CVE-2018-5768: Use of Hard-coded Credentials

A remote, unauthenticated attacker can gain remote code execution on the the Tenda AC15 router with a specially crafted password parameter for the COOKIE header...

Remote code execution

An issue was discovered on Tenda AC15 V15.03.1.16multi devices. A remote, unauthenticated attacker can gain remote code execution on the device with a crafted password parameter for the COOKIE header...

CVE-2018-5767: Improper Input Validation

An issue was discovered on Tenda AC15 V15.03.1.16multi devices. A remote, unauthenticated attacker can gain remote code execution on the device with a crafted password parameter for the COOKIE header...

PT-2018-17136

Name of the Vulnerable Software and Affected Versions: Tenda AC15 version 15.03.1.16 multi Description: A remote, unauthenticated attacker can gain remote code execution on the device by crafting a password parameter for the COOKIE header. Recommendations: For Tenda AC15 version 15.03.1.16 multi,...

PT-2018-1180

Name of the Vulnerable Software and Affected Versions Tenda AC15 router affected versions not specified Description The issue allows a remote, unauthenticated attacker to gain remote code execution on the device. It is related to the use of predefined credentials and can be exploited by a special...

CVE-2017-11679

Cross-Site Request Forgery CSRF exists in Hashtopus 1.5g via the password parameter to admin.php in an a=config action...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF exists in Hashtopus 1.5g via the password parameter to admin.php in an a=config action...

CVE-2017-11679

Cross-Site Request Forgery CSRF exists in Hashtopus 1.5g via the password parameter to admin.php in an a=config action...

PT-2017-12170

Name of the Vulnerable Software and Affected Versions Hashtopus version 1.5g Description A Cross-Site Request Forgery CSRF issue exists, allowing unauthorized actions via the password parameter to "admin.php" in an "a=config" action. Recommendations For version 1.5g, consider restricting access t...

CVE-2017-11679: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF exists in Hashtopus 1.5g via the password parameter to admin.php in an a=config action...

HazirSite SQL Injection Vulnerability

HazirSite girisyap.asp suffers from a SQL injection vulnerability. Allows remote attackers to bypass authentication via the 1 ka class or 2 sifre parameter...

Cross-Site Request Forgery Vulnerability in Multiple Arris Devices

Arris DG860A, TG862A, TG862G devices are modem products from the Arris Group of Companies. A cross-site request forgery vulnerability exists in the 'advpwdcgi' parameter in the web management interface of multiple Arris devices. A remote attacker could exploit this vulnerability to perform...

Web Reference Database Command Execution Vulnerability

Web Reference Database is a web-based multi-user interface product that provides search tools and automatic indexing for managing scientific literature. A vulnerability in the handling of the 'adminPassword' parameter in the Web Reference Databaseinstall.php script allows remote attackers to...

Multiple Cross-Site Scripting Vulnerabilities in SupportCenter Plus

SupportCenter Plus is a web-based customer support software. Multiple cross-site scripting vulnerabilities exist in SupportCenter Plus. Because input passed to the "/HomePage.do" script via the "fromCustomer" HTTP GET parameter, the "username" and "password" HTTP POST parameters are not properly...

CVE-2014-9451: Improper Restriction of Operations within the Bounds of a Memory Buffer

Multiple stack-based buffer overflows in the DIVA web service API /webservice in VDG Security SENSE formerly DIVA 2.3.13 allow remote attackers to execute arbitrary code via the 1 user or 2 password parameter in an AuthenticateUser request...

PT-2014-8937

Name of the Vulnerable Software and Affected Versions Bird Feeder plugin version 1.2.3 Description The issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks. This is achieved via the user or password parameter in th...

CVE-2014-9334: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Bird Feeder plugin 1.2.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 user or 2 password parameter in the bird-feeder page to...

CVE-2014-9340

Multiple cross-site request forgery CSRF vulnerabilities in the wpCommentTwit plugin 0.5 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 username or 2 password parameter in the...

CVE-2014-2061

The input control in PasswordParameterDefinition in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to obtain passwords by reading the HTML source code, related to the default value...

jenkins: clear text password disclosure (SECURITY-93)

The input control in PasswordParameterDefinition in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to obtain passwords by reading the HTML source code, related to the default value...