Lexmark Markvision Enterprise Default Credentials

The remote Lexmark Markvision Enterprise install, a web-based printer and multi-function device management system, is protected with a set of known default credentials that allow admin level access to the application. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

CSDJCMS拿shell漏洞与PHP源码分析过程

简要描述： CSDJCMS漏洞后台拿shell 详细说明： includeonce"include/install.php"; ifSIsInstall==0 header"Location:install/install.php"; includeonce"include/label.php"; ifSWebmode==1 or !fileexists"index.html" //缓存区 $cacheid ='index'; if!$cacheopt-start$cacheid echo GetTemp"index.html",0; $cacheopt-end; else...

EasyPHP Webserver Multiple Vulnerabilities

This host is running EasyPHP Webserver and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: gbeasyphpwebservermultvuln.nasl 6115 2017-05-12 09:03:25Z teissa $ EasyPHP Webserver Multiple Vulnerabilities Authors: Antu Sanadi Copyright: Copyright C 2013 Greenbone Networks GmbH,...

Editing "Global Templates" possible without admin login

If you are logged in to the admin panel you get the following line: quoteYou have temporary access to administrative functions. Drop access if you no longer require it. For more information, refer to the documentation.quote Pressing "Drop access" redirects you to the normal Wiki page, away from t...

GroundWork Monitor Enterprise contains multiple vulnerabilities

Overview GroundWork Monitor Enterprise 6.7.0 and possibly earlier versions contain multiple vulnerabilities. Description The SEC Consult Vulnerability Lab Security Advisory states:The following vulnerability description has been categorized into the components where the vulnerabilities have been...

e107 Persistant XSS vulnerability

Exploit for php platform in category web applications Exploit Title: E107 CMS Persistant XSS vulnerability Google Dork: "intitle:e107 powered website" | inurl:e107admin | ... Date: 18/02/2013 Exploit Author: Zyklon B Vendor Homepage: http://e107.org/ Software Link:...

BigAnt IM Message server and components contain multiple vulnerabilities

Overview BigAnt IM Message server and components contain multiple vulnerabilities which could allow an attacker to perform administrative functions on the the system Description CWE-89: Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' - CVE-2012-6273During the SH...

Novell eDirectory 8.8.x Multiple Security Vulnerabilities

The remote host is running eDirectory, a directory service software from Novell. The installed version of Novell eDirectory is affected by multiple issues : - An unspecified cross-site scripting flaw exists. CVE-2012-0428 - It is possible to trigger a remote denial of service vulnerability by...

Password Disclosure in D-Link IP Cameras (CVE-2012-4046)

A password disclosure vulnerability in the D-Link DCS-9xx series IP cameras allows attackers to gain administrator level access to the camera when on the same broadcast domain. CVE-2012-4046 Details:...

OpenDocMan 1.2.6.2 SQL Injection / Access Bypass

1 - Unprotected id parameter ----------------------------- In check-in.php the id variable is not filtered so that one can put in additional SQL statements. I have been able to get a UNION SELECT query to run but I do not think it's exploitable because there is a second query that runs with the i...

ManageEngine Security Manager Plus Default Administrator Credentials

The remote ManageEngine Security Manager Plus install uses a default set of credentials 'admin' / 'admin' to control access to its management interface. With this information, an attacker could gain administrative access to the application. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

django-cms -- XSS Vulnerability

Cross-site scripting XSS vulnerability Jonas Obrist reports: The security issue allows users with limited admin access to elevate their privileges through XSS injection using the pageattribute template tag. Only users with admin access and the permission to edit at least one django CMS page objec...

Oracle MySQL Privilege Escalation

use DBI; $|=1; =for comment MySQL privilege elevation Exploit This exploit adds a new admin user. By Kingcope Tested on Debian Lenny mysql-5.0.51a OpenSuSE 11.4 5.1.53-log How it works: This exploit makes use of several things: The attacker is in possession of a mysql user with 'file' privileges...

CVE-2012-4964

The CVE-2012-4964 vulnerability affects Samsung printer firmware prior to 20121031 that ships with a hardcoded read-write SNMP community string. This enables remote attackers to obtain administrative access over SNMP, potentially taking full control of affected devices (including some Dell-brande...

D-Link DSR-250N Persistent Root Access

D-Link DSR-250N has a backdoor account that allows for persistent root access. D-Link DSR-250N Persistent Root Access Router: D-Link DSR-250N Hardware Version: A1 Firmware Version: 1.05B73WW Arch: armv6l, Linux Author: 0o -- nullnull nu11.nu11 at yahoo.com Date: 2012-11-25 Purpose: Persistently...

CVE-2012-5918

razorCMS 1.2 allows remote authenticated users to access administrator directories and files by creating and deleting a directory...

MS12-066: Description of the security update for SharePoint Foundation 2010 Service Pack 1: October 9, 2012

Describes the security update for SharePoint Foundation 2010 Service Pack 1 that was released on October 9, 2012.INTRODUCTIONMicrosoft has released security bulletin MS12-066. To view the complete security bulletin, go to one of the following Microsoft websites: Home...

Harvard Carr Center for Human Rights Policy Hacked, Password was "DOG" ?

Harvard's Carr Center for Human Rights Policy website www.hks.harvard.edu/cchrp/ was hacked last week and then silently fixed by the administrator without giving Reply/Credit to the Whitehat Hacker who reported the vulnerability. The Hack incident was performed in 3 Phases as described below: Pha...

CVE-2012-2153

Removed by vendor...

DEBIAN-CVE-2012-4448

Cross-site request forgery CSRF vulnerability in wp-admin/index.php in WordPress 3.4.2 allows remote attackers to hijack the authentication of administrators for requests that modify an RSS URL via a dashboardincominglinks edit action...