview NVR web application does not enforce authorizations on the main.cgi file when requesting json data. It says that you can do anything without authentication, however you must know the request structure. In addition, the users' passwor...

Amazon Linux AMI : java-1.7.0-openjdk (ALAS-2017-835)

An untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and hence escalate their privileges. CVE-2017-3511 It was found that the JAXP component of...

Dolibarr 4.0.4 SQL Injection / XSS / Weaknesses

=== FOXMOLE - Security Advisory 2017-02-23 === Dolibarr ERP & CRM - Multiple Issues Affected Versions ================= Dolibarr 4.0.4 Issue Overview ============== Vulnerability Type: SQL Injection, Cross Site Scripting, Weak Hash Algorithm without Salt, Weak Password Change Method Technical Ris...

MATESO GmbH Password Safe And Repository Enterprise 7.4.4 Build 2247 Credential Management

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2015-036 Products: Password Safe and Repository Enterprise Manufacturer: MATESO GmbH Affected Versions: 7.4.4 Build 2247 Tested Versions: 7.4.4 Build 2247 Vulnerability Type: Credentials Management CWE-255 Violation of Secure Desig...

Default credentials

Trango ApexLynx 2.0, ApexOrion 2.0, GigaLynx 2.0, GigaOrion 2.0, and StrataLink 3.0 devices have a built-in, hidden root account, with a default password for which the MD5 hash value is public but the cleartext value is perhaps not yet public. This account is accessible via SSH and/or TELNET, and...

CVE-2016-10307

Trango ApexLynx 2.0, ApexOrion 2.0, GigaLynx 2.0, GigaOrion 2.0, and StrataLink 3.0 devices have a built-in, hidden root account, with a default password for which the MD5 hash value is public but the cleartext value is perhaps not yet public. This account is accessible via SSH and/or TELNET, and...

Default credentials

Wonder CMS 2014 allows remote attackers to obtain sensitive information by viewing /files/password, which reveals the unsalted MD5 hashed password...

CVE-2014-8701

Wonder CMS 2014 allows remote attackers to obtain sensitive information by viewing /files/password, which reveals the unsalted MD5 hashed password...

Blizard BB 1.7 (privtmsg) MD5 Hash Retrieve Blind sql injection Exploit

Exploit for php platform in category web applications !/usr/bin/perl ------------------------------------------------------------------------ + Blizard BB 1.7 privtmsg MD5 Hash Retrieve blind sql injection ------------------------------------------------------------------------ Discovered by Juri...

Sawmill Enterprise 8.7.9 Authentication Bypass Vulnerability

Sawmill Enterprise version 8.7.9 suffers from a pass the hash authentication bypass vulnerability. + Credits: John Page AKA Hyp3rlinx + Website: hyp3rlinx.altervista.org Vendor: =============== www.sawmill.net Product: ======================== Sawmill Enterprise v8.7.9 sawmill8.7.9.4x86windows.ex...

Netman 204 - Backdoor Account / Password Reset Vulnerability

Exploit for hardware platform in category web applications Exploit Title: Netman 204 Backdoor and weak password recovery function Google Dork: intitle:"Netman 204 login" Date: 31st Jan 2017 Exploit Author: Simon Gurney Vendor Homepage: blog.synack.co.uk Software Link:...