CVE-2014-9304

Plex Media Server before 0.9.9.3 allows remote attackers to bypass the web server whitelist, conduct SSRF attacks, and execute arbitrary administrative actions via multiple crafted X-Plex-Url headers to system/proxy, which are inconsistently processed by the request handler in the backend web...

CVE-2010-3893: Undefined Security Weakness

The administrator interface in IBM OmniFind Enterprise Edition 8.x and 9.x does not restrict use of a session ID aka SID value to a single IP address, which allows remote attackers to perform arbitrary administrative actions by leveraging cookie theft, related to a "session impersonation" issue...

Server: unrestricted access to CGI scripts

Red Hat Administration Server, as used by Red Hat Directory Server 8.0 EL4 and EL5, does not properly restrict access to CGI scripts, which allows remote attackers to perform administrative actions...

CVE-2008-1244: Improper Authentication

cgi-bin/setupdns.exe on the Belkin F5D7230-4 router with firmware 9.01.10 does not require authentication, which allows remote attackers to perform administrative actions, as demonstrated by changing a DNS server via the dns11, dns12, dns13, and dns14 parameters. NOTE: it was later reported that...

CVE-2007-4316: Undefined Security Weakness

The management interface in ZyNOS firmware 3.62WK.6 on the Zyxel Zywall 2 device has a certain default password, which allows remote attackers to perform administrative actions...