Muster Render Farm Management System - Arbitrary File Download

Name: Muster Render Farm Management System Arbitrary File Download Vendor Website : http://www.vvertex.com/muster.html Date Released : November 29, 2011 Affected Software : Muster 6.20 Researcher : Nick Freeman [email protected] Description Security-Assessment.com has discovere...

ManageEngine ADSelfService Plus Default Administrator Credentials

The instance of ManageEngine ADSelfService Plus running on the remote web server uses a default set of credentials 'admin' / 'admin' to control access to its management interface. A remote attacker can exploit this to gain full administrative access to the application. %NASLMINLEVEL 70300 C Tenab...

Netgear Wireless Cable Modem Gateway - Authentication Bypass / Cross-Site Request Forgery

Sense of Security - Security Advisory - SOS-11-011 Release Date. 20-Sep-2011 Last Update. - Vendor Notification Date. 22-Mar-2011 Product. NETGEAR Wireless Cable Modem Gateway CG814WG Affected versions. Hardware 1.03, Software V3.9.26 R14 verified, possibly others Severity Rating. High Impact...

Cross site scripting

Cross-site scripting XSS vulnerability in the management interface in Microsoft FAST ESP 5.1.5 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-5092

Cross-site scripting XSS vulnerability in the management interface in Microsoft FAST ESP 5.1.5 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

HP Client Automation Satellite Web Console Detection

HP Client Automation Satellite, the portion of HP Client Automation that is installed on client systems, was detected on the remote host. This is used for managing client devices. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid56165; scriptversion"1.5";...

CVE-2009-5092

Cross-site scripting XSS vulnerability in the management interface in Microsoft FAST ESP 5.1.5 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Design/Logic Flaw

The web-based management interface on Cisco SA 500 series security appliances with software before 2.1.19 allows remote authenticated users to execute arbitrary commands via crafted parameters to web forms, aka Bug ID CSCtq65681...

CVE-2011-2546

SQL injection vulnerability in the web-based management interface on Cisco SA 500 series security appliances with software before 2.1.19 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCtq65669...

CVE-2011-2547

The CVE-2011-2547 issue affects Cisco SA 500 Series Security Appliances running software before 2.1.19. The Privilege Escalation vulnerability allows an authenticated user to inject arbitrary commands into the underlying OS via crafted parameters in web forms, enabling execution with root-equival...

Cisco SA 500 Series Security Appliances Web Management Interface SQL Injection Vulnerability

Cisco SA 500 Series Security Appliances firmware contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary SQL code on a system. The vulnerability is due to improper validation of user-supplied input to the Cisco SA 500 Security Appliance web-based...

Cisco SA 500 Series Security Appliances Web Management Interface Vulnerabilities

...

ManageEngine SupportCenter Plus Default Administrator Credentials

The remote ManageEngine SupportCenter Plus install uses a default set of credentials 'administrator' / 'administrator' to control access to its management interface. With this information, an attacker can gain administrative access to the application. %NASLMINLEVEL 70300 C Tenable Network Securit...

PT-2011-08: Multiple vulnerabilities in Dlink DPH 150SE/E/F1

Positive Research Center has discovered multiple vulnerabilities in Dlink DPH 150SE/E/F1 IP phone. 1. A vulnerability exists in web management interface of Dlink DPH 150SE and allows an unauthenticated user to obtain device configuration file with all the settings including administrator's...

CVE-2011-1645

The web management interface on the Cisco RVS4000 Gigabit Security Router with software 1.x before 1.3.3.4 and 2.x before 2.0.2.7, and the WRVS4400N Gigabit Security Router with software before 2.0.2.1, allows remote attackers to read the backup configuration file, and consequently execute...

Design/Logic Flaw

The web management interface on the Cisco RVS4000 Gigabit Security Router with software 1.x before 1.3.3.4 and 2.x before 2.0.2.7, and the WRVS4400N Gigabit Security Router with software before 2.0.2.1, allows remote authenticated users to execute arbitrary commands via the 1 ping test parameter ...

CVE-2011-1645

The web management interface on the Cisco RVS4000 Gigabit Security Router with software 1.x before 1.3.3.4 and 2.x before 2.0.2.7, and the WRVS4400N Gigabit Security Router with software before 2.0.2.1, allows remote attackers to read the backup configuration file, and consequently execute...

CVE-2011-0951

The web-based management interface in Cisco Secure Access Control System ACS 5.1 before 5.1.0.44.6 and 5.2 before 5.2.0.26.3 allows remote attackers to change arbitrary user passwords via unspecified vectors, aka Bug ID CSCtl77440...

CVE-2011-0951

The web-based management interface in Cisco Secure Access Control System ACS 5.1 before 5.1.0.44.6 and 5.2 before 5.2.0.26.3 allows remote attackers to change arbitrary user passwords via unspecified vectors, aka Bug ID CSCtl77440...

Cisco Secure Access Control System Password Modification Vulnerability

Cisco Secure Access Control System ACS contains a vulnerability that could allow an unauthenticated, remote attacker to modify user passwords. The vulnerability is due to improper security restrictions on user password change functions in the web-based management interface of the Cisco Secure ACS...