NAS4Free Web UI Default Credentials

The NAS4Free web interface on the remote host has the 'admin' user account secured with the default password. A remote, unauthenticated attacker could exploit this to gain administrative access to the web interface, which could allow arbitrary command execution via exec.php. %NASLMINLEVEL 70300 C...

Cisco Content Security Management Appliance Web UI Default Credentials

It is possible to log into Cisco Content Security Management Appliance's web management console using default credentials. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid73301; scriptversion"1.5";...

Design/Logic Flaw

The Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to bypass intended access restrictions and execute arbitrary commands via unspecified vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-0884

CVE-2014-0884 affects IBM Lotus Protector for Mail Security (Admin Web UI) on 2.8.x before 2.8.1-22905. A cross-site scripting (XSS) vulnerability allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. The root cause is not detailed in the provided docum...

CVE-2014-0887

The Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to execute arbitrary commands with root privileges via unspecified vectors...

PT-2014-3918

Name of the Vulnerable Software and Affected Versions IBM Lotus Protector for Mail Security versions 2.8.x through 2.8.1-22904 Description A cross-site scripting XSS issue exists in the Admin Web UI, allowing remote authenticated users to inject arbitrary web script or HTML. This can be achieved...

CVE-2014-0887: Improper Neutralization of Special Elements used in an OS Command

The Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to execute arbitrary commands with root privileges via unspecified vectors...

CVE-2014-0884: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-0886: Improper Neutralization of Special Elements used in an OS Command

The Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to bypass intended access restrictions and execute arbitrary commands via unspecified vectors...

CVE-2014-0885: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors...

PT-2014-3919

Name of the Vulnerable Software and Affected Versions IBM Lotus Protector for Mail Security versions 2.8.x through 2.8.0 Description A cross-site request forgery CSRF issue exists in the Admin Web UI, allowing remote authenticated users to hijack the authentication of victims via unknown vectors...

Ability Mail Server 2013 - Password Reset CSRF from Stored XSS (Web UI)

Exploit for windows platform in category web applications On one machine Windows Server 2003, install a new instance of AMS with these configurations 1. Primary Domain: hack.local 2. Enable the WebMail Service 3. Domain Name: hack.local 4. Add a User and set Password. In this case I created a use...

Updated nagios package fixes security vulnerability

A flaw was reported and fixed in Nagios, which can be exploited to cause a denial of service. This vulnerability is caused due to an off-by-one error within the processcgivars function, which can be exploited to cause an out-of-bounds read by sending a specially-crafted key value to the Nagios we...

Conceptronic CIPCAMPTIWL 21.37.2.49 Cross Site Request Forgery

Hello List, Here I inform you about an easily exploitable CSRF discovered in Conceptronic cameras CIPCAMPTIWL. General Details Affected Product: Conceptronic camera CIPCAMPTIWL Tested Firmware: 21.37.2.49 Tested Web UI Firmware: 0.61.4.18 Assigned CVE: CVE-2013-7204 CVSSv2 Base Score: 5.8...

Ability Mail Server 2013 3.1.1 - Web UI Persistent Cross-Site Scripting

Ability Mail Server 2013 3.1.1 - Web UI Persistent Cross-Site Scripting !/usr/bin/env python ''' Exploit Title: Ability Mail Server 2013 Stored XSS Date: 12/20/2013 Exploit Author: David Um Vendor Homepage: http://www.code-crafters.com/ Software Link: http://download.code-crafters.com/ams.exe...

Ability Mail Server 2013 3.1.1 - Web UI Persistent Cross-Site Scripting

!/usr/bin/env python ''' Exploit Title: Ability Mail Server 2013 Stored XSS Date: 12/20/2013 Exploit Author: David Um Vendor Homepage: http://www.code-crafters.com/ Software Link: http://download.code-crafters.com/ams.exe Version: 3.1.1 Tested on: Windows Server 2003 SP2 CVE : CVE-2013-6162...

Palo Alto Networks PAN-OS Firewall/Panorama Web UI Detection

Binary data paloaltowebuidetect.nbin...

Intersystems Cache Remote Code Execution (via Default 'Minimal Security' Install)

------------------- 1 Overview Title: Intersystems Cache Remote Code Execution via Default 'Minimal Security' Install Product: Intersystems Cache Product URL: http://www.intersystems.com/cache/index.html Vendor: Intersystems Affected Versions: Tested on Cache for Windows x86-64 & i386 2009. thru...