12664 matches found
Information disclosure
USB Pratirodh is prone to sensitive information disclosure. It stores sensitive information such as username and password in simple usb.xml. An attacker with physical access to the system can modify the file according his own requirements that may aid in further attack...
CVE-2017-6911
CVE-2017-6911 refers to USB Pratirodh, a free security tool for USB storage control. The vulnerability is an insecure password/storage issue: sensitive information (e.g., usernames and passwords) is stored in a plain usb.xml file. An attacker with physical access can modify this file, potentially...
CA Arcserve D2D - GWT RPC Credential Information Disclosure (Metasploit)
Exploit for windows platform in category local exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'CA Arcserve D2D GWT RPC Credential Information Disclosure', 'Descriptio...
Citrix Receiver: Difference of Logon Experience When Logon StoreFront with a Locked Account by Using Username/password and Smart Card
This article is intended for Citrix administrators and technical teams only.Non-admin users must contact their company’s Help Desk/IT support team and can refer toCTX297149for more information This article describes user experience of using Pass-throughwith username and password or smart card log...
iFdate Social Dating Script 2.0 - SQL Injection
Exploit Title: iFdate Social Dating Script v2.0 - SQL Injection Google Dork: N/A Date: 18.03.2017 Vendor Homepage: http://turnkeycentral.com/ Software: http://turnkeycentral.com/scripts/social-dating-script/ Demo: http://demo.turnkeycentral.com/ifdate/index.php Version: 2.0 Tested on: Win7 x64,...
Reflective cross-site scripting vulnerability in multiple parameters of DuoDuo Rebate System V8.3_UTF8 official version
DuoDuo rebate system is for e-commerce rebate, shopping guide to provide solutions, is the open source PHP rebate site system. DuoDuoRebate.com system V8.3UTF8 official version February 10, 2017 There is a reflective cross-site scripting vulnerability. Due to the code parameter , ddusername...
tomcat: timing attack in Realm implementation
The Realm implementations did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder...
Code injection
OpenBSD 5.8 and 5.9 allows certain local users with kern.usermount privileges to cause a denial of service kernel panic by mounting a tmpfs with a VNOVAL in the 1 username, 2 groupname, or 3 device name of the root node...
CVE-2016-6246
OpenBSD 5.8 and 5.9 allows certain local users with kern.usermount privileges to cause a denial of service kernel panic by mounting a tmpfs with a VNOVAL in the 1 username, 2 groupname, or 3 device name of the root node...
CVE-2017-6351
The WePresent WiPG-1500 device with firmware 1.0.3.7 has a manufacturer account that has a hardcoded username / password. Once the device is set to DEBUG mode, an attacker can connect to the device using the telnet protocol and log into the device with the 'abarco' hardcoded manufacturer account...
CVE-2017-6351
WePresent WiPG-1500 devices (firmware up to 1.0.3.7) contain a hardcoded manufacturer account with a username/password. When DEBUG mode is enabled, an attacker can connect via telnet (port 5885) and log in using the hardcoded account abarco . This account is not documented, nor is the DEBUG featu...
CVE-2017-6351
The WePresent WiPG-1500 device with firmware 1.0.3.7 has a manufacturer account that has a hardcoded username / password. Once the device is set to DEBUG mode, an attacker can connect to the device using the telnet protocol and log into the device with the 'abarco' hardcoded manufacturer account...
Advanced Matrimonial Script 2.0.3 - SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: Advanced Matrimonial Script v2.0.3 - SQL Injection Google Dork: N/A Date: 06.03.2017 Vendor Homepage: http://www.phpscriptsmall.com/ Software : http://www.phpscriptsmall.com/product/advanced-matrimonial/ Demo:...
MLM Forced Matrix 2.0.7 - SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: MLM Forced Matrix v2.0.7 - SQL Injection Google Dork: N/A Date: 06.03.2017 Vendor Homepage: http://www.phpscriptsmall.com/ Software : http://www.phpscriptsmall.com/product/mlm-forced-matrix/ Demo: http://74.124.215.220/forctrix/...
Invalid password "nsgslbautosync: unable to establish master SSH connection: master process exited"
After changing the RPC passwords on our Netscalers, GSLB synchronization fails. Reverting to the default passwords allows GSLB sync to function. A non-default password is desired. Errors in the ns.log: "nsgslbautosync: Error executing command on gslb site...Reason: Error: Invalid username or...
Wordpress < 4.7.1 - Username Enumeration (CVE-2017-5487)
Author: p0wd3r know Chong Yu 404 security lab Date: 2017-03-05 0x00 vulnerability overview Vulnerability description Recently exploit-db is published on a Wordpress 4.7.1 username enumeration vulnerabilities: , in fact, the vulnerability to 1-month 14, has been posted on the Internet, and given t...
CVE-2016-7406
Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in the 1 username or 2 host argument...
DEBIAN-CVE-2016-7406
Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in the 1 username or 2 host argument...