MOXA EDR-G903 Series Multiple Vulnerabilities

OVERVIEW This advisory provides mitigation details for vulnerabilities that impact Moxa EDR-G903 Series Routers. Independent researcher Neil Smith identified a hard-coded user account vulnerability and an insufficient entropy vulnerability in Moxa’s EDR-G903 series routers. By impersonating the...

Supermicro IPMI Firmware CGI Scanner Remote Code Execution (CVE-2013-3621; CVE-2013-3623)

A buffer overflow vulnerability has been reported in the Supermicro IPMI Firmware. A remote attacker may exploit this issue by sending specially crafted messages to the target server. Exploitation of these vulnerabilities may result in remote code execution as the root user account...

[SECURITY] Fedora 20 Update: accountsservice-0.6.35-1.fc20

The accountsservice project provides a set of D-Bus interfaces for querying and manipulating user account information and an implementation of these interfaces, based on the useradd, usermod and userdel commands...

Cisco Video Surveillance 4000 Series IP Camera Default Credential Vulnerability

A vulnerability in the analytics page of the Cisco Video Surveillance 4000 Series IP Camera could allow an unauthenticated, remote attacker to gain access to the analytics pages of a Cisco Video Surveillance 4000 Series IP Camera. The vulnerability is due to an undocumented user account with a...

Active Directory - Enumerate User Account Policy

Binary data adsienumuseraccountpolicy.nbin...

Hikvision IP Cameras Overflow / Bypass / Privilege Escalation

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Hikvision IP Cameras Multiple Vulnerabilities 1. Advisory Information Title: Hikvision IP Cameras Multiple Vulnerabilities Advisory ID: CORE-2013-0708 Advisory URL:...

CVE-2013-3448

Cisco WebEx Meetings Server does not check whether a user account is active, which allows remote authenticated users to bypass intended access restrictions by performing meeting operations after account deactivation, aka Bug ID CSCuh33315...

Foreman (Red Hat OpenStack/Satellite) users/create Mass Assignment

This module exploits a mass assignment vulnerability in the 'create' action of 'users' controller of Foreman and Red Hat OpenStack/Satellite Foreman 1.2.0-RC1 and earlier by creating an arbitrary administrator account. For this exploit to work, your account must have 'createusers' permission e.g....

Zoom Telephonics (Multiple Devices) - Multiple Vulnerabilities

source: https://www.securityfocus.com/bid/61044/info Multiple Zoom Telephonics devices are prone to an information-disclosure vulnerability, multiple authentication bypass vulnerabilities and an SQL-injection vulnerability. Exploiting these issues could allow an attacker to gain unauthorized acce...

Credentials Test or Job Fails when attempt to use VIX

Challenge When using Veeam Backup & Replication with a VMware environment the following error may be seen when using the Guest Credentials Test or when processing a VM that is in a DMZ or Isolated environment. Failed to prepare guest for hot backup. Error: Failed to connect to guest agent. Errors...

shopex最新版前台一处想不到的SQL注入

简要描述： shopex代码核心的地方都做了加密处理，找漏洞就需要一点想象空间了，比如这个SQL注入... 详细说明： 存在于用户注册想不到的位置吧？ 1. /core/shop/controller/ctl.passport.php 267行 if !$info = $account-create$POST,$message ... 2.看到1，想到有没有可能$account-create是foreach $POST构造sql语句的呐？ 3.看数据表结构： 果断提交时$POST里加入memberid测试其实测试时我还试了mobile等，嘿，只捡有用的字段说，然后就有了下图： 漏洞证明：...

Spike the server security dogs V3. 3 official version—Added the user-to vulnerability and early warning-the black bar safety net

The first few pictures ha, is the result of my test. Follow my test figure to see. 1. First determine the guard function in the“account security daemon”is open. ! 0 0 2. Check the code ! 2 2 3. Save As a bat format to run, the process runs in the security dog will appear to intercept the tips,...

The wretched stream again to reset the hold which network any user password even commandeer a user account-bug warning-the black bar safety net

The problem lies in the hold which its happy to rent the site, the official people please read on: 1. Registered a user and logged in, found you can change the user mailbox; ! 2. Click on change mailbox, here is not carry out any check, even without operation of the verification code, to...

WeBid 1.0.6 - Multiple Vulnerabilities

Title: Webid Blind SQL Injection / Local File Disclosure Vulnerability Google Dork: intext:"Powered by WeBid" Author: Ahmed Aboul-Ela Contact: Ahmed.Aboul3laatgmaildotcom Vendor: http://www.webidsupport.com/ Software Link:...

CVE-2013-1170

The Cisco Prime Network Control System NCS appliance with software before 1.1.1.24 has a default password for the database user account, which makes it easier for remote attackers to change the configuration or cause a denial of service service disruption via unspecified vectors, aka Bug ID...

Cisco IOS Smart Install Configuration File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Cisco IOS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Smart Install client. A specially crafted packet can be sent to the SMI IBC server to...

Privilege escalation through Mozilla Maintenance Service — Mozilla

Security researcher Frédéric Hoguin discovered that the Mozilla Maintenance Service on Windows was vulnerable to a buffer overflow. This system is used to update software without invoking the User Account Control UAC prompt. The Mozilla Maintenance Service is configured to allow unprivileged user...

Alt-N MDaemon's WebAdmin Remote Code Execution Vulnerability

================================================================== Alt-N MDaemon's WebAdmin Remote Code Execution Vulnerability ================================================================== Software: Alt-N MDaemon v13.0.3 and prior versions Vendor: http://www.altn.com/ Vuln Type: Remote Code...

Alt-N MDaemon WebAdmin Remote Code Execution

================================================================== Alt-N MDaemon's WebAdmin Remote Code Execution Vulnerability ================================================================== Software: Alt-N MDaemon v13.0.3 and prior versions Vendor: http://www.altn.com/ Vuln Type: Remote Code...

Server: Multiple CSRF vulnerabilities

Multiple cross-site request forgery CSRF vulnerabilities in ownCloud 4.5.6 and 4.0.11 and all prior versions before allows remote attackers to hijack the authentication for users via the "lat" and "lng" POST parameters to guesstimezone.php in /apps/calendar/ajax/settings/ CVE-2013-0299 Commits:...