PT-2019-6107

Name of the Vulnerable Software and Affected Versions IBM Planning Analytics versions 2.0.0 through 2.0.8 Description The issue is related to a configuration overwrite that allows an unauthenticated user to login as admin and then execute code as root or SYSTEM via TM1 scripting. This is due to...

Empire CMS core encryption algorithm has logic flaws

Empire CMS it is based on B/S structure, Empire CMS-logo easy-to-use website management system. It is a well-designed and efficient website solution for Linux/windows/Unix and other environments. Empire CMS core encryption algorithm has a logical loophole, attackers can use the vulnerability to...

CVE-2019-17600

Intelbras IWR 1000N 1.6.4 devices allow disclosure of the administrator login name and password because v1/system/user is mishandled...

CVE-2019-17600

CVE-2019-17600 affects Intelbras IWR 1000N with firmware 1.6.4. The issue is a mishandling of v1/system/user that leads to disclosure of the administrator login name and password. The Red Hat and NVD entries confirm the same vulnerability family; exploitation is referenced in public exploit mater...

Top Echelon Software: able to login into login.topechelon.com

The support login for our administrative account was using insecure credentials, allowing access to our administrative account. These credentials are not used, so we chose to deactivate the login to prevent access...

CVE-2019-16238

Afterlogic Aurora through 8.3.9-build-a3 has XSS that can be leveraged for session hijacking by retrieving the session cookie from the administrator login...

Unauthorized Access Vulnerability in Schneider Electric Modicon M340 PLCs

Schneider Electric Modicon M340 is a medium-sized PLC from Schneider Electric, which has a wide range of applications in the industrial control field in China. An unauthorized access vulnerability exists in the Schneider Electric Modicon M340 PLC. The vulnerability can be exploited to obtain...

PT-2019-3020 · Cisco · Cisco Ucs Director Express For Big Data +2

Name of the Vulnerable Software and Affected Versions: Cisco Integrated Management Controller IMC Supervisor versions affected versions not specified Cisco UCS Director versions affected versions not specified Cisco UCS Director Express for Big Data versions affected versions not specified...

UNA 10.0.0 RC1 Cross Site Scripting

Exploit Title: UNA - 10.0.0-RC1 stored XSS vuln. Date: 2019 08 10 Exploit Author: Greg.Priest Vendor Homepage: https://una.io/ Software Link: https://github.com/unaio/una/tree/master/studio Version: UNA - 10.0.0-RC1 Tested on: Windows/Linux CVE : CVE-2019-14804 UNA-v.10.0.0-RC1 Stored XSS...

CVE-2019-10119

eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16 use session IDs for authentication but lack authorization checks. An attacker can obtain a session ID via an invalid login attempt to the RemoteApi account, aka HMCCU-154. This leads to automatic login as admin...

CVE-2019-10121

eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.15 use session IDs for authentication but lack authorization checks. An attacker can obtain a session ID via the user authentication dialogue, aka HMCCU-153. This leads to automatic login as admin...

CVE-2018-14027

Digisol Wireless Wifi Home Router HR-3300 allows XSS via the userid or password parameter to the admin login page...

Design/Logic Flaw

Digisol Wireless Wifi Home Router HR-3300 allows XSS via the userid or password parameter to the admin login page...

CVE-2018-14027

Digisol Wireless Wifi Home Router HR-3300 allows XSS via the userid or password parameter to the admin login page...

CVE-2018-14027: Improper Neutralization of Input During Web Page Generation

Digisol Wireless Wifi Home Router HR-3300 allows XSS via the userid or password parameter to the admin login page...

PT-2019-9019

Name of the Vulnerable Software and Affected Versions Digisol Wireless Wifi Home Router HR-3300 Description The issue allows for XSS via the userid or password parameter to the "admin login page" API endpoint. Recommendations For Digisol Wireless Wifi Home Router HR-3300, avoid using the userid o...

CVE-2019-7666

Prima Systems FlexAir, Versions 2.3.38 and prior. The application allows improper authentication using the MD5 hash value of the password, which may allow an attacker with access to the database to login as admin without decrypting the password...

CVE-2019-7666

Prima Systems FlexAir, Versions 2.3.38 and prior. The application allows improper authentication using the MD5 hash value of the password, which may allow an attacker with access to the database to login as admin without decrypting the password...

Authentication flaw

Prima Systems FlexAir, Versions 2.3.38 and prior. The application allows improper authentication using the MD5 hash value of the password, which may allow an attacker with access to the database to login as admin without decrypting the password...

Cross site scripting

TP-Link TL-WR840N v5 00000005 devices allow XSS via the network name. The attacker must log into the router by breaking the password and going to the admin login page by THC-HYDRA to get the network name. With an XSS payload, the network name changed automatically and the internet connection was...