CVE-2017-7410

Multiple SQL injection vulnerabilities in account/signup.php and account/signup2.php in WebsiteBaker 2.10.0 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 username, 2 displayname parameter...

Splunk Enterprise Information Disclosure Vulnerability (SP-CAAAPZ3)

Splunk Enterprise is prone to an information disclosure vulnerability via JavaScript. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Moxa AWK-3131A 1.4 < 1.7 - 'Username' OS Command Injection

!/usr/bin/env python2 import telnetlib import re import random import string Split string into chunks, of which each is /var/a' - 1 completed = temp = re.split'\n', script for content in temp: if lencontent != 0: for s in re.split' ', content: if ' ' in s: s = '\x20' if '\n' in s: s = '\n' else:...

Moxa AWK-3131A 1.4 1.7 - Username OS Command Injection

Moxa AWK-3131A 1.4 1.7 - Username OS Command Injection !/usr/bin/env python2 import telnetlib import re import random import string Split string into chunks, of which each is /var/a' - 1 completed = temp = re.split'\n', script for content in temp: if lencontent != 0: for s in re.split' ', content...

CVE-2017-7318

Siklu EtherHaul devices before 7.4.0 are vulnerable to a remote command execution RCE vulnerability. This vulnerability allows a remote attacker to execute commands and retrieve information such as usernames and plaintext passwords from the device with no authentication...

Revive Adserver Elevation of Privilege Vulnerability

Revive Adserver is an open source advertising management system from the Revive Adserver team. The system provides ad placement, ad space management, data statistics and other functions. A security vulnerability exists in Revive Adserver versions prior to 3.2.5 and 4.0.0, which stems from the...

Netgear WNR2000v5 - 'hidden_lang_avi' Remote Stack Overflow (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'time' class MetasploitModule 'NETGEAR WNR2000v5 Unauthenticated hiddenlangavi Stack Overflow', 'Description' = %q The NETGEAR WNR2000 router h...

Information disclosure

USB Pratirodh is prone to sensitive information disclosure. It stores sensitive information such as username and password in simple usb.xml. An attacker with physical access to the system can modify the file according his own requirements that may aid in further attack...

CVE-2017-6911

CVE-2017-6911 refers to USB Pratirodh, a free security tool for USB storage control. The vulnerability is an insecure password/storage issue: sensitive information (e.g., usernames and passwords) is stored in a plain usb.xml file. An attacker with physical access can modify this file, potentially...

CA Arcserve D2D - GWT RPC Credential Information Disclosure (Metasploit)

Exploit for windows platform in category local exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'CA Arcserve D2D GWT RPC Credential Information Disclosure', 'Descriptio...

Citrix Receiver: Difference of Logon Experience When Logon StoreFront with a Locked Account by Using Username/password and Smart Card

This article is intended for Citrix administrators and technical teams only.Non-admin users must contact their company’s Help Desk/IT support team and can refer toCTX297149for more information This article describes user experience of using Pass-throughwith username and password or smart card log...

iFdate Social Dating Script 2.0 - SQL Injection

Exploit Title: iFdate Social Dating Script v2.0 - SQL Injection Google Dork: N/A Date: 18.03.2017 Vendor Homepage: http://turnkeycentral.com/ Software: http://turnkeycentral.com/scripts/social-dating-script/ Demo: http://demo.turnkeycentral.com/ifdate/index.php Version: 2.0 Tested on: Win7 x64,...

Reflective cross-site scripting vulnerability in multiple parameters of DuoDuo Rebate System V8.3_UTF8 official version

DuoDuo rebate system is for e-commerce rebate, shopping guide to provide solutions, is the open source PHP rebate site system. DuoDuoRebate.com system V8.3UTF8 official version February 10, 2017 There is a reflective cross-site scripting vulnerability. Due to the code parameter , ddusername...

tomcat: timing attack in Realm implementation

The Realm implementations did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder...

Code injection

OpenBSD 5.8 and 5.9 allows certain local users with kern.usermount privileges to cause a denial of service kernel panic by mounting a tmpfs with a VNOVAL in the 1 username, 2 groupname, or 3 device name of the root node...

CVE-2016-6246

OpenBSD 5.8 and 5.9 allows certain local users with kern.usermount privileges to cause a denial of service kernel panic by mounting a tmpfs with a VNOVAL in the 1 username, 2 groupname, or 3 device name of the root node...

CVE-2017-6351

The WePresent WiPG-1500 device with firmware 1.0.3.7 has a manufacturer account that has a hardcoded username / password. Once the device is set to DEBUG mode, an attacker can connect to the device using the telnet protocol and log into the device with the 'abarco' hardcoded manufacturer account...

CVE-2017-6351

WePresent WiPG-1500 devices (firmware up to 1.0.3.7) contain a hardcoded manufacturer account with a username/password. When DEBUG mode is enabled, an attacker can connect via telnet (port 5885) and log in using the hardcoded account abarco . This account is not documented, nor is the DEBUG featu...

CVE-2017-6351

The WePresent WiPG-1500 device with firmware 1.0.3.7 has a manufacturer account that has a hardcoded username / password. Once the device is set to DEBUG mode, an attacker can connect to the device using the telnet protocol and log into the device with the 'abarco' hardcoded manufacturer account...

Advanced Matrimonial Script 2.0.3 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Advanced Matrimonial Script v2.0.3 - SQL Injection Google Dork: N/A Date: 06.03.2017 Vendor Homepage: http://www.phpscriptsmall.com/ Software : http://www.phpscriptsmall.com/product/advanced-matrimonial/ Demo:...