5448 matches found
Web servers PHPMyAdmin Misconfiguration Code Injection
A code injection vulnerability has been reported in PHPMyAdmin. The vulnerability is due to PHPMyAdmin misconfiguration. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request to the target...
PHPMyAdmin Misconfiguration Remote Code Injection (CVE-2009-1151)
A Code Injection vulnerability has been reported in PhpMyAdmin. The vulnerability is due to misconfiguration of PhpMyAdmin server. A remote attacker could exploit this vulnerability by sending a malicious request to the server. Successful exploitation could result in attacker-controlled script...
HackerOne: DNS Misconfiguration
Your localhost.hackerone.com has address 127.0.0.1 and this may lead to "Same- Site" Scripting. Here is detailed description of this minor security issue by Tavis Ormandy: http://www.securityfocus.com/archive/1/486606/30/0/threaded...
Security Advisory: NETGEAR Router D6300B Firmware: V1.0.0.14_1.0.14
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Advisory ID: SYSS-2013-001 Product: NETGEAR Router D6300B / Firmware: V1.0.0.141.0.14 latest Vendor: Netgear Affected Versions: until V1.0.0.141.0.14 latest Tested Versions: V1.0.0.141.0.14 latest Vulnerability Type: Root-Shell, OS Command Injection,...
Netgear D6300B Command Injection / Misconfiguration
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Advisory ID: SYSS-2013-001 Product: NETGEAR Router D6300B / Firmware: V1.0.0.141.0.14 latest Vendor: Netgear Affected Versions: until V1.0.0.141.0.14 latest Tested Versions: V1.0.0.141.0.14 latest Vulnerability Type: Root-Shell, OS Command Injection,...
Fedora 20 : mediawiki-1.21.3-1.fc20 (2013-22047)
Kevin Israel Wikipedia user PleaseStand identified and reported two vectors for injecting JavaScript in CSS that bypassed MediaWiki's blacklist CVE-2013-4567, CVE-2013-4568. - Internal review while debugging a site issue discovered that MediaWiki and the CentralNotice extension were incorrectly...
Adobe ColdFusion 9 Administrative Login Bypass
Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication using the RDS component. Due to default settings or misconfiguration, its password can be set to an empty value. This allows an attacker to create a session via the RDS login that can be carried over to th...
[Web-Sorrow v1.5] Versatile security scanner for the information disclosure and fingerprinting phases of pentesting
Web-Sorrow is a perl based tool for misconfiguration, version detection, enumeration, and server information scanning. It's entirely focused on Enumeration and collecting Info on the target server. Web-Sorrow is a "safe to run" program, meaning it is not designed to be an exploit or perform any...
Cisco Mobility Services Engine Anonymous Login Vulnerability
A vulnerability in Cisco Mobility Services Engine could allow an unauthenticated, remote attacker to connect to a database replication port anonymously via Secure Sockets Layer SSL. The vulnerability is due to the misconfiguration of the Oracle SSL service. An attacker could exploit this...
VMware - Setuid VMware-mount Popen lsb_release Privilege Escalation
VMware - Setuid VMware-mount Popen lsbrelease Privilege Escalation // Source: http://blog.cmpxchg8b.com/2013/08/security-debianisms.html On most modern Linux systems, /bin/sh is provided by bash, which detects that it's being invoked as sh, and attempts to mimic traditional sh. As everyone who...
Sun SPARC Enterprise T5120 and T5220 Default Configuration Root Command Execution
The remote Sun SPARC Enterprise Server has been mistakenly shipped with factory settings in the pre-installed Solaris 10 image which configures the remote SSH server insecurely. As a result, local or remote users may leverage these misconfigurations to execute arbitrary commands with the privileg...
Adobe ColdFusion RDS Authentication Bypass
Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication using the RDS component. Due to default settings or misconfiguration, its password can be set to an empty value. This allows an attacker to create a session via the RDS login that can be carried over to th...
Symantec Web Gateway < 5.1.1 Multiple Vulnerabilities (SYM13-008)
Binary data 6966.prm...
Symantec Web Gateway < 5.1.1 Multiple Vulnerabilities (SYM13-008)
According to its self-reported version number, the remote web server is hosting Symantec Web Gateway before version 5.1.1, which has the following vulnerabilities : - Multiple cross-site scripting vulnerabilities exist. CVE-2013-4670 - It is possible to inject arbitrary operating system commands...
Symantec Web Gateway 5.1.0.x - Multiple Vulnerabilities
Symantec Web Gateway 5.1.0.x - Multiple Vulnerabilities SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities - Surveillance via Symantec Web Gateway product: Symantec Web Gateway vulnerable version:...
Server Misconfiguration discloses passwords of all Barracuda Network Employees
Security expert Ebrahim Hegazy has found a Password disclosure vulnerability in Barracuda update servers which allows to gain access to employee credentials. The Egyptian information security advisor Ebrahim Hegazy@Zigoo0 has found a Password disclosure vulnerability in one of Barracuda update...
Server Misconfiguration discloses passwords of all Barracuda Network Employees
Security expert Ebrahim Hegazy has found a Password disclosure vulnerability in Barracuda update servers which allows to gain access to employee credentials. The Egyptian information security advisor Ebrahim Hegazy@Zigoo0 has found a Password disclosure vulnerability in one of Barracuda update...
C.P.Sub 4.5 - Authentication Bypass
C.P.Sub 4.5 - Authentication Bypass !/usr/bin/python Exploit Title: C.P.Sub = v4.5 Misconfiguration and Improper Authentication Date: 2013/6/27 Exploit Author: Chako Vendor Homepage: http://www.cooltey.org/ping/php.php Software Download Link: http://cooltey.myweb.hinet.net/cpsubv4.5.zip Version: ...
C.P.Sub 4.5 - Authentication Bypass
!/usr/bin/python Exploit Title: C.P.Sub = v4.5 Misconfiguration and Improper Authentication Date: 2013/6/27 Exploit Author: Chako Vendor Homepage: http://www.cooltey.org/ping/php.php Software Download Link: http://cooltey.myweb.hinet.net/cpsubv4.5.zip Version: = v4.5 Tested on: Windows 7 Improper...
C.P.Sub 4.5 Privilege Escalation
!/usr/bin/python Exploit Title: C.P.Sub = v4.5 Misconfiguration and Improper Authentication Date: 2013/6/27 Exploit Author: Chako Vendor Homepage: http://www.cooltey.org/ping/php.php Software Download Link: http://cooltey.myweb.hinet.net/cpsubv4.5.zip Version: = v4.5 Tested on: Windows 7 Improper...