Trend Micro Threat Discovery Appliance 2.6.1062r1 log_query_system.cgi Remote Code Execution

!/usr/local/bin/python """ Trend Micro Threat Discovery Appliance + eg: ./poc.py 172.16.175.123 admin123 saturn:trendmicrothreatdiscoverylogquerysystemrce mrme$ ./poc.py 172.16.175.123 admin123 + logged in... + starting backdoor, this will take a few secs... + calling backdoor! id uid=0root...

Trend Micro Threat Discovery Appliance 2.6.1062r1 log_query.cgi Remote Code Execution Exploit

Trend Micro Threat Discovery Appliance versions 2.6.1062r1 and below suffer from a logquery.cgi remote code execution vulnerability. !/usr/local/bin/python """ Trend Micro Threat Discovery Appliance + eg: ./poc.py 172.16.175.123 admin123 saturn:trendmicrothreatdiscoverylogqueryrce mrme$ ./poc.py...

Trend Micro Threat Discovery Appliance 2.6.1062r1 dlp_policy_upload.cgi Information Disclosure

!/usr/local/bin/python """ Trend Micro Threat Discovery Appliance + eg: ./poc.py 172.16.175.123 admin /etc/passwd saturn:trendmicrothreatdiscoverydlppolicyuploadlfd mrme$ ./poc.py 172.16.175.123 admin123 /etc/passwd + logged in... + downloading file... root:x:0:0:root:/root:/bin/true...

Trend Micro Threat Discovery Appliance 2.6.1062r1 dlp_policy_upload.cgi Information Disclosure Explo

Trend Micro Threat Discovery Appliance versions 2.6.1062r1 and below suffer from a dlppolicyupload.cgi information disclosure vulnerability. !/usr/local/bin/python """ Trend Micro Threat Discovery Appliance + eg: ./poc.py 172.16.175.123 admin /etc/passwd...

Pornhub: Weak user aunthentication on mobile application - I just broken userKey secret password

The researcher discovered a hard coded authentication bypass on the mobile app...

NTP Denial of Service Vulnerability (CNVD-2015-07022)

NTP Network Time Protocol is a network protocol that synchronizes the clocks of two computers by exchanging packets. A security vulnerability exists in NTP versions prior to 4.2.8p4 and 4.3.x prior to 4.3.77. Due to the program failing to properly use authentication and restriction mechanisms to...

PT-2015-3192

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine version 1.20.899 Description The issue is related to weaknesses in the authentication procedure of the Cisco Identity Services Engine guest portal. It allows a remote attacker to obtain sensitive information by...

Weak authentication in EMC Secure Remote Services Virtual Edition Web Portal

------------------------------------------------------------------------ Weak authentication in EMC Secure Remote Services Virtual Edition Web Portal ------------------------------------------------------------------------ Han Sahin, November 2014...

Cisco TelePresence Video Communication Server Expressway Password Change Vulnerability

The Cisco TelePresence Video Communication Server VCS Expressway is a telepresence video communication server. The Password Change feature in the Web management interface of the Cisco TelePresence VCS Expressway fails to properly perform authentication operations, allowing remote attackers to...

GetSimpleCMS 3.3.5 Multiple Vulnerabilities

Exploit for php platform in category web applications Vulnerability: XSS, Code Execution, DOS, Password Leak, Weak Authentication Affected Software: GetSimpleCMS http://get-simple.info/ Affected Version: 3.3.5 probably also prior versions Patched Version: 3.3.6 partial fix Risk: Medium-High Vendo...

GetSimpleCMS 3.3.5 XSS / Code Execution / DoS / Weak Auth

Vulnerability: XSS, Code Execution, DOS, Password Leak, Weak Authentication Affected Software: GetSimpleCMS http://get-simple.info/ Affected Version: 3.3.5 probably also prior versions Patched Version: 3.3.6 partial fix Risk: Medium-High Vendor Contacted: 2015-06-14 Vendor Partial Fix: 2015-07-14...

USN-2449-1 ntp vulnerabilities

Neel Mehta discovered that NTP generated weak authentication keys. A remote attacker could possibly use this issue to brute force the authentication key and send requests if permitted by IP restrictions. CVE-2014-9293 Stephen Roettger discovered that NTP generated weak MD5 keys. A remote attacker...

Apple iOS multiple security vulnerabilities

Weak authentication, unauthorized access, information leakage, race conditions, protection bypass, memory corruptions on different formats parsing, XXE...

Apple TV multiple security vulnerabilities

Weak authentication, unauthorized access, information leakage, race conditions, protection bypass, memory corruptions on different formats parsing...

CMSimple 4.4.4 RFI / Code Execution / Default Password

Exploit Title : CMSimple 4.4.4 various security vulnerability Author : Govind Singh aka NullPort Vendor : http://cmsimple.org/ Download Link : http://www.cmsimple.org/downloadcounter/dlcount/count.php?id=31 Date : 26/07/2014 Discovered at : IHT Lab 1ND14N H4X0R5 T34M Love to : Manish Tanwar,...

CMSimple 4.4.4 - color Remote Code Execution

CMSimple 4.4.4 - color Remote Code Execution source: https://www.securityfocus.com/bid/68961/info CMSimple is prone to multiple security vulnerabilities including: 1. Multiple arbitrary PHP code-execution vulnerabilities 2. A weak authentication security-bypass vulnerability 3. Multiple security...

CMSimple - Default Administrator Credentials

source: https://www.securityfocus.com/bid/68961/info CMSimple is prone to multiple security vulnerabilities including: 1. Multiple arbitrary PHP code-execution vulnerabilities 2. A weak authentication security-bypass vulnerability 3. Multiple security vulnerabilities An attacker can exploit these...

CMSimple 4.4.4 - Remote File Inclusion

CMSimple 4.4.4 - Remote File Inclusion source: https://www.securityfocus.com/bid/68961/info CMSimple is prone to multiple security vulnerabilities including: 1. Multiple arbitrary PHP code-execution vulnerabilities 2. A weak authentication security-bypass vulnerability 3. Multiple security...

CMSimple 4.4.4 - Remote File Inclusion

source: https://www.securityfocus.com/bid/68961/info CMSimple is prone to multiple security vulnerabilities including: 1. Multiple arbitrary PHP code-execution vulnerabilities 2. A weak authentication security-bypass vulnerability 3. Multiple security vulnerabilities An attacker can exploit these...

acFTP 1.4 Invalid Password Weak Authentication Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/6235/info A vulnerability has been reported for acFTP. Reportedly, acFTP allows users to authenticate without a valid password. An attacker can exploit this vulnerability and log on to the vulnerable FTP server without ne...