195 matches found
The vulnerability of the Cisco Wireless LAN Controller 2500 software allows for bypassing access restrictions.
Vulnerability exists in Cisco Wireless LAN Controller WLC devices due to the widespread use of the Aironet IOS software. This leads to a state where the controller acts as an administrative HTTP server. Exploiting this vulnerability allows malicious actors to bypass access restrictions by...
The vulnerability of the ScreenOS operating system, which allows a hacker to trigger a service failure
The vulnerability of the ScreenOS operating system’s administrative web service interface exists due to insufficient verification of input data. Exploiting this vulnerability allows a malicious actor, operating remotely, to cause service failures by using specially crafted SSL packets...
Design/Logic Flaw
The admin web interface in Cisco AsyncOS 8.x before 8.0.8-113, 8.1.x and 8.5.x before 8.5.3-051, 8.6.x and 8.7.x before 8.7.0-171-LD, and 8.8.x before 8.8.0-085 on Web Security Appliance WSA devices allows remote authenticated users to obtain root privileges via crafted certificate-generation...
HooToo Tripmate HT-TM01 2.000.022 - CSRF Vulnerabilities
Exploit for php platform in category web applications Exploit Title: HooToo Tripmate HT-TM01 Cross Site Request Forgery Date: 03Sep15 Exploit Author: Ken Smith Contact: https://twitter.com/P4tchw0rk Vendor Homepage: http://www.hootoo.com Version: HT-TM01, version 2.000.022 1. Description Various...
HooToo Tripmate HT-TM01 2.000.022 - Cross-Site Request Forgery
Exploit Title: HooToo Tripmate HT-TM01 Cross Site Request Forgery Date: 03Sep15 Exploit Author: Ken Smith Contact: https://twitter.com/P4tchw0rk Vendor Homepage: http://www.hootoo.com Version: HT-TM01, version 2.000.022 1. Description Various functions in the device's admin web portal are...
CVE-2015-4182
Cisco Identity Services Engine (ISE) administrative web interface before 1.3 contains a vulnerability in the web page access controls that allows an authenticated remote attacker to bypass access restrictions and either read sensitive information or change settings via unspecified vectors (Bug ID...
CVE-2015-0698
Multiple cross-site scripting XSS vulnerabilities in filter search forms in admin web pages on Cisco Web Security Appliance WSA devices with software 8.5.0-497 allow remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCut39213...
CVE-2015-0698
Multiple cross-site scripting XSS vulnerabilities in filter search forms in admin web pages on Cisco Web Security Appliance WSA devices with software 8.5.0-497 allow remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCut39213...
CVE-2015-1444
The CVE-2015-1444 entry describes multiple cross-site scripting (XSS) vulnerabilities in the web administration frontend (httpd) of fli4l. Affected are versions before 3.10.1 and 4.0 before 2015-01-30, where the following admin scripts are vulnerable: conntrack.cgi, index.cgi, log_syslog.cgi, pro...
Wing FTP Server Authenticated Command Execution
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote include Msf::Exploit::CmdStager include Msf::Exploit::Remote::HttpClient def...
Wing FTP Server - (Authenticated) Command Execution (Metasploit)
This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Wing FTP Server Authenticated Command Execution', 'Description' = %q This module exploits the embedded Lua interpreter in the admin w...
Wing FTP Server Authenticated Command Execution Exploit
This Metasploit module exploits the embedded Lua interpreter in the admin web interface for versions 4.3.8 and below. When supplying a specially crafted HTTP POST request an attacker can use os.execute to execute arbitrary system commands on the target with SYSTEM privileges. This module requires...
Wing FTP Server Authenticated Command Execution
This module exploits the embedded Lua interpreter in the admin web interface for versions 3.0.0 and above. When supplying a specially crafted HTTP POST request an attacker can use os.execute to execute arbitrary system commands on the target with SYSTEM privileges. This module requires Metasploit...
IBM Lotus Protector for Mail Security Multiple Vulnerabilities
A version of IBM Lotus Protector for Mail Security is installed on the remote host that is affected by multiple vulnerabilities : - An unspecified cross-site scripting vulnerability exists in the Admin Web UI. CVE-2014-0884 - An unspecified cross-site request forgery vulnerability exists in the...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in the Admin web interface in OpenVPN Access Server before 1.8.5 allows remote attackers to hijack the authentication of administrators for requests that create administrative users...
CVE-2013-2692
OpenVPN Access Server before 1.8.5 is affected by a CSRF vulnerability in the Admin web interface that can allow an attacker to hijack the authentication of administrators and perform actions to create new administrative users. The issue is described as a cross-site request forgery affecting the ...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in the Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors...
Design/Logic Flaw
The Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to bypass intended access restrictions and execute arbitrary commands via unspecified vectors...
Cross site scripting
Cross-site scripting XSS vulnerability in the Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...