Cisco Fixes Blank Admin Password Flaw in TelePresence Product

Cisco has patched a number of vulnerabilities in several separate products, including a serious remote code execution flaw in its Wide Area Application Services Mobile software that could allow an attacker to take complete control of a vulnerable device. Cisco also has patched a vulnerability in...

Hewlett-Packard 2620 Switch Series Admin Account CSRF Vulnerability

Exploit Title: Hewlett-Packard 2620 Switch Series. Edit Admin Account - CSRF Vulnerability Date: 26.09.2013r. Exploit Author: Hubert Grądek PL Software Link: download link if available Tested on: HP-E2620 24-PoEP // RA.15.05.0006,ROMRA.15.10 CVE : No CVE exists - 0day exploit This is private...

Hewlett-Packard (HP) 2620 Switch Series. Edit Admin Account - Cross-Site Request Forgery

Hewlett-Packard HP 2620 Switch Series. Edit Admin Account - Cross-Site Request Forgery Exploit Title: Hewlett-Packard 2620 Switch Series. Edit Admin Account - CSRF Vulnerability Date: 26.09.2013r. Exploit Author: Hubert GrÄ…dek PL Software Link: download link if available Tested on: HP-E2620...

Mac's CMS 1.1.4 - Multiple Vulnerabilities

Exploit Title: Mac's CMS - Multiple vilnerabilities Date: 2013 14 August Exploit Author: Yashar shahinzadeh Special thanks to Mormoroth Credit goes for: http://y-shahinzadeh.ir & ha.cker.ir Vendor Homepage: http://macs-framework.sourceforge.net/ Tested on: Linux & Windows, PHP 5.3.4 Affected...

Spitefire CMS 1.1.4 Cross Site Request Forgery

Exploit Title: spitefire CMS - CSRF / ADD / EDTI / UPLOAD FILE Date: 2013 15 August Exploit Author: Yashar shahinzadeh Special thanks to Mormoroth Credit goes for: http://y-shahinzadeh.ir & ha.cker.ir Vendor Homepage: http://spitfire.clausmuus.de/ Tested on: Linux & Windows, PHP 5.2.9 Affected...

Bigace CMS 2.7.8 - Add Admin Account CSRF

Exploit for php platform in category web applications document.myForm.submit; 0day.today 2018-04-05...

Rite CMS 1.0.0 Cross Site Request Forgery / Cross Site Scripting

Exploit Title: RiteCMS multiple vulnerabilities Date: 2013 30 July Exploit Author: Yashar shahinzadeh Credit goes for: ha.cker.ir Vendor Homepage: http://ritecms.com/ Tested on: Linux & Windows, PHP 5.2.9 Affected Version : 1.0.0 Contacts: http://Twitter.com/YShahinzadeh , http://y-shahinzadeh.ir...

BigACE 2.7.8 - Cross-Site Request Forgery (Add Admin)

Exploit Title: Bigace CMS CSRF - Adding an admin account Date: 2013 29 July Exploit Author: Yashar shahinzadeh Credit goes for: ha.cker.ir Vendor Homepage: http://www.bigace.de/ Tested on: Linux & Windows, PHP 5.2.9 Affected Version : 2.7.8 Contacts: http://Twitter.com/YShahinzadeh ,...

Western Digital My Net Password Disclosure

Vulnerable Systems: Western Digital My Net Series Wireless Routers: N600 Firmware 1.03.12 N600 Firmware 1.04.16 N750 Firmware 1.03.12 N750 Firmware 1.04.16 N900 Firmware 1.05.12 N900 Firmware 1.06.18 N900 Firmware 1.06.28 N900C Firmware 1.05.12 N900C Firmware 1.06.18 N900C Firmware 1.06.28 CVE...

Bigace CMS 2.7.8 Cross Site Request Forgery

Exploit Title: Bigace CMS CSRF - Adding an admin account Date: 2013 29 July Exploit Author: Yashar shahinzadeh Credit goes for: ha.cker.ir Vendor Homepage: http://www.bigace.de/ Tested on: Linux & Windows, PHP 5.2.9 Affected Version : 2.7.8 Contacts: http://Twitter.com/YShahinzadeh ,...

B2Bbuilder injection vulnerability+Exp+the default administrator account-vulnerability warning-the black bar safety net

The test version of the program is: B2Bbuilderv6. 6 http://www.site.com/?m=offer&s=offerlist&id=1 0 0 4+and%28select+1+from%28select+count%2 8%2 9%2Cconcat%2 8% 2 8 select+%28select+%28select+concat%280x27%2C0x7e%2Cb2bbuilderadmin. user,0x27,password %2C0x27%2C0x7e%2 9+from+%60b2bbuilder%6 0...

