CG-WLR300NX fails to restrict access permissions

Overview CG-WLR300NX provided by Corega Inc is a wireless LAN router. CG-WLR300NX fails to restrict access permissions. Satoshi Ogawa of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

Weak Password Vulnerability in Free Planning Enterprise Website Management System

Free Planner Enterprise Website Management System is an ASP-based website builder. Freedom of planning enterprise website management system default weak password vulnerability, attackers exploit the vulnerability through the default weak password admin/admin login website background, get backgrou...

Weak Password Vulnerability in NetDrive Unified Communications Platform (Active-UC)

NetDynamic Unified Communications platform Active-UC provides office communication services for enterprises, integrating various communication devices, media and applications. A weak password vulnerability exists in NetDrive Unified Communications Platform Active-UC. Account password: admin /...

windgap-pa.gov XSS vulnerability

Vulnerable URL: http://windgap-pa.gov/admin/login.php Details: Description| Value ---|--- Patched:| Yes, at 28.07.2017 Latest check for patch:| 28.07.2017 11:55 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 11038053 VIP website status:| No Check windgap-pa.gov...

Weak password vulnerability in NetSense Firewall Security Audit System (secfox)

NetShen Firewall is a well-known firewall in China, products related to the net gate, sslVPN, security audit, ssh and so on. A weak password vulnerability exists in the security audit system secfox of NetShen Firewall, which can be exploited by an attacker to log in as an administrator. The...

miniblog 1.0.1 - Cross-Site Request Forgery (Add New Post)

Exploit for php platform in category web applications Exploit Title : miniblog 1.0.1 - Cross-Site Request Forgery Add New Post Author : Besim Google Dork : Date : 09/10/2016 Type : webapps Platform : PHP Vendor Homepage : http://www.spyka.net/scripts/php/miniblog Software link :...

miniblog 1.0.1 - Cross-Site Request Forgery (Add New Post)

Exploit Title : miniblog 1.0.1 - Cross-Site Request Forgery Add New Post Author : Besim Google Dork : Date : 09/10/2016 Type : webapps Platform : PHP Vendor Homepage : http://www.spyka.net/scripts/php/miniblog Software link : http://dl.spyka.co.uk/scripts/php/miniblog-1-0-1.zip Description admin...

Netnifty Nebula Internet Behavior Management System Exploits Information Leakage Vulnerabilities

Leadsec Internet Behavior Management System referred to as Leadsec ACM is an all-round solution for Internet access users in terms of information content security, network application management, organizational operational efficiency, network resource utilization, legal risk avoidance and network...

Design by ARRR Design - SQL Injection

Design by ARRR Design - SQL Injection. Webapps exploit for PHP platform Exploit Title: Design by ARRR Design Get Username & Password Exploit Author: ./MalingSendal - Trenggalek Cyber Army Dork : intext:"Design by ARRR Design" Vendor Homepage: http://arrrdesign.web.id/ Date : 2016/10/07 Tested on ...

Weak Password Vulnerability in Mapper VPN3005C-104 Appliance

The Maipu VPN3005C-104 device is a security gateway developed by Maipu. A weak password vulnerability exists in the Maipu VPN3005C-104 device. It allows an attacker to log in to the system backend and gain administrator privileges by using the account password admin\admin...

Canoas Web Hosting Administration Page Bypass Vulnerability

A security vulnerability exists in the Canoas web hosting administration page. Due to a failure to filter the Login and Senha parameters in the admin/login.php page. This allows an attacker to bypass login restrictions and perform unauthorized operations...

Loxone Smart Home Default Admin Login (HTTP)

The remote Loxone installation has default credentials set. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Goigi CMS Backend /admin/index.php Universal Password Bypass Vulnerability

Goigi CMS has a universal password bypass vulnerability in the backend /admin/index.php login, which can be utilized with '=' 'or' to bypass login authentication. When the login succeeds, the page returns 302 and location=location: dashboard in the http header. If the login fails, the returned...

Honeywell IP-Camera HICC-1100PT - Credentials Disclosure

imply go to the following url: http://host:port/cgi-bin/readfile.cgi?query=ADMINID Should return some javascript variable which contain the credentials and other configuration vars: var AdmID="admin"; var AdmPass1=“admin”; var AdmPass2=“admin”; var Language=“en”; var LogoffTime="0"; Request: GET...

Open Upload Remote Cross-Site Request Forgery Vulnerability

Open Upload is an extensible PHP open source project for creating a private/public file download server . The Open Upload application suffers from a CSRF vulnerability, which can be exploited to lure an administrator user to a specially crafted URL via spear phishing or social engineering, allowi...

Hitron CGNV4 ModemRouter 4.3.9.9-SIP-UPC - Multiple Vulnerabilities

Hitron CGNV4 ModemRouter 4.3.9.9-SIP-UPC - Multiple Vulnerabilities Hitron CGNV4 modem/router multiple vulnerabilities -------------------------------------------------- Platforms / Firmware confirmed affected: - Hitron CGNV4, 4.3.9.9-SIP-UPC - Product page:...

Hitron CGNV4 Modem / Router 4.3.9.9-SIP-UPC - Multiple Vulnerabilities

Exploit for hardware platform in category web applications Hitron CGNV4 modem/router multiple vulnerabilities -------------------------------------------------- Platforms / Firmware confirmed affected: - Hitron CGNV4, 4.3.9.9-SIP-UPC - Product page:...

The vulnerability of the Dr.Web Enterprise Security Suite, a antivirus software, allows a malicious individual to carry out XSS attacks.

The vulnerability of the Dr.Web Enterprise Security Suite anti-virus protection allows for XSS attacks due to insufficient validation of the user name in the web administrator’s login page. This means that before the user name is returned to the user, it may be compromised by a malicious actor...

WordPress xmlrpc Weak Password Access Attempt

Sending a request to xmlrpc.php requires authentication. An attacker may attempt guessing passwords to the system while avoiding the admin login page...

Weak Password Vulnerability in Web Management System of Xi'an Netcom Network Technology Co.

Xi'an Netcom Network Technology Co., Ltd. website management system is to provide customers with a total solution for network marketing. A weak password vulnerability exists in the website management system of Xi'an Netco Network Technology Co. An attacker can utilize the default background as:...