TBK DVR4104 DVR4216 - Credentials Leak

TBK DVR4104 DVR4216 - Credentials Leak -- coding: utf-8 -- import json import requests import argparse import tableprint as tp class Colors: BLUE = '\03394m' GREEN = '\03332m' RED = '\0330;31m' DEFAULT = '\0330m' ORANGE = '\03333m' WHITE = '\03397m' BOLD = '\0331m' BRCOLOUR = '\0331;37;40m' banne...

DLink DIR-601 - Admin Password Disclosure(CVE-2018-5708)

Description Having local access to the network but being unauthenticated to the administrator panel, a user can disclose the built in Admin username/password to access the admin panel 2. Proof of Concept For proof of concept, the real Admin password is "thisisatest" Step 1: Access default...

Dell EMC ScaleIO certification attempts to limit improper vulnerabilities

Dell EMC ScaleIO is a software-defined solution for converting DAS storage to shared data block storage from Dell, U.S.A. Light Installation Agent LIA is one of the installation agent programs. A security vulnerability exists in LIA in Dell EMC ScaleIO versions prior to 2.5, which stems from the...

How to suppress Citrix Receiver credentials prompt

This article describes how to suppress the Username\Password prompt in Citrix Receiver for Windows. Note : This article is applicable forReceiver for Windows 4.4.1000and later. Credential prompt as shown in the preceding screen shot will be displayed when a store has been configured at the Add...

Dodocool DC38 N300 - Cross-site Request Forgery Vulnerability

Exploit for php platform in category web applications Exploit Title: DODOCOOL DC38 N300 Cross-site Request Forgery Date: 17-01-2018 Exploit Authors: Raffaele Sabato Contact: https://twitter.com/syrion89 Vendor: DODOCOOL Vendor Homepage: www.dodocool.com Version: RTN2-AW.GD.R3465.1.20161103 CVE:...

Authentication flaw

Missing authentication for the remote configuration port 1236/tcp on the Cohu 3960HD allows an attacker to change configuration parameters such as IP address and username/password via specially crafted XML SOAP packets...

CVE-2017-8861

Missing authentication for the remote configuration port 1236/tcp on the Cohu 3960HD allows an attacker to change configuration parameters such as IP address and username/password via specially crafted XML SOAP packets...

Mozilla Firefox 55 - Denial of Service

Mozilla Firefox 55 - Denial of Service Exploit Title: Mozilla Firefox Firefox Lockout Vulnerability"; //Content to be forcibly viewed echo ""; //End echo "setTimeout"location.href ='".$location."';",10000;"; ? Solution: Update to version 55 https://www.mozilla.org/en-US/firefox/55.0/releasenotes/...

Mozilla Firefox < 55 - Denial of Service Exploit

Exploit for multiple platform in category dos / poc Exploit Title: Mozilla Firefox Firefox Lockout Vulnerability"; //Content to be forcibly viewed echo ""; //End echo "setTimeout"location.href ='".$location."';",10000;"; ? Solution: Update to version 55...

CVE-2017-1000092

Git Plugin connects to a user-specified Git repository as part of form validation. An attacker with no direct access to Jenkins but able to guess at a username/password credentials ID could trick a developer with job configuration permissions into following a link with a maliciously crafted Jenki...

jenkins-plugin-git: CSRF vulnerability allows capturing credentials (SECURITY-528)

The Git Plugin can leak credentials username and password used to access a git repo if an attacker-supplied URL is provided to the plugin. To supply the URL to the plugin, the attacker would need to guess a username/password ID and then trick a developer into following a specific URL...

CVE-2017-7783

If a long user name is used in a username/password combination in a site URL such as " http://UserName:[email protected]", the resulting modal prompt will hang in a non-responsive state or crash, causing a denial of service. This vulnerability affects Firefox 55...

U.S. Dept Of Defense: Multiple cryptographic vulnerabilities in login page on ███████

Summary: I realize that this report's title may not make sense yet. In one sentence: users logging in to the ███████ Server REST API Login page can have their passwords stolen by an attacker on the same LAN or WiFi as the victim trying to log in. Description: To save the reader any confusion, I'l...

CVE-2016-5762

Integer overflow in the Post Office Agent in Novell GroupWise before 2014 R2 Service Pack 1 Hot Patch 1 might allow remote attackers to execute arbitrary code via a long 1 username or 2 password, which triggers a heap-based buffer overflow...

Citrix Receiver: Difference of Logon Experience When Logon StoreFront with a Locked Account by Using Username/password and Smart Card

This article is intended for Citrix administrators and technical teams only.Non-admin users must contact their company’s Help Desk/IT support team and can refer toCTX297149for more information This article describes user experience of using Pass-throughwith username and password or smart card log...

CVE-2017-6351

The WePresent WiPG-1500 device with firmware 1.0.3.7 has a manufacturer account that has a hardcoded username / password. Once the device is set to DEBUG mode, an attacker can connect to the device using the telnet protocol and log into the device with the 'abarco' hardcoded manufacturer account...

Invalid password "nsgslbautosync: unable to establish master SSH connection: master process exited"

After changing the RPC passwords on our Netscalers, GSLB synchronization fails. Reverting to the default passwords allows GSLB sync to function. A non-default password is desired. Errors in the ns.log: "nsgslbautosync: Error executing command on gslb site...Reason: Error: Invalid username or...

NETWAVE IP Camera Password Disclosure Vulnerability

NETWAVE IP Camera is a webcam product. NETWAVE IP Camera suffers from a password disclosure vulnerability, which allows an attacker to obtain the username and password of the device via POC code, resulting in a password disclosure risk...

CVE-2016-6606

An issue was discovered in cookie encryption in phpMyAdmin. The decryption of the username/password is vulnerable to a padding oracle attack. This can allow an attacker who has access to a user's browser cookie file to decrypt the username and password. Furthermore, the same initialization vector...

Exagate WEBPack Management System SQL Injection Vulnerability

WEBPack Management System is a WEB-based hardware control software used by Exagate. An SQL injection vulnerability exists in the username and password parameters of the login.php page of the WEBPack Management System, which can be used by an attacker to compromise the application, access or modif...