2762 matches found
Cross site request forgery (csrf)
An issue was discovered in PublicCMS V4.0.20180210. There is a CSRF vulnerability in "admin/sysUser/save.do?callbackType=closeCurrent&navTabId=sysUser/list" that can add an admin account...
CVE-2018-11500
PublicCMS 4.0.20180210 contains a CSRF vulnerability in admin/sysUser/save.do?callbackType=closeCurrent&navTabId=sysUser/list that can be exploited to add an administrator account. This is the CVE-2018-11500 issue (NVD CVSSv3.0 base score 8.8; CVSSv2 base 6.8). The vulnerability is client-side re...
CVE-2018-11500
An issue was discovered in PublicCMS V4.0.20180210. There is a CSRF vulnerability in "admin/sysUser/save.do?callbackType=closeCurrent&navTabId=sysUser/list" that can add an admin account...
D-Link DIR-620 Router Information Disclosure Vulnerability
D-link DIR-620 is a wireless router product of AUO D-Link. web server is one of the web servers. A security vulnerability exists in the web server of the D-Link DIR-620, which originates from the use of a hard-coded password for the admin account. An attacker can exploit this vulnerability to...
PT-2018-3887 · D Link · Dir-620
Name of the Vulnerable Software and Affected Versions: D-Link DIR-620 devices with customized firmware versions 1.0.3, 1.0.37, 1.3.1, 1.3.3, 1.3.7, 1.4.0, and 2.0.22 Description: The issue is related to a hardcoded password for the admin account, specifically set to anonymous. This could allow a...
NodAPS 4.0 - SQL injection Cross-Site Request Forgery
NodAPS 4.0 - SQL injection Cross-Site Request Forgery Exploit Title: Online Booking system - NodAPS 4.0 - 'search' SQL injection / Cross-Site Request Forgery Date: 2018-05-16 Exploit Author: Borna nematzadeh L0RD Vendor Homepage:...
Arris Touchstone Telephony Gateway TG1682G Weak Password Vulnerability
The Arris Touchstone Telephony Gateway TG1682G is an all-in-one Modem modem router from the Arris Group of Companies. A security vulnerability exists in the Arris Touchstone Telephony Gateway TG1682G version 9.1.103J6, which originates from the use of the default password: password for the admin...
CVE-2018-11126
dg-user/?controller=users&action=add in doorGets 7.0 has CSRF that results in adding an administrator account...
CVE-2018-11126
dg-user/?controller=users&action=add in doorGets 7.0 has CSRF that results in adding an administrator account...
CVE-2018-11018
An issue was discovered in PbootCMS v1.0.7. Cross-site request forgery CSRF vulnerability in apps/admin/controller/system/RoleController.php allows remote attackers to add administrator accounts via admin.php/role/add.html...
CVE-2018-9112
A low privileged admin account with a weak default password of admin exists on the Foxconn FEMTO AP-FC4064-T APGTB385.8.3lb15-W47 LTE Build 15. In addition, its web management page relies on the existence or values of cookies when performing security-critical operations. One can gain privileges b...
CVE-2018-9112
A low privileged admin account with a weak default password of admin exists on the Foxconn FEMTO AP-FC4064-T APGTB385.8.3lb15-W47 LTE Build 15. In addition, its web management page relies on the existence or values of cookies when performing security-critical operations. One can gain privileges b...
Directus Elevation of Privilege Vulnerability
Directus is a content management system CMS. A security vulnerability exists in Directus version 6.4.9 that stems from the use of a hard-coded password: admin for the Admin account, which can be exploited by an attacker to elevate privileges...
CVE-2018-10723
Directus 6.4.9 contains a hardcoded admin password for the Admin account caused by an INSERT in api/schema.sql. Multiple sources (CNVD-2018-09196, NVD CVE-2018-10723, OSV, PRION) describe this as an elevation of privilege/vector involving a hardcoded credential, enabling potential administrator a...
CVE-2018-6401
Meross MSS110 devices before 1.1.24 contain a TELNET listener providing access for an undocumented admin account with a blank password...
Default credentials
Meross MSS110 devices before 1.1.24 contain a TELNET listener providing access for an undocumented admin account with a blank password...
CVE-2018-6401
Meross MSS110 devices before 1.1.24 contain a TELNET listener providing access for an undocumented admin account with a blank password...
baijiacms cross-site request forgery vulnerability (CNVD-2018-08921)
baijiacms is a content management system CMS for e-commerce. A cross-site request forgery vulnerability exists in the index.php file in baijiacms version 4 41420170105. The vulnerability can be exploited by a remote attacker to add an administrator account, change an administrator password, or...
