2762 matches found
CVE-2019-12502
There is a lack of CSRF countermeasures on MOBOTIX S14 MX-V4.2.1.61 cameras, as demonstrated by adding an admin account via the /admin/access URI...
Serv-U FTP Server 15.1.6.25 Local Privilege Escalation Vulnerability
Exploit for multiple platform in category local exploits CVE: CVE-2018-19999 Security researcher: Chris Moberly @ The Missing Link Security Product name: Serv-U FTP Server Product version: Tested on 15.1.6.25 current as of Dec 2018 Fixed in: 15.1.7 Overview The Serv-U FTP Server is vulnerable to...
The vulnerability of the remote execution service for the “Scanner-VS” security scanner allows access to the security scanner with superuser privileges.
The vulnerability of the remote execution service of the “Scanner-VS” security scanner is related to the presence of a pre-installed administrative account, whose information is not available in the documentation. Exploiting this vulnerability could allow a malicious actor, operating remotely, to...
ATutor 2.2.4 - Directory Traversal / Remote Code Execution,
This module exploits an arbitrary file upload vulnerability together with a directory traversal flaw in ATutor versions 2.2.4, 2.2.2 and 2.2.1 in order to execute arbitrary commands. It first creates a zip archive containing a malicious PHP file. The zip archive takes advantage of a directory...
Cross site scripting
TP-Link Archer CR-700 1.0.6 devices have an XSS vulnerability that can be introduced into the admin account through a DHCP request, allowing the attacker to steal the cookie information, which contains the base64 encoded username and password...
CVE-2016-10719
TP-Link Archer CR-700 1.0.6 devices have an XSS vulnerability that can be introduced into the admin account through a DHCP request, allowing the attacker to steal the cookie information, which contains the base64 encoded username and password...
CVE-2016-10719
TP-Link Archer CR-700 1.0.6 devices have an XSS vulnerability that can be introduced into the admin account through a DHCP request, allowing the attacker to steal the cookie information, which contains the base64 encoded username and password...
CVE-2016-10719
TP-Link Archer CR-700 (firmware 1.0.6) is affected by a cross-site scripting (XSS) vulnerability that can be triggered via a DHCP request to inject script into the admin session. The exploit could lead to theft of cookies containing base64-encoded username and password information. Affected compo...
Spoofing
A user having access to the UI of a Revive Adserver instance could be tricked into clicking on a specifically crafted admin account-switch.php URL that would eventually lead them to another unsafe domain, potentially used for stealing credentials or other phishing attacks. This vulnerability was...
Design/Logic Flaw
An issue was discovered in JFrog Artifactory 6.7.3. By default, the access-admin account is used to reset the password of the admin account in case an administrator gets locked out from the Artifactory console. This is only allowable from a connection directly from localhost, but providing a...
CVE-2019-9733
JFrog Artifactory 6.7.3 is vulnerable to an admin login bypass: an unauthenticated user can exploit the X-Forwarded-For header to login as the admin by abusing the access-admin reset path, bypassing IP whitelists and potentially obtaining tokens to control all artifacts and repositories. Root cau...
CVE-2019-10644
HYBBS 2.2 has a CSRF vulnerability on the /?admin/user.html page that can add an administrator account. The connected sources confirm the affected software/version and the vulnerable endpoint; no exploit details or fixes are provided in the documents. No root-cause or remediation specifics are st...
CVE-2019-10644
An issue was discovered in HYBBS 2.2. /?admin/user.html has a CSRF vulnerability that can add an administrator account...
CVE-2019-1569
The Expedition Migration tool 1.1.8 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the User Mapping Settings for account name of admin user...
CVE-2019-1569
The Expedition Migration tool 1.1.8 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the User Mapping Settings for account name of admin user...
JFrog Artifactory Administrator Authentication Bypass
CipherTechs Inc - Security Advisory JFrog Artifactory Administrator Authentication Bypass Introduction ============ JFrog Artifactory https://jfrog.com/artifactory/ is a popular universal artifact repository manager commonly used by software developers. CipherTechs' Red Team discovered a high ris...
Cross site request forgery (csrf)
sftnow through 2018-12-29 allows index.php?g=Admin&m=User&a=addpost CSRF to add an admin account...
CVE-2019-9688
sftnow through 2018-12-29 allows index.php?g=Admin&m=User&a=addpost CSRF to add an admin account...
CVE-2019-9688
CVE-2019-9688 (sftnow) is a CSRF vulnerability in sftnow up to 2018-12-29 that allows an attacker to trigger index.php?g=Admin&m=User&a=add_post to add an admin account. Connected sources confirm a cross-site request forgery flaw exists in sftnow 2018-12-29 and earlier versions. The provided docu...