CVE-2016-1560

ExaGrid appliances with firmware before 4.8 P26 have a default password of 1 inflection for the root shell account and 2 support for the support account in the web interface, which allows remote attackers to obtain administrative access via an SSH or HTTP session...

Design/Logic Flaw

MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirmhash value to verify.php...

CVE-2017-7615

MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirmhash value to verify.php...

CVE-2017-7615

MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirmhash value to verify.php...

CVE-2017-7615

CVE-2017-7615 affects MantisBT up to version 2.30 (e.g., 2.3.0/2.3.1). The vulnerability is in verify.php where an empty confirm_hash enables pre-auth remote password reset and unauthenticated admin access, allowing unauthorized password changes and admin access. Public exploit references exist (...

SQL Injection Vulnerability in Cache Master Web Appliance

Cache Master is able to optimize caching for web videos including mobile videos, as well as smart caching for http downloads of web pages and web images. A SQL injection vulnerability exists in the Cache Master web appliance. An attacker can use this vulnerability to log into the backend of a...

CVE-2016-7542

A read-only administrator on Fortinet devices with FortiOS 5.2.x before 5.2.10 GA and 5.4.x before 5.4.2 GA may have access to read-write administrators password hashes not including super-admins stored on the appliance via the webui REST API, and may therefore be able to crack them...

CVE-2017-6803

Multiple cross-site request forgery CSRF vulnerabilities in the web interface in the Scheduler in SolarWinds formerly Serv-U FTP Voyager 16.2.0 allow remote attackers to hijack the authentication of users for requests that 1 change the admin password, 2 terminate the scheduler, or 3 possibly...

Dahua Technology Camera Products Unauthorized Access Vulnerability

DH-IPC-HDW23A0RN-ZS, DH-IPC-HFW13A0SN-W, DHI-HCVR51A04HE-S3 are some of the many camera products from Dahua Technology. The unauthorized access vulnerability exists in Dahua's camera products, which allows an attacker to access the user database of a camera product with non-administrator...

CVE-2017-6573

A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta aka mail-masta plugin 1.0 for WordPress. This affects ./inc/lists/edit-list.php with the GET Parameter: id...

CVE-2017-6570

A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta aka mail-masta plugin 1.0 for WordPress. This affects ./inc/campaign/view-campaign-list.php with the GET Parameter: id...

CVE-2017-6577

A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta aka mail-masta plugin 1.0 for WordPress. This affects ./inc/subscriberlist.php with the POST Parameter: listid...

CVE-2017-6575

A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta aka mail-masta plugin 1.0 for WordPress. This affects ./inc/lists/editmember.php with the GET Parameter: memberid...

CVE-2017-6558

iball Baton 150M iB-WRA150N v1 00000001 1.2.6 build 110401 Rel.47776n devices are prone to an authentication bypass vulnerability that allows remote attackers to view and modify administrative router settings by reading the HTML source code of the password.cgi file...

CVE-2017-6574

A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta aka mail-masta plugin 1.0 for WordPress. This affects ./inc/lists/editmember.php with the GET Parameter: filterlist...

CVE-2017-6578

A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta aka mail-masta plugin 1.0 for WordPress. This affects ./inc/subscriberlist.php with the POST Parameter: subscriberemail...

CVE-2017-6574

A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta aka mail-masta plugin 1.0 for WordPress. This affects ./inc/lists/editmember.php with the GET Parameter: filterlist...

CVE-2017-6571

A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta aka mail-masta plugin 1.0 for WordPress. This affects ./inc/campaign/view-campaign.php with the GET Parameter: id...

CVE-2017-6573

A concrete SQL injection in the WordPress Mail Masta plugin (version 1.0) affecting the file ./inc/lists/edit-list.php via the GET parameter id. Exploitation appears to require WordPress admin access and could allow arbitrary SQL execution, with multiple external sources confirming the vulnerabil...

CVE-2017-6572

A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta aka mail-masta plugin 1.0 for WordPress. This affects ./inc/lists/addmember.php with the GET Parameter: filterlist...