Razer US: Admin login page reveals user account - no anti-bruteforce

A login page's text upon a failed login could have been used to determine valid user names. The text was adjusted to avoid this...

kmrc.in XSS vulnerability

Open Bug Bounty ID: OBB-578803 Description| Value ---|--- Affected Website:| kmrc.in Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Default credentials

\ProgramData\WebLog Expert\WebServer\WebServer.cfg in WebLog Expert Web Server Enterprise 9.4 has weak permissions BUILTIN\Users:IDC, which allows local users to set a cleartext password and login as admin...

CVE-2018-7581

\ProgramData\WebLog Expert\WebServer\WebServer.cfg in WebLog Expert Web Server Enterprise 9.4 has weak permissions BUILTIN\Users:IDC, which allows local users to set a cleartext password and login as admin...

WebLog Expert Web Server Enterprise 9.4 Weak Permissions Vulnerability

Exploit for windows platform in category local exploits + Credits: John Page aka hyp3rlinx Vendor: ======== www.weblogexpert.com Product: ======== WebLog Expert Web Server Enterprise v9.4 WebLog Expert is a fast and powerful access log analyzer. It will give you information about your site's...

medienhaus-brandenburger.de XSS vulnerability

Open Bug Bounty ID: OBB-567689 Description| Value ---|--- Affected Website:| medienhaus-brandenburger.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

planetoftheweb.com XSS vulnerability

Open Bug Bounty ID: OBB-566611 Description| Value ---|--- Affected Website:| planetoftheweb.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Social Oauth Login PHP - Authentication Bypass Vulnerability

Exploit for php platform in category web applications Exploit Title: Social Oauth Login PHP - Authentication Bypass Dork: N/A Exploit Author: Borna nematzadeh L0RD or email protected Vendor Homepage: https://www.codester.com/items/4554/social-oauth-login-php Version: All version Category: Webapps...

TrendNet AUTHORIZED_GROUP Information Disclosure Vulnerability

Exploit for hardware platform in category web applications TrendNet AUTHORIZEDGROUP Information Disclosure Full report: https://blogs.securiteam.com/index.php/archives/3627 Twitter: @SecuriTeamSSD Weibo: SecuriTeamSSD Vulnerability Summary The following advisory describes an information disclosur...

Joomla! Administration Panel Login Form Detected

Joomla! Administration Panel has been detected on the target web application. This may present an attacker with an exploit vector which could be leveraged using other techniques, such as a Brute-Force or Dictionary Attack, allowing an attacker to gain access to administrative functionality. No...

CVE-2018-5705

Reservo Image Hosting 1.6 is vulnerable to XSS attacks. The affected function is its search engine the t parameter to the /search URI. Since there is an user/admin login interface, it's possible for attackers to steal sessions of users and thus admins. By sending users an infected URL, code will ...

Vulnerabilities in DM Enterprise Building System's common.inc2010.php file with out-of-rights access

DM enterprise building system is developed by php + mysql a set of specialized in small and medium-sized enterprise website construction of open source cms. DM enterprise website builder system common.inc2010.php file has an override access vulnerability. Attackers can use the vulnerability to...

CVE-2017-17947

A cross site scripting issue has been found in custompage.cgi in Pulse Secure Pulse Connect Secure PCS before 8.0R17.0, 8.1.x before 8.1R13, 8.2.x before 8.2R9, and 8.3.x before 8.3R3 and Pulse Policy Secure PPS before 5.2R10, 5.3.x before 5.3R9, and 5.4.x before 5.4R3 due to one of the URL...

CVE-2018-5479

FoxSash ImgHosting 1.5 according to footer information is vulnerable to XSS attacks. The affected function is its search engine via the search parameter to the default URI. Since there is an user/admin login interface, it's possible for attackers to steal sessions of users and thus admins. By...

CVE-2018-5479

FoxSash ImgHosting 1.5 according to footer information is vulnerable to XSS attacks. The affected function is its search engine via the search parameter to the default URI. Since there is an user/admin login interface, it's possible for attackers to steal sessions of users and thus admins. By...

CVE-2018-5479

FoxSash ImgHosting 1.5 according to footer information is vulnerable to XSS attacks. The affected function is its search engine via the search parameter to the default URI. Since there is an user/admin login interface, it's possible for attackers to steal sessions of users and thus admins. By...

instantmoneynetwork.com XSS vulnerability

Open Bug Bounty ID: OBB-489056 Description| Value ---|--- Affected Website:| instantmoneynetwork.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

citystars.com.eg XSS vulnerability

Open Bug Bounty ID: OBB-458581 Description| Value ---|--- Affected Website:| citystars.com.eg Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

Cambium ePMP 1000 Account Password Reset

This module exploits an access control vulnerability in Cambium ePMP device management portal. It requires any one of the following non-admin login credentials - installer/installer, home/home - to reset password of other existing users including 'admin'. All versions 'Cambium ePMP 1000 Account...

WordPress Plugin Userpro < 4.9.17.1 - Authentication Bypass

Exploit Title: Userpro – WordPress Plugin – Authentication Bypass Google Dork: inurl:/plugins/userpro Date: 11.04.2017 Exploit Author: Colette Chamberland Wordfence, Iain Hadgraft Duke University Vendor Homepage: https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681?srank=9...