PowerPress Podcasting < 6.0.5 - Authenticated Cross-Site Scripting (XSS)

By exploiting a Cross-site scripting vulnerability the attacker can hijack a logged in user’s session by stealing cookies. This means that the malicious hacker can change the logged in user’s password and invalidate the session of the victim while the hacker maintains access. PoC 1. Logon into an...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Auto-Exchanger 5.1.0 allows remote attackers to hijack the authentication of users for requests that change a password via a request to signup.php...

Auto-Exchanger 5.1.0 - Cross-Site Request Forgery

Auto-Exchanger 5.1.0 - Cross-Site Request Forgery INPUT type='hidden' maxLength=60 size=30 name="mail" id="mail" va...

Auto-Exchanger 5.1.0 - CSRF Vulnerability

Exploit for php platform in category web applications INPUT type='h...

Auto-Exchanger 5.1.0 - Cross-Site Request Forgery

label id...

Autoexchanger 5.1.0 Cross Site Request Forgery

Exploit Title: Auto-exchanger version 5.1.0 Xsrf Date: 2015/06/05 Exploit Author: Aryan Bayaninejad Linkedin : https://www.linkedin.com/profile/view?id=276969082 Vendor Homepage: www.auto-exchanger.com Version: Version 5.1.0 Demo : www.farhadexchange.com CVE : CVE-2015-6827...

Endian Firewall Proxy Password Change Command Injection

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit4 'Endian Firewall Proxy Password Change Command Injection', 'Description' = %q This module exploits an OS command injection...

Endian Firewall Proxy Password Change Command Injection Exploit

This Metasploit module exploits an OS command injection vulnerability in a web-accessible CGI script used to change passwords for locally-defined proxy user accounts. Valid credentials for such an account are required. Command execution will be in the context of the "nobody" account, but this...

HooToo Tripmate HT-TM01 2.000.022 - CSRF Vulnerabilities

Exploit for php platform in category web applications Exploit Title: HooToo Tripmate HT-TM01 Cross Site Request Forgery Date: 03Sep15 Exploit Author: Ken Smith Contact: https://twitter.com/P4tchw0rk Vendor Homepage: http://www.hootoo.com Version: HT-TM01, version 2.000.022 1. Description Various...

OpenVPN Access Server Default Credentials (SSH)

The remote OpenVPN Access Server is using known default credentials. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

HooToo Tripmate HT-TM01 2.000.022 - Cross-Site Request Forgery

Exploit Title: HooToo Tripmate HT-TM01 Cross Site Request Forgery Date: 03Sep15 Exploit Author: Ken Smith Contact: https://twitter.com/P4tchw0rk Vendor Homepage: http://www.hootoo.com Version: HT-TM01, version 2.000.022 1. Description Various functions in the device's admin web portal are...

Rockmongo Default Credentials (HTTP)

The remote Rockmongo web interface is using known default credentials. SPDX-FileCopyrightText: 2015 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later CPE =...

CVE-2015-4319

The password-change feature in the administrative web interface in Cisco TelePresence Video Communication Server VCS Expressway X8.5.1 improperly performs authorization, which allows remote authenticated users to reset arbitrary active-user passwords via unspecified vectors, aka Bug ID CSCuv12338...

Design/Logic Flaw

The password-change feature in the administrative web interface in Cisco TelePresence Video Communication Server VCS Expressway X8.5.1 improperly performs authorization, which allows remote authenticated users to reset arbitrary active-user passwords via unspecified vectors, aka Bug ID CSCuv12338...

CVE-2015-4319

The password-change feature in the administrative web interface in Cisco TelePresence Video Communication Server VCS Expressway X8.5.1 improperly performs authorization, which allows remote authenticated users to reset arbitrary active-user passwords via unspecified vectors, aka Bug ID CSCuv12338...

Cisco TelePresence Video Communication Server Expressway Password Change Vulnerability

The Cisco TelePresence Video Communication Server VCS Expressway is a telepresence video communication server. The Password Change feature in the Web management interface of the Cisco TelePresence VCS Expressway fails to properly perform authentication operations, allowing remote attackers to...

Cisco TelePresence Video Communication Server Expressway Logging Error Message Acquisition Vulnerability

Cisco TelePresence Video Communication Server is a video conferencing solution that integrates h.323 and SIP. A security vulnerability exists in Cisco TelePresence Video Communication Server Expressway, where the system records a password hash in the configuration log file when a user changes the...

Code injection

The Apple ID OD plug-in in Apple OS X before 10.10.5 allows attackers to change arbitrary user passwords via a crafted app...

CVE-2015-3799

The Apple ID OD plug-in in Apple OS X before 10.10.5 allows attackers to change arbitrary user passwords via a crafted app...

CVE-2015-3799

The CVE-2015-3799 entry concerns Apple OS X prior to 10.10.5 where the Apple ID OD Plug-in could allow an attacker to change a local user’s password via a crafted app. The issue is described as a password-authentication state-management problem in the Apple ID OD Plug-in, addressed by OS X 10.10....