Brother MFC-J6520DW - Authentication Bypass / Password Change

ASCII hex -- md5 e.g. AuthCookie=c243a9ee18a9327bfd419f31e75e71c7 for 'test' password This information can be used to crack current password from exported cookie. Fix: Minimize network access to Brother MFC device or disable HTTPS interface. Confirmed vulnerable: MFC-J6973CDW MFC-J4420DW MFC-8710...

Brother MFC-J6520DW - Authentication Bypass Password Change

Brother MFC-J6520DW - Authentication Bypass Password Change ASCII hex -- md5 e.g. AuthCookie=c243a9ee18a9327bfd419f31e75e71c7 for 'test' password This information can be used to crack current password from exported cookie. Fix: Minimize network access to Brother MFC device or disable HTTPS...

Default credentials

DISPUTED Riverbed RiOS through 9.6.0 has a weak default password for the secure vault, which makes it easier for physically proximate attackers to defeat the secure-vault protection mechanism by leveraging knowledge of the password algorithm and the appliance serial number. NOTE: the vendor...

JVN#55121369: CentreCOM AR260S V2 vulnerable to privilege escalation

​CentreCOM AR260S V2 provided by Allied Telesis K.K. is a wired LAN router. CentreCOM AR260S V2 contains a privilege escalation vulnerability. Impact Unintended operations may be performed with administrative privileges by a user who can log into the product with "guest" account. Solution Apply...

Logic Flaw Vulnerability at My NJ Client APP Change Password Function

My Nanjing Client APP is a city-level public service mobile application that integrates all kinds of living information in Nanjing. A logic flaw exists in the password change function of MyNJ Client APP. Since the original password is not verified when changing the password, it allows an attacker...

CVE-2017-6803

Multiple cross-site request forgery CSRF vulnerabilities in the web interface in the Scheduler in SolarWinds formerly Serv-U FTP Voyager 16.2.0 allow remote attackers to hijack the authentication of users for requests that 1 change the admin password, 2 terminate the scheduler, or 3 possibly...

CVE-2017-6803

Multiple cross-site request forgery CSRF vulnerabilities in the web interface in the Scheduler in SolarWinds formerly Serv-U FTP Voyager 16.2.0 allow remote attackers to hijack the authentication of users for requests that 1 change the admin password, 2 terminate the scheduler, or 3 possibly...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the web interface in the Scheduler in SolarWinds formerly Serv-U FTP Voyager 16.2.0 allow remote attackers to hijack the authentication of users for requests that 1 change the admin password, 2 terminate the scheduler, or 3 possibly...

Change of Expired LDAP Password on NetScaler During Log On Fails Intermittently

Changing the expired LDAP password at the time of user login via NetScaler Gateway due to password-expiry may fail and demonstrate itself on the login page as: "Incorrect credentials. Try again." or "Cannot connect. Try connecting again." ifEnhanced Authentication Feedback is enabled: At the time...

CVE-2017-6411

Cross Site Request Forgery CSRF on D-Link DSL-2730U C1 IN1.00 devices allows remote attackers to change the DNS or firewall configuration or any password...

CVE-2017-6411

Cross Site Request Forgery CSRF on D-Link DSL-2730U C1 IN1.00 devices allows remote attackers to change the DNS or firewall configuration or any password...

CVE-2017-6411

Cross Site Request Forgery CSRF on D-Link DSL-2730U C1 IN1.00 devices allows remote attackers to change the DNS or firewall configuration or any password...

PT-2017-16633 · D Link · D-Link Di-524 Wireless Router

Name of the Vulnerable Software and Affected Versions: D-Link DI-524 Wireless Router version 9.01 Description: The issue affects the D-Link DI-524 Wireless Router, allowing remote attackers to perform certain actions due to multiple cross-site request forgery CSRF vulnerabilities. These actions...

Invalid password "nsgslbautosync: unable to establish master SSH connection: master process exited"

After changing the RPC passwords on our Netscalers, GSLB synchronization fails. Reverting to the default passwords allows GSLB sync to function. A non-default password is desired. Errors in the ns.log: "nsgslbautosync: Error executing command on gslb site...Reason: Error: Invalid username or...

UBUNTU-CVE-2016-10206

Cross-site request forgery CSRF vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack the authentication of users for requests that change passwords and possibly have unspecified other impact as demonstrated by a crafted user action request to index.php...

CVE-2016-10206

Cross-site request forgery CSRF vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack the authentication of users for requests that change passwords and possibly have unspecified other impact as demonstrated by a crafted user action request to index.php...

CVE-2016-10206

Cross-site request forgery CSRF vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack the authentication of users for requests that change passwords and possibly have unspecified other impact as demonstrated by a crafted user action request to index.php...

D-Link DSL-2730U Wireless N 150 Cross Site Request Forgery

Author : B GOVIND Exploit Title : DLink DSL-2730U Wireless N 150, Change DNS Configuration bypassing aadmina privilege Date : 01-03-2017 Vendor Homepage : http://www.dlink.co.in Firmware Link : ftp://support.dlink.co.in/firmware/DSL-2730U Affected version : Hardware ver C1, Firmware ver: IN1.0.0...

CVE-2016-9315

CVE-2016-9315 affects Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 and earlier. The issue is a privilege-escalation in the com.trend.iwss.gui.servlet.updateaccountadministration servlet, where an authenticated, low-privilege user can change the Master Admin password or add new...

Happy Xiongbao Cloud Phone Watch Android app has arbitrary password reset vulnerability

Happy Xiongbao Cloud Phone Watch APP is an APP that works with the Happy Xiongbao Cloud Phone Watch hardware device. The Happy Xiongbao Cloud Phone Watch Android app has an arbitrary password reset vulnerability. It allows attackers to exploit the vulnerability to change the password of the other...