JVC IP-Camera VN-T216VPRU - Local File Disclosure

JVC IP-Camera VN-T216VPRU - Local File Disclosure 1. Advisory Information ======================================== Title : JVC IP-Camera VN-T216VPRU Local File Inclusion Vendor Homepage : http://pro.jvc.com/ Remotely Exploitable : Yes Tested on Camera types : VN-T216VPRU Product References :...

VideoIQ Camera - Local File Disclosure

Exploit for php platform in category web applications "cli" die$error0; if$argc "; echo"\nExample: php $argv0 localhost 8080"; die; ifisset$argv1 && isset$argv2 $host = $argv1; $port = $argv2; $pack = "GET /%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C..FILEPATH HTTP/1.0\r\n";...

VideoIQ Camera - Local File Disclosure

"cli" die$error0; if$argc "; echo"\nExample: php $argv0 localhost 8080"; die; ifisset$argv1 && isset$argv2 $host = $argv1; $port = $argv2; $pack = "GET /%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C..FILEPATH HTTP/1.0\r\n"; $pack.= "Host: $host\r\n"; $pack.= "Connection:...

JVC IP-Camera VN-T216VPRU - Local File Disclosure

Advisory Information ======================================== Title : JVC IP-Camera VN-T216VPRU Local File Inclusion Vendor Homepage : http://pro.jvc.com/ Remotely Exploitable : Yes Tested on Camera types : VN-T216VPRU Product References :...

VideoIQ Camera - Local File Disclosure

VideoIQ Camera - Local File Disclosure "cli" die$error0; if$argc "; echo"\nExample: php $argv0 localhost 8080"; die; ifisset$argv1 && isset$argv2 $host = $argv1; $port = $argv2; $pack = "GET /%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C..FILEPATH HTTP/1.0\r\n"; $pack.= "Host:...

JVC IP-Camera VN-T216VPRU - Credentials Disclosure

Advisory Information ======================================== Title : JVC IP-Camera VN-T216VPRU Remote Credentials Disclosure Vendor Homepage : http://pro.jvc.com/ Remotely Exploitable : Yes Tested on Camera types : VN-T216VPRU Product References :...

C2S DVR Management IRDOME-II-C2S IRBOX-II-C2S DVR - Credentials Disclosure Authentication Bypass

C2S DVR Management IRDOME-II-C2S IRBOX-II-C2S DVR - Credentials Disclosure Authentication Bypass 1. Advisory Information ======================================== Title : C2S DVR Management Remote Credentials Disclosure & Authentication Bypass Vendor Homepage : http://www.cash2s.com/en/ Remotely...

JVC IP-Camera VN-T216VPRU - Credentials Disclosure

JVC IP-Camera VN-T216VPRU - Credentials Disclosure 1. Advisory Information ======================================== Title : JVC IP-Camera VN-T216VPRU Remote Credentials Disclosure Vendor Homepage : http://pro.jvc.com/ Remotely Exploitable : Yes Tested on Camera types : VN-T216VPRU Product...

Vanderbilt IP-Camera CCPW3025-IR CVMW3025-IR - Credentials Disclosure

Vanderbilt IP-Camera CCPW3025-IR CVMW3025-IR - Credentials Disclosure 1. Advisory Information ======================================== Title : Vanderbilt IP-Camera CCPW3025-IR + CVMW3025-IR Remote Credentials Disclosure Vendor Homepage : https://is.spiap.com/ Remotely Exploitable : Yes Tested on...

SecNews: Querying private posts and changing post meta

Summary --- Unauthenticated user can run arbitrary post queries and insert arbitrary numeric post meta via vulnerable /wp-content/themes/SecNews-NewCustom/functions/ajax.php file. I'm including two exploits in one report because the fix for both is the same, i.e. delete ajax.php. Run arbitrary po...

WordPress WP Live Chat Support 6.2.03 Cross Site Scripting

------------------------------------------------------------------------ Stored Cross-Site Scripting vulnerability in WP Live Chat Support WordPress Plugin ------------------------------------------------------------------------ Dennis Kerdijk & Erwin Kievith , July 2016...

WordPress WP Live Chat Support 6.2.03 Plugin - Persistent Cross-Site Scripting

Exploit for php platform in category web applications Stored Cross-Site Scripting vulnerability in WP Live Chat Support WordPress Plugin Abstract A stored Cross-Site Scripting vulnerability was found in the WP Live Chat Support WordPress Plugin. This issue can be exploited by an unauthenticated...

Updated libupnp packages fix security vulnerability

libupnp's default behavior allows an unauthenticated user access to a server's filesystem through POST and GET requests CVE-2016-6255...

Server: Insecure Direct Object References in Gallery

ownCloud was vulnerable to a insecure direct object reference. Any unauthenticated user would be able to download any image from the server if the gallery app is enabled. For more information please consult the official advisory. This advisory is licensed CC BY-SA 4.0...

AirOS 6.x - Arbitrary File Upload

AirOS 6.x - Arbitrary File Upload EDB-Note Source: https://hackerone.com/reports/73480 Vulnerability It's possible to overwrite any file and create new ones on AirMax systems, because the "php2" maybe because of a patch don't verify the "filename" value of a POST request. It's possible to a...

AirOS 6.x - Arbitrary File Upload

Exploit for cgi platform in category web applications EDB-Note Source: https://hackerone.com/reports/73480 Vulnerability It's possible to overwrite any file and create new ones on AirMax systems, because the "php2" maybe because of a patch don't verify the "filename" value of a POST request. It's...

AirOS 6.x - Arbitrary File Upload

EDB-Note Source: https://hackerone.com/reports/73480 Vulnerability It's possible to overwrite any file and create new ones on AirMax systems, because the "php2" maybe because of a patch don't verify the "filename" value of a POST request. It's possible to a unauthenticated user to exploit this...

AirOS 6.x Arbitrary File Upload

Vulnerability It's possible to overwrite any file and create new ones on AirMax systems, because the "php2" maybe because of a patch don't verify the "filename" value of a POST request. It's possible to a unauthenticated user to exploit this vulnerability. Example Consider the following request:...

Unauthenticated Command Injection in Management Web Interface

Palo Alto Networks PAN-OS implements an API to enable programmatic device configuration and administration of the device. An issue was identified where the management API incorrectly parses input to a specific API call, leading to execution of arbitrary OS commands without authentication via the...

WordPress Booking Calendar Contact Form 1.0.23 Blind SQL Injection

Exploit Title: Wordpress booking calendar contact form =v1.0.23 - Unauthenticated blind SQL injection Date: 2016-02-08 Google Dork: Index of /wp-content/plugins/booking-calendar-contact-form Exploit Author: Joaquin Ramirez Martinez i0 SEC-LABORATORY Vendor Homepage: http://wordpress.dwbooster.com...