WordPress Plugin IP Ban Has Multiple Cross-Site Request Forgery Vulnerabilities

WordPress is a set of blogging platform developed by WordPress Software Foundation using PHP language, which supports setting up personal blog sites on servers with PHP and MySQL. IP Ban plugin is a plugin used to prohibit certain IP addresses from accessing the blog, similar to the role of the...

CVE-2014-6078

IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 do not have a lockout period after invalid login attempts, which makes it easier for remote attackers to obtain admin access via a brute-force attack...

CVE-2014-6078

IBM Security Access Manager for Mobile (8.0.x) and IBM Security Access Manager for Web (7.x/8.x) are affected by CVE-2014-6078, which enables brute-force login attempts due to no account lockout after invalid logins. The vulnerability is remote, low complexity, and does not require authentication...

Free Article Submissions 1.0 - SQL Injection

Free Article Submissions 1.0 - SQL Injection Exploit Title: Free Article Submissions SQL Injection Vulnerability Google Dork: inurl:/category.php?id=22 "Affiliate Programs Portal" inurl:/category.php?id=2 "Arts & Entertainment" Date: 07/12/2014 Exploit Author: BarrabravaZ Vendor Homepage:...

LG Electronics mobile access routers lack access restrictions

Overview LG Electronics mobile access routers provided by NTT DOCOMO, INC. lack access restrictions in the web administration interface. Taiga Asano reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact An attacke...

WordPress Plugin Slider REvolution 3.0.95 / Showbiz Pro 1.7.1 - Arbitrary File Upload

!/usr/bin/perl Title: Slider Revolution/Showbiz Pro shell upload exploit Author: Simo Ben youssef Contact: SimoatMorxploitcom Discovered: 15 October 2014 Coded: 15 October 2014 Updated: 25 November 2014 Published: 25 November 2014 MorXploit Research http://www.MorXploit.com Vendor: ThemePunch...

RobotStats 1.0 - 'robot' SQL Injection

Title : RobotStats v1.0 robot param SQL Injection Vulnerability Author : ZoRLu / [email protected] / [email protected] Home : http://milw00rm.com / its online Twitter : https://twitter.com/milw00rm or @milw00rm Date : 22.11.2014 Demo : http://alpesoiseaux.free.fr/robotstats/ Download :...

Default credentials

The Change Password feature in IBM Sterling B2B Integrator 5.2.x through 5.2.4 does not have a lockout protection mechanism for invalid login requests, which makes it easier for remote attackers to obtain admin access via a brute-force approach...

CVE-2014-6099

IBM Sterling B2B Integrator 5.2.x (and Sterling Integrator 5.1) is affected by CVE-2014-6099 due to a lack of login- Brute-force protection on the Change Password screen, enabling potential admin credential compromise. The IBM bulletin lists affected versions (5.2 through 5.2.4; 5.1 as applicable...

CVE-2014-6099

The Change Password feature in IBM Sterling B2B Integrator 5.2.x through 5.2.4 does not have a lockout protection mechanism for invalid login requests, which makes it easier for remote attackers to obtain admin access via a brute-force approach...

VulnCheck KEV: CVE-2017-6360

QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information via unspecified vectors...

CVE-2014-5246

The Shenzhen Tenda Technology Tenda A5s router with firmware 3.02.05CN allows remote attackers to bypass authentication and gain administrator access by setting the admin:language cookie to zh-cn...

CVE-2014-5240

Cross-site scripting XSS vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enabled, allows remote authenticated administrators to inject arbitrary web script or HTML, and obtain Super Admin privileges, via a crafted avatar URL...

CVE-2014-2940

CVE-2014-2940 affects Cobham Sailor 900 and 6000 satellite terminals running firmware 1.08 MFHF / 2.11 VHF, where hardcoded administrator credentials are present. The NVD entry notes that an attacker could obtain full administrative control, with exploitation requiring either physical access to t...

WordPress Contact Form 7 Plugin <= 3.5.2 - Remote Code Execution

Because of this vulnerability, attackers with admin access add uploader tag into contact form at the site and use it for CE via AFU attack. Solution Update the plugin...

Lian Li NAS - Multiple Vulnerabilities

Exploit for hardware platform in category web applications Exploit Title: Lian Li NAS Multiple vulnerabilities Date: 21/07/2014 Exploit Author: pws Vendor Homepage: http://www.lian-li.com/en/dtportfoliocategory/nas/ Firmware Link: https://www.dropbox.com/s/imvkndl8m5yj7qp/G5S604121826700.tar.gz...

Lian Li NAS - Multiple Vulnerabilities

Exploit Title: Lian Li NAS Multiple vulnerabilities Date: 21/07/2014 Exploit Author: pws Vendor Homepage: http://www.lian-li.com/en/dtportfoliocategory/nas/ Firmware Link: https://www.dropbox.com/s/imvkndl8m5yj7qp/G5S604121826700.tar.gz Tested on: Latest version CVE : None yet 1. Hardcoded cookie...

Wordpress Plugin Better WP Security - Stored XSS

No description provided by source. ======= Summary ======= Name: Bit51 Better WP Security Plugin - Unauthenticated Stored XSS to RCE Release Date: 30 July 2013 Reference: NGS00500 Discoverer: Richard Warren [email protected] Vendor: Bit51 Vendor Reference: Systems Affected: Bit51 Better...

freediscussionforums 1.0 - Multiple Vulnerabilities

No description provided by source. ''' | / |/ \ /\ | | | | \ | \ / | | | | / \ | | | | | | | |/| | | | |/ /\ | | | | | | | | || / \ || | | | || ||// \/|/ http://www.exploit-db.com/moaub-14-freediscussionforums-multiple-remote-vulnerabilities/ ''' Abysssec Inc Public Advisory Title :...

Sambar Server 4.1 beta Admin Access Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2255/info 'dumpenv.pl' is a utility that will display environment information on which the server resides, this information could include the server software version being used, directory settings and path information. Th...