6394 matches found
Dahua Technology Camera Products Unauthorized Access Vulnerability
DH-IPC-HDW23A0RN-ZS, DH-IPC-HFW13A0SN-W, DHI-HCVR51A04HE-S3 are some of the many camera products from Dahua Technology. The unauthorized access vulnerability exists in Dahua's camera products, which allows an attacker to access the user database of a camera product with non-administrator...
CVE-2017-6571
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta aka mail-masta plugin 1.0 for WordPress. This affects ./inc/campaign/view-campaign.php with the GET Parameter: id...
CVE-2017-6570
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta aka mail-masta plugin 1.0 for WordPress. This affects ./inc/campaign/view-campaign-list.php with the GET Parameter: id...
CVE-2017-6577
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta aka mail-masta plugin 1.0 for WordPress. This affects ./inc/subscriberlist.php with the POST Parameter: listid...
CVE-2017-6574
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta aka mail-masta plugin 1.0 for WordPress. This affects ./inc/lists/editmember.php with the GET Parameter: filterlist...
CVE-2017-6558
iball Baton 150M iB-WRA150N v1 00000001 1.2.6 build 110401 Rel.47776n devices are prone to an authentication bypass vulnerability that allows remote attackers to view and modify administrative router settings by reading the HTML source code of the password.cgi file...
CVE-2017-6578
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta aka mail-masta plugin 1.0 for WordPress. This affects ./inc/subscriberlist.php with the POST Parameter: subscriberemail...
CVE-2017-6573
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta aka mail-masta plugin 1.0 for WordPress. This affects ./inc/lists/edit-list.php with the GET Parameter: id...
CVE-2017-6574
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta aka mail-masta plugin 1.0 for WordPress. This affects ./inc/lists/editmember.php with the GET Parameter: filterlist...
CVE-2017-6575
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta aka mail-masta plugin 1.0 for WordPress. This affects ./inc/lists/editmember.php with the GET Parameter: memberid...
CVE-2017-6572
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta aka mail-masta plugin 1.0 for WordPress. This affects ./inc/lists/addmember.php with the GET Parameter: filterlist...
CVE-2017-6573
A concrete SQL injection in the WordPress Mail Masta plugin (version 1.0) affecting the file ./inc/lists/edit-list.php via the GET parameter id. Exploitation appears to require WordPress admin access and could allow arbitrary SQL execution, with multiple external sources confirming the vulnerabil...
PHPCMS '/phpcms/modules/member/index.php' file upload vulnerability
PHPCMS is a website management software. The software adopts modular development and supports a variety of classification methods, using it can easily realize the design, development and maintenance of personalized websites. A file upload vulnerability exists in PHPCMS...
CVE-2017-6342
An issue was discovered on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19. When SmartPSS Software is launched, while on the login screen, the software in the background automatically lo...
Linux kernel elevation of privilege vulnerability
The Linux kernel is the kernel used by the operating system Linux, released by the Linux Foundation in the United States. A security vulnerability exists in the dccprcvstateprocess function in the net/dccp/input.c file in Linux kernel version 4.9.11 and earlier, due to the program failing to...
Netgear DGN2200 Authenticated Remote Command Execution
Exploit Title: NETGEAR Firmware DGN2200v1/v2/v3/v4 NON-ADMIN AUTHENTICATED RCE Date: 2017-02-18 Exploit Author: SivertPL Vendor Homepage: http://netgear.com/ Software Link: http://www.downloads.netgear.com/files/GDC/DGN2200/DGN2200%20Firmware%20Version%201.0.0.20%20-%20Initial%20Release%20NA.zip...
Riverbed RiOS Insecure Cryptographic Storage
Riverbed RiOS insecure cryptographic storage CVE-2017-5670 Description Riverbed Steelhead hardware appliances are used to optimize and accelerate network traffic. There can be implemented as TLS endpoints, so they have a secure vault aimed to store private TLS certificates for servers. The secure...
CVE-2017-5154
The CVE-2017-5154 issue affects Advantech WebAccess 8.1, where an SQL injection vulnerability exists in updateTemplate.aspx. The underlying flaw is insufficient input validation, enabling an attacker to craft inputs that could grant administrative access to the application and its data files. Pub...
bpms: stored XSS in dashbuilder
JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via dashbuilder. Remote, authenticated attackers that have privileges to access dashbuilder usually admins can store scripts in several editable fields, which are not properly sanitized before showing to other users, including other admi...