TimeClock CSRF Remote Add Admin Exploit

No description provided by source...

ibPhotohost 1.1.2 - SQL Injection

No description provided by source. + + Title: ibPhotohost 1.1.2 SQL Injection + Author: fred777 - fred777.5x.to + Link: http://mods.invisionize.com/index.php/f/7609 + Vuln: index.php?autocom=photohost&CODE=04&img=SQL Injection + Greetzz to: back2hack,free-hack,hackbase,c-c + Contact:...

SilverPlatter WebSPIRS 3.3.1 File Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2362/info A remote user could gain read access to known files outside of the root directory where SilverPlatter WebSPIRS resides. Requesting a specially crafted URL composed of '../' sequences along with the known filenam...

XAMPP 1.8.1 (lang.php, WriteIntoLocalDisk method) - Local Write Access Vulnerability

No description provided by source. 通过访问以下链接： http://www.example.com/xampp/lang.php?WriteIntoLocalDisk 发现以下文件已经被修改： http://www.example.com/xampp/lang.tmp EXPLOIT-DB来源：https://www.exploit-db.com/exploits/28654/...

QNAP Turbo NAS TS-1279U-RP Multiple Path Injection

No description provided by source. Exploit Title: QNAP Turbo NAS Multiple Path Injection Date: 2012-09-04 Exploit Author: Andrea Fabrizi Vendor Homepage: http://www.qnap.com/ Version: = 3.7.3 build 20120801 Tested on: QNAP TS-1279U-RP This vulnerability has been discovered on QNAP TS-1279U-RP, bu...

MS Windows 2000/NT 4/XP Window Message Subsystem Design Error Vulnerability (4)

No description provided by source. source: http://www.securityfocus.com/bid/5408/info A serious design error in the Win32 API has been reported. The issue is related to the inter-window message passing system. This vulnerability is wide-ranging and likely affects almost every Win32 window-based...

Google Hack Honeypot File Upload Manager 1.3 'delall' Unauthorized File Access Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/27877/info Google Hack Honeypot File Upload Manager is prone to an unauthorized file-access vulnerability. This issue occurs because the application fails to validate users before processing a certain HTTP request...

Critical: Red Hat Security Advisory: java-1.7.0-openjdk security update

Updated java-1.7.0-openjdk packages that fix various security issues are now available for Red Hat Enterprise Linux 7. The Red Hat Security Response Team has rated this update as having Critical security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...

Hardcoded credentials

SAP Web Services Tool CA-WUI-WST has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors...

CVE-2014-4011

CVE-2014-4011 concerns SAP Capacity Leveling where credentials are hardcoded, enabling remote access via unspecified vectors. The available sources confirm the issue and its impact as partial confidentiality compromise with potential unauthorized access, but do not provide concrete exploit detail...

CVE-2014-4006

The CVE-2014-4006 entry concerns the SAP Trader’s and Scheduler’s Workbench (TSW) for SAP Oil & Gas, where hardcoded credentials are present. This flaw can enable remote access for an attacker via unspecified vectors. The vulnerability is documented in multiple sources (NVD entry and related reco...

Design/Logic Flaw

The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion provide an undocumented access method involving the FTP protocol, which allows remote attackers to execute arbitrary code or cause a denial of service application crash via...

CVE-2014-0760 Festo CECX-X-(C1/M1) Controller Improper Authentication

The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion provide an undocumented access method involving the FTP protocol, which could allow a remote attacker to execute arbitrary code or cause a denial of service application crash vi...

PT-2014-08: Password Access in Solar-Log

The specialists of the Positive Research center have detected a Password Access vulnerability in Solar-Log. Application uses some kind of "encryption" for password stored in the configuration file with a static key. Attacker can get a password in plain text. How to fix Update your firmware up to...

Hardcoded credentials

SAP Business Object Processing Framework BOPF for ABAP has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors...

CVE-2011-3153

dmrc.c in Light Display Manager aka LightDM before 1.1.1 allows local users to read arbitrary files via a symlink attack on /.dmrc...

Linksys Routers Vulnerable to Remote Access Vulnerability

Linksys routers sold to consumers as a home or small office networking box are vulnerable to a simple exploit that could give an attacker remote access to the router. The vulnerabilities are wormable, yet are unrelated to the Moon worm reported last week by the SANS Institute. Linksys, which was...

CVE-2013-4041

CVE-2013-4041 is an IBM Java SDK vulnerability affecting IBM SDK Java Technology Edition versions 5.0, 6, and 7 (and related WebSphere bundles) where code running under a security manager could access restricted classes via an unspecified vector. The IBM notices detail multiple CVEs in the Oracle...

CVE-2013-6282

The 1 getuser and 2 putuser API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against...

PineApp MailSecure - Remote Command Execution

----------------------------------------------------------------- It is possible execute any command bash as qmailq unprivilege user, sending only the following https request, without authentication...