Grandstream Phone Web UI Information Disclosure

The remote Grandstream phone is affected by an information disclosure vulnerability in the web administration interface due to the failure to restrict access to sensitive configuration data. An unauthenticated, remote attacker can exploit this to disclose sensitive information related to the...

CVE-2017-14743

Faleemi FSC-880 00.01.01.0048P2 devices allow unauthenticated SQL injection via the Username element in an XML document to /onvif/deviceservice, as demonstrated by reading the admin password...

Sql injection

Faleemi FSC-880 00.01.01.0048P2 devices allow unauthenticated SQL injection via the Username element in an XML document to /onvif/deviceservice, as demonstrated by reading the admin password...

CVE-2017-14743

Faleemi FSC-880 00.01.01.0048P2 devices allow unauthenticated SQL injection via the Username element in an XML document to /onvif/deviceservice, as demonstrated by reading the admin password...

youke365_SQL_Injection#1

优客365 v2.9版本 后台存在SQL注入，可导致获取后台管理员账号密码 1，一个单引号引发的血案 爆出了表名dirusers和一些列名 2，源码审计，问题代码在.\module\login.php 代码处理不严谨。根据上图，经测试，用户名可以用1' or '1'='1进行绕过 密码进行了md5加密，所以不能进行简单绕过 3，sql注入 将爆破后的密码进行md5解密，即可得到管理员密码。当然，也可以顺便爆破管理员账号。（所以通过管理员账号认证是有两种姿势） 4，愉快地登陆后台 最后附上payload payload = ' and select 1 fromselect...

Axesstel MU553S Default Password Vulnerability

The Axesstel MU553S is a router from Axesstel USA. A security vulnerability exists in the Axesstel MU553S MU55XS-V1.14 version that originates from the use of the default 'admin' password for the administrator account. An attacker can exploit the vulnerability to perform unauthorized operations...

D-Link DIR-850L REV.B Password Disclosure Vulnerability

The D-Link DIR-850L REV.B is a wireless router from AUO D-Link. A security vulnerability exists in the D-Link NPAPI extension used in D-Link DIR-850L REV.B devices with firmware FW208WWb02 and prior versions. An attacker could exploit the vulnerability to retrieve the administrator password...

Design/Logic Flaw

The D-Link NPAPI extension, as used in conjunction with D-Link DIR-850L REV. B with firmware through FW208WWb02 devices, sends the cleartext admin password over the Internet as part of interaction with mydlink Cloud Services...

CVE-2017-14418

The D-Link NPAPI extension, as used in conjunction with D-Link DIR-850L REV. B with firmware through FW208WWb02 devices, sends the cleartext admin password over the Internet as part of interaction with mydlink Cloud Services...

CVE-2017-14418

The D-Link NPAPI extension, as used in conjunction with D-Link DIR-850L REV. B with firmware through FW208WWb02 devices, sends the cleartext admin password over the Internet as part of interaction with mydlink Cloud Services...

CVE-2017-11351

Axesstel MU553S MU55XS-V1.14 devices have a default password of admin for the admin account...

PT-2017-13462 · D Link · Mydlink Cloud Services +1

Name of the Vulnerable Software and Affected Versions: D-Link DIR-850L REV. B versions through FW208WWb02 Description: The issue concerns the transmission of the admin password in cleartext over the Internet when the D-Link NPAPI extension interacts with mydlink Cloud Services. Recommendations: F...

D-link ten vulnerabilities 0Day studies attach detailed procedures-vulnerability warning-the black bar safety net

Security researcher Pierre Kim recently revealed the D-Link DIR 850LAC1200-Type Dual-Band Gigabit cloud router is exposed 10 a safety score comprisesXSSattack invasion, shortage of proper firmware cover, back door and root mention the right. Here are 10 Safety scores are: Firmware to. The firmwar...

CVE-2017-14335

On Beijing Hanbang Hanbanggaoke devices, because user-controlled input is not sufficiently sanitized, sending a PUT request to /ISAPI/Security/users/1 allows an admin password change...

Default credentials

On Beijing Hanbang Hanbanggaoke devices, because user-controlled input is not sufficiently sanitized, sending a PUT request to /ISAPI/Security/users/1 allows an admin password change...

CVE-2017-14335

On Beijing Hanbang Hanbanggaoke devices, because user-controlled input is not sufficiently sanitized, sending a PUT request to /ISAPI/Security/users/1 allows an admin password change...

CVE-2017-14335

Beijing Hanbang Hanbanggaoke IP Camera devices are affected. A vulnerability exists due to insufficient sanitization of user-controlled input, allowing a remote attacker to change the administrator password by sending a PUT request to /ISAPI/Security/users/1. The PoC demonstrates changing admin/p...

CVE-2017-14262

On Samsung NVR devices, remote attackers can read the MD5 password hash of the 'admin' account via certain szUserName JSON data to cgi-bin/main-cgi, and login to the device with that hash in the szUserPasswd parameter...

ZTE ADSL ZXV10 W300 Password Interception Vulnerability

The ZTE ADSL ZXV10 W300 is an ADSL modem Modem product from China's ZTE Corporation ZTE. A security vulnerability exists in the ZTE ADSL ZXV10 W300 W300V2.1.0fER7PEO57 version and W300V2.1.0hER7PEO57 version. A remote attacker can exploit this vulnerability to change the administrator password by...

CVE-2015-7257

ZTE ADSL ZXV10 W300 modems W300V2.1.0fER7PEO57 and W300V2.1.0hER7PEO57 allow remote authenticated non-administrator users to change the admin password by intercepting an outgoing password change request, and changing the username parameter from "support" to "admin"...