6850 matches found
CVE-2017-15304
/bin/login.php in the Web Panel on the Airtame HDMI dongle with firmware before 3.0 allows an attacker to set his own session id via a "Cookie: PHPSESSID=" header. This can be used to achieve persistent access to the admin panel even after an admin password change...
NEXXT Routers Authentication Bypass Vulnerability (Sep 2017) - Active Check
Setting a specific cookie allows for authentication bypass in NEXXT Routers. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
The vulnerability of the microprogrammed Wi-Fi router STATION L-02F, related to deficiencies in access control, allows a hacker to gain access to the device with administrator privileges and execute arbitrary commands.
The vulnerability of the microprogrammed Wi-Fi router STATION L-02F is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to gain access to the device with administrator privileges and execute arbitrary commands...
NiuShop open source mall system v1.16 front-end use plug-in functionality at the existence of any file contains vulnerabilities
NiuShop open source mall system is by Shanxi Niu Cool Information Technology Co., Ltd. completely independent design, research and development of a PHP open source e-commerce system . NiuShop open source mall system v1.16 front-end use plug-in functionality at the existence of any file contains a...
PHP Melody 2.7.3 - Multiple Vulnerabilities
Vulnerabilities Summary The following advisory describes three 3 vulnerabilities found in PHP Melody version 2.7.3. PHP Melody is a “self-hosted Video CMS which evolved over the last 9 years. SEO optimization, unbeaten security and speed are advantages you no longer have to compromise on. A truly...
CVE-2015-2673
The ecajaxupdateoption and ecajaxclearalltaxrates functions in inc/admin/adminajaxfunctions.php in the WP EasyCart plugin 1.1.30 through 3.0.20 for WordPress allow remote attackers to gain administrator privileges and execute arbitrary code via the optionname and optionvalue parameters...
File Upload Vulnerability in WK+shop General Mall System
WK+shop is a mall system based on the technology of PHP+MySQL, developed using ThinkPHP5.0 framework, which combines the Witcott mission system with multiple mall systems. A file upload vulnerability exists in the WK+shop universal mall system, which allows an attacker to upload arbitrary files a...
Zomato: Admin Access to a domain used for development and admin access to internal dashboards on that domain
@prateek0490 Was able to find our development server without any authentication. Which leads to leak the user data and some internal dashboards...
Tecnovision DLX Spot - Authentication Bypass Vulnerability
Exploit for multiple platform in category remote exploits Exploit Title: DlxSpot - Player4 LED video wall - Admin Interface SQL Injection Google Dork: "DlxSpot - Player4" Date: 2017-05-14 Discoverer: Simon Brannstrom Authors Website: https://unknownpwn.github.io/ Vendor Homepage:...
CVE-2017-14244
An authentication bypass vulnerability on iBall Baton ADSL2+ Home Router FWiB-LR7011A1.0.2 devices potentially allows attackers to directly access administrative router settings by crafting URLs with a .cgi extension, as demonstrated by /info.cgi and /password.cgi...
CVE-2017-10845
Wi-Fi STATION L-02F Software version V10g and earlier allows remote attackers to access the device with administrative privileges and perform unintended operations through a backdoor account...
The vulnerability of the cmd parameter in D-Link router microprogramming devices such as D-Link DNS-320L, D-Link DNS-327L, D-Link DNR-326, D-Link DNS-320B, D-Link DNS-345, D-Link DNS-325, and D-Link DNS-322L allows attackers to bypass the authentication process.
The vulnerability of the cmd parameter in D-Link DNS-320L, D-Link DNS-327L, D-Link DNR-326, D-Link DNS-320B, D-Link DNS-345, D-Link DNS-325, and D-Link DNS-322L routers is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to bypass...
Backdoor Vulnerability in NTT DOCOMO Wi-Fi STATION L-02F Software
NTT DOCOMO Wi-Fi STATION L-02F Software is a set of software used in the L-02F router from NTT DOCOMO Japan. A security vulnerability exists in NTT DOCOMO Wi-Fi STATION L-02F Software V10g and earlier versions. A remote attacker with a backdoor account could exploit the vulnerability to gain acce...
Backdoor access issue in Wi-Fi STATION L-02F
Overview Wi-Fi STATION L-02F provided by NTT DOCOMO, INC. contains a backdoor access issue. Japan Computer Emergency Response Team Coordination Center Global Coordination Division Cyber Metrics Line Information Security Analyst Keisuke Shikano reported this vulnerability to IPA. JPCERT/CC...
Cannot bind LDAP on XenMobile sever on port 636
Admin is unable to bind Secure LDAP on XMS server...
PHPCMS V9.6.3 CSRF Vulnerability and Arbitrary File Write Vulnerability in the Backend
PHPCMS is a web content management system based on PHP and Mysql architecture. PHPcms V9.6.3 version of the backend exists CSRF vulnerability and arbitrary file write vulnerability. Attackers can use this vulnerability to remotely write Trojan horse files to obtain web server administrative...
Invoice Manager 3.1 - Cross-Site Request Forgery (Add Admin) Vulnerability
Exploit for php platform in category web applications ======================================================== Invoice Manager v3.1 Cross site request forgery Add Admin Description : Invoice Manager v3.1 is vulnerable to CSRF attack No CSRF token in place which if an admin user can be tricked to...
D-Link DIR-600 - Authentication Bypass
D-Link DIR-600 - Authentication Bypass Exploit Title: D-Link DIR-600 - Authentication Bypass Absolute Path Traversal Attack CVE - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12943 Date: 29-08-2017 Exploit Author: Jithin D Kurup Contact :...
Arbitrary Password Reset and Background Arbitrary File Upload Vulnerability in Wanda Information Food Safety Information Traceability System
Wanda Information Food Safety Information Traceability System is a platform for analyzing and processing the quality and safety data of food enterprises and realizing the functions of information disclosure, public inquiry, diagnosis and early warning, and quality complaint. Wanda Information Foo...