Zoom X4 / X5 SQL Injection / Authentication Bypass Vulnerabilities

Zoom X4 and X5 modems suffers from authentication bypass and remote SQL injection vulnerabilities. Vulnerable Products - Zoom X4 ADSL Modem and Router running Nucleus/4.3 UPnP/1.0Virata-EmWeb/R620 Server All GS Firmware versions Zoom X5 ADSL Modem and Router running Nucleus/4.3...

Zoom X4/X5 ADSL Modem and Router -Unauthenticated Remote Root Command Execution

Vulnerable Products - Zoom X4 ADSL Modem and Router running Nucleus/4.3 UPnP/1.0Virata-EmWeb/R620 Server All GS Firmware versions Zoom X5 ADSL Modem and Router running Nucleus/4.3 UPnP/1.0Virata-EmWeb/R620 Server All GS Firmware versions Note: A similar vulnerability was reported several years ag...

Zoom Telephonics X4/X5 ADSL Modem - Multiple Vulnerabilities

Vulnerable Products - Zoom X4 ADSL Modem and Router running Nucleus/4.3 UPnP/1.0Virata-EmWeb/R620 Server All GS Firmware versions Zoom X5 ADSL Modem and Router running Nucleus/4.3 UPnP/1.0Virata-EmWeb/R620 Server All GS Firmware versions Note: A similar vulnerability was reported several years ag...

Invision Power Board Admin 帐号接管命令执行漏洞

Invision Power Board是一个非常流行的PHP论坛程序。 Invision Power Board没有正确验证注册页面User Email字段的输入内容，导致远程攻击者能够修改任意用户的登录密码。通过修改管理员帐户的密码，攻击者能够远程执行代码。成功利用该漏洞需要攻击者获得目标帐户的用户名和注册邮件地址。 0 Invision Power Board Invision Power Board 3.4.4 厂商补丁： Invision Power Board -------------------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

On IPB just out of 0day vulnerabilities due to mysql truncation causes of vulnerability-vulnerability warning-the black bar safety net

First posted about the original: http://www.john-jean.com/blog/securite-informatique/ipb-invision-power-board-all-versions-1-x-2-x-3-x-admin-account-takeover-leading-to-code-execution-742 This is a good vulnerability, not IPB now using how widely although also in my day is used quite widely, sigh...

Invision Power Board 1.x / 2.x / 3.x Admin Account Takeover

Invision Power Board IPD versions 1.x, 2.x, and 3.x suffer from an administrative account takeover vulnerability that allows for code execution. IPB Invision Power Board all versions 1.x? / 2.x / 3.x Admin account Takeover leading to code execution Written on : 2013/05/02 Released on : 2013/05/13...

Invision Power Board 1.x?/2.x/3.x - Admin Takeover

IPB Invision Power Board all versions 1.x? / 2.x / 3.x Admin account Takeover leading to code execution Written on : 2013/05/02 Released on : 2013/05/13 Author: John JEAN @johnjean on twitter Affected application: Invision Power Board = 3.4.4 Type of vulnerability: Logical Vulnerability / Bad...

Invision Power Board 1.x / 2.x / 3.x Admin Account Takeover

IPB Invision Power Board all versions 1.x? / 2.x / 3.x Admin account Takeover leading to code execution Written on : 2013/05/02 Released on : 2013/05/13 Author: John JEAN @johnjean on twitter Affected application: Invision Power Board = 3.4.4 Type of vulnerability: Logical Vulnerability / Bad...

PHPSHE（简好技术）某功能储存xss，可以蠕虫，并成功搞到admin

简要描述： See your gifts, I came... 详细说明： 测试地址：http://www.phpshe.com/bbs/topic/46 1 漏洞缺陷地址 http://www.phpshe.com/bbs 2 论坛发帖子回复等，帖子内容只做了前端过滤，所以我用charles直接修改post数据就可以绕过了（服务端完全是啥都么有过滤的节奏啊）。 3 发了个帖子，诱骗了一下管理员。 图0 4 果然很快就上勾了，同时还搞到了其他一些其他用户的cookie。 图1 5 这个cookie是管理员的 图2 6 怕你不信我搞到了管理员的cookie，并成功登录，所以我留了几个记号。...