98 matches found
CVE-2017-8050
CVE-2017-8050 affects Tenable Appliance 4.4.0 (and possibly earlier) where a flaw in the Web UI enables unauthorized manipulation of the administrator password. The vulnerability is exploited via the Web UI without authentication, with potential impact on integrity (admin password changed by an a...
Stitch - Python Remote Administration Tool (RAT)
This is a cross platform python framework which allows you to build custom payloads for Windows, Mac OSX and Linux as well. You are able to select whether the payload binds to a specific IP and port, listens for a connection on a port, option to send an email of system info when the system boots,...
IBM Sterling B2B Integrator Authentication Bypass Vulnerability
IBM Sterling B2B Integrator is IBM's software for integrating critical B2B processes, transactions and relationships. The software supports secure integration of complex B2B processes with diverse partner communities. A security vulnerability exists in IBM Sterling B2B Integrator versions 5.1 and...
Qualys Security Advisory - userhelper / libuser
Qualys Security Advisory CVE-2015-3245 userhelper chfn newline filtering CVE-2015-3246 libuser passwd file handling -- Summary ----------------------------------------------------------------- The libuser library implements a standardized interface for manipulating and administering user and grou...
Prolink H5004NK Cross Site Request Forgery Vulnerability
PROLiNK H5004NK suffers from multiple cross site request forgery vulnerabilities. Exploit Title: PROLiNK H5004NK Multiple Vulnerabilities Date: 16-04-2015 Firmware: R76S Slt 4WNE1 6.1R Tested on: Windows 8 64-bit Exploit Author: Osanda Malith Jayathissa @OsandaMalith Disclaimer: Use this for...
PROLiNK H5004NK Cross Site Request Forgery
Exploit Title: PROLiNK H5004NK Multiple Vulnerabilities Date: 16-04-2015 Firmware: R76S Slt 4WNE1 6.1R Tested on: Windows 8 64-bit Exploit Author: Osanda Malith Jayathissa @OsandaMalith Disclaimer: Use this for educational purposes only! 1| Admin Password Manipulation XSRF...
frcms 注入 (可改任意用户密码 demo成功)#1
简要描述： rt。 详细说明： 在api/uc.php中 define'APIRETURNFORBIDDEN', '-2'; define'UCCLIENTROOT', FRROOT.'/ucclient'; includeonceFRROOT.'/api/apiconfig.php'; ifdefined'INUC' exit'Invalid Request'; else errorreporting0; setmagicquotesruntime0; !isset$db&&$db=connectdb; defined'MAGICQUOTESGPC' ||...
ZTE WXV10 W300 Disclosure / CSRF / Default
Exploit Title: ZTE WXV10 W300 Multiple Vulnerabilities Date: 17-05-2014 Server Version: RomPager/4.07 UPnP/1.0 Tested Routers: ZTE ZXV10 W300 Firmware: W300V1.0.0aZRDLK ADSL Firmware: FwVer:3.11.2.175TC3086 HwVer:T14.F75.0 Tested on: Kali Linux x8664 Exploit Author: Osanda Malith Jayathissa...
COMTREND CT-5361T Router - 'Password.cgi' Cross-Site Request Forgery (Admin Password Manipulation)
source: https://www.securityfocus.com/bid/67033/info Comtrend CT-5361T ADSL Router is prone to a cross-site scripting vulnerability and a cross-site request-forgery vulnerability. An attacker can exploit these vulnerabilities to execute arbitrary script code in the browser of an unsuspecting user...
Command School Student Management System - '/sw/Admin_change_Password.php' Cross-Site Request Forgery (Admin Password Manipulation)
source: https://www.securityfocus.com/bid/64707/info Command School Student Management System is prone to the following security vulnerabilities: 1. Multiple SQL-injection vulnerabilities 2. A cross-site request forgery vulnerability 3. A cross-site scripting vulnerability 4. An HTML injection...
Cisco EPC3925 - Cross-Site Request Forgery
Cisco EPC3925 - Cross-Site Request Forgery Exploit Title: Cisco EPC3925 � Cross Site Request Forgery Google Dork: N/A Date: 12-11-2013 Exploit Author: Jeroen - IT Nerdbox Vendor Homepage: http://www.cisco.com Software Link: Not public Version: epc3925-E10-5-v302r125572-130520c Tested on: Cisco...
PlaySMS <= 0.9.9.2 - CSRF Vulnerability
Exploit for php platform in category web applications Playsms is an open source SMS managment system , suffers from Cross-site request forgery through which attacker can manipulate user data via sending him malicious craft url. Playsms is not using any security token to prevent it against CSRF.Yo...
PBBoard - 'member_id' Validation Password Manipulation
source: https://www.securityfocus.com/bid/54916/info PBBoard is prone to multiple security vulnerabilities including: 1. Multiple SQL-injection vulnerabilities 2. A security-bypass vulnerability 3. An arbitrary file upload vulnerability Exploiting these issues could allow an attacker to carry out...
V5shop 8.2 version of the next pass to kill injection vulnerability-vulnerability warning-the black bar safety net
Vulnerability to harm: the high-risk A vulnerability file: cart. aspx Search keywords: inurl:scoreindex. aspx exp: the /cart. aspx? act=buy&id=1 and Select Top 1 char1 2 4%2BisNullcastName as varchar8 0 0 0,char3 2%2Bchar1 2 4%2BisNullcastPass as varchar8 0 0 0,char3 2%2Bchar1 2 4 From Select Top...
Openfire < 3.6.4 jabber:iq:auth Crafted password_change Request Password Manipulation
The remote host is running Openfire / Wildfire, an instant messaging server supporting the XMPP protocol. According to its version, the installation of Openfire or Wildfire fails to verify the owner of the account before changing the password for the account in response to an 'iq:auth' request. A...
[SA15494] FunkyASP AD System "password" SQL Injection Vulnerability
---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secuniavacancies/...
Openfire < 3.6.4 Arbitrary Password Manipulation
Binary data 5018.prm...
getpop3.txt
what?: =-getpop3 exploit-= who?: - by r3p3nt of the DHC - where?: - http://dhc1.cjb.net - contact?: - [email protected] greets: all of DHC, duke, f0rpaxe, artech, and eli up for some raceball? thanks: jwb [email protected] You are wondering "hmm..what is getpop3, mister r3p3nt". Well,...