CVE-2013-6026

The web interface on D-Link DIR-100, DIR-120, DI-624S, DI-524UP, DI-604S, DI-604UP, DI-604+, and TM-G5240 routers; Planex BRL-04R, BRL-04UR, and BRL-04CW routers; and Alpha Networks routers allows remote attackers to bypass authentication and modify settings via an xmlsetroodkcableoj28840ybtide...

CVE-2013-2707

Cross-site request forgery CSRF vulnerability in the Login With Ajax plugin before 3.1 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that modify this plugin's settings...

CVE-2013-2640

ajax.functions.php in the MailUp plugin before 1.3.2 for WordPress does not properly restrict access to unspecified Ajax functions, which allows remote attackers to modify plugin settings and conduct cross-site scripting XSS attacks via unspecified vectors related to "formData=save" requests, a...

CVE-2013-2640

ajax.functions.php in the MailUp plugin before 1.3.2 for WordPress does not properly restrict access to unspecified Ajax functions, which allows remote attackers to modify plugin settings and conduct cross-site scripting XSS attacks via unspecified vectors related to "formData=save" requests, a...

CVE-2013-0731

ajax.functions.php in the MailUp plugin before 1.3.3 for WordPress does not properly restrict access to unspecified Ajax functions, which allows remote attackers to modify plugin settings and conduct cross-site scripting XSS attacks by setting the wordpressloggedin cookie. NOTE: this is due to an...

PT-2013-2566

Name of the Vulnerable Software and Affected Versions MailUp plugin for WordPress versions prior to 1.3.3 Description The issue allows remote attackers to modify plugin settings and conduct cross-site scripting XSS attacks by setting the wordpress logged in cookie, due to incomplete access...

CVE-2013-2640: Undefined Security Weakness

ajax.functions.php in the MailUp plugin before 1.3.2 for WordPress does not properly restrict access to unspecified Ajax functions, which allows remote attackers to modify plugin settings and conduct cross-site scripting XSS attacks via unspecified vectors related to "formData=save" requests, a...

PT-2013-3867

Name of the Vulnerable Software and Affected Versions MailUp plugin for WordPress versions prior to 1.3.2 Description The issue allows remote attackers to modify plugin settings and conduct cross-site scripting XSS attacks. This is due to the ajax.functions.php file not properly restricting acces...

CVE-2012-4021

MosP kintai kanri before 4.1.0 does not properly perform authentication, which allows remote authenticated users to impersonate arbitrary user accounts, and consequently obtain sensitive information or modify settings, via unspecified vectors...

CVE-2012-2596: Improper Control of Generation of Code

The XPath functionality in unspecified web applications in Siemens WinCC 7.0 SP3 before Update 2 does not properly handle special characters in parameters, which allows remote authenticated users to read or modify settings via a crafted URL, related to an "XML injection" attack...

PT-2012-4124

Name of the Vulnerable Software and Affected Versions Siemens WinCC version 7.0 SP3 before Update 2 Description The issue concerns the XPath functionality in web applications, which does not properly handle special characters in parameters. This allows remote authenticated users to read or modify...

CVE-2012-1250: Undefined Security Weakness

Logitec LAN-W300N/R routers with firmware before 2.27 do not properly restrict login access, which allows remote attackers to obtain administrative privileges and modify settings via vectors related to PPPoE authentication...

CVE-2012-2340

The Contact Forms module 7.x-1.x before 7.x-1.2 for Drupal does not specify sufficiently restrictive permissions, which allows remote authenticated users with the "access the site-wide contact form" permission to modify the module settings via unspecified vectors...

PT-2012-3962

Name of the Vulnerable Software and Affected Versions Contact Forms module versions 7.x-1.x before 7.x-1.2 Description The issue allows remote authenticated users with the access the site-wide contact form permission to modify the module settings. This is due to insufficiently restrictive...

CVE-2012-2340: Undefined Security Weakness

The Contact Forms module 7.x-1.x before 7.x-1.2 for Drupal does not specify sufficiently restrictive permissions, which allows remote authenticated users with the "access the site-wide contact form" permission to modify the module settings via unspecified vectors...

CVE-2011-3997

Opengear console servers with firmware before 2.2.1 allow remote attackers to bypass authentication, and modify settings or access connected equipment, via unspecified vectors...

Authentication flaw

Opengear console servers with firmware before 2.2.1 allow remote attackers to bypass authentication, and modify settings or access connected equipment, via unspecified vectors...

PT-2011-4809

Name of the Vulnerable Software and Affected Versions Opengear console servers versions prior to 2.2.1 Description The issue allows remote attackers to bypass authentication and modify settings or access connected equipment. Recommendations For versions prior to 2.2.1, update the firmware to...

CVE-2011-3997: Improper Authentication

Opengear console servers with firmware before 2.2.1 allow remote attackers to bypass authentication, and modify settings or access connected equipment, via unspecified vectors...

Opengear console servers vulnerable to authentication bypass

Overview Opengear console servers contains an authentication bypass vulnerability. Opengear console servers are for managing servers and network products. Opengear console servers contain an authentication bypass vulnerability. Tadayoshi Nakahira reported this vulnerability to IPA. JPCERT/CC...