2525 matches found
Vox TG790 ADSL Router - Cross-Site Request Forgery (Add Admin)
Vox TG790 ADSL Router - Cross-Site Request Forgery Add Admin Title: Vox TG790 ADSL Router - Cross-Site Request Forgery Add Admin Author: Cakes Exploit Date: 2018-08-01 Vendor: Vox Telecom Link: https://www.vox.co.za/ Firmware Version: 6.2.W.1 CVE: N/A Description Due to improper session managemen...
Gxlcms Cross-Site Request Forgery Vulnerability
Gxlcms is an enterprise website creation system. A cross-site request forgery vulnerability exists in Gxlcms version 2.0. A remote attacker can exploit this vulnerability to add an administrator account with the help of news/index.php?s=Admin-Admin-Insert URL...
CVE-2018-15177
In Gxlcms 2.0, a news/index.php?s=Admin-Admin-Insert CSRF attack can add an administrator account...
CVE-2018-15177
In Gxlcms 2.0, a news/index.php?s=Admin-Admin-Insert CSRF attack can add an administrator account...
Shopify: Stored XSS on activity
Hi security team members, Description I found a store xss on the activity which allows an attacker to steal admin account cookies. Step to reproduce 1-Create store 2- Add a member in a store 3- Member can choose any name 4- So change the any member name with hunter" 5- Now on admain account make...
CVE-2018-14943
Harmonic NSG 9000 devices have a default password of nsgadmin for the admin account, a default password of nsgguest for the guest account, and a default password of nsgconfig for the config account...
CVE-2018-14943
Harmonic NSG 9000 devices have a default password of nsgadmin for the admin account, a default password of nsgguest for the guest account, and a default password of nsgconfig for the config account...
Cisco Prime Collaboration Provisioning Denial of Service Vulnerability
Cisco Prime Collaboration Provisioning is the United States Cisco Cisco company's set of Web-based next-generation communications services software. The software provides IP communication service features for IP telephony, voice mail and unified communications environments. A security vulnerabili...
BageCMS Cross-Site Request Forgery Vulnerability
BageCMS is a cross-platform content management system CMS based on PHP and MySQL. A cross-site request forgery vulnerability exists in the index.php?r=admini/admin/create URL in BageCMS version 3.1.3. A remote attacker can exploit the vulnerability to add a backend administrator account...
CVE-2018-14583
xyhai.php?s=/Auth/addUser in XYHCMS 3.5 allows CSRF to add a background administrator account...
Cross site request forgery (csrf)
index.php?r=admini/admin/create in BageCMS V3.1.3 allows CSRF to add a background administrator account...
CVE-2018-14582
CVE-2018-14582 affects BageCMS v3.1.3, where a CSRF flaw in index.php?r=admini/admin/create allows a remote attacker to add a background administrator account. The issue is documented across multiple sources (NVD, Red Hat, CNVD, CVE records) with no explicit patch/version remediation details in t...
CVE-2018-14583
XYHCMS 3.5 is affected by a Cross-Site Request Forgery (CSRF) in the URL xyhai.php?s=/Auth/addUser, which can be used to add a background administrator account. The vulnerability is described across multiple sources as CVE-2018-14583. The provided connected documents confirm the affected componen...
October CMS Cross-Site Scripting Vulnerability (CNVD-2018-14215)
October CMS is an open source, self-hosted content management system CMS built on the Laravel PHP framework, developed by Canadian software developer Alexey Bobkov and Australian software developer Samuel Georges. The Media module is one of the media content management modules. A cross-site...
Oracle GlassFish Open Source Edition Remote Monitoring Vulnerability
Oracle GlassFish is the United States Oracle Oracle company to achieve a jsp and other applications such as server software. Oracle GlassFish Open Source Edition is its open source version. Oracle GlassFish Open Source Edition 5.0 version of the demonstration function has a security vulnerability...
Oracle GlassFish 5.0 Demo Feature Default Credentials Vulnerability
Oracle GlassFish Server is using default credentials for the demo feature. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
CVE-2018-14324
The demo feature in Oracle GlassFish Open Source Edition 5.0 has TCP port 7676 open by default with a password of admin for the admin account. This allows remote attackers to obtain potentially sensitive information, perform database operations, or manipulate the demo via a JMX RMI session, aka a...
Design/Logic Flaw
The demo feature in Oracle GlassFish Open Source Edition 5.0 has TCP port 7676 open by default with a password of admin for the admin account. This allows remote attackers to obtain potentially sensitive information, perform database operations, or manipulate the demo via a JMX RMI session, aka a...
CVE-2018-14324
The demo feature in Oracle GlassFish Open Source Edition 5.0 has TCP port 7676 open by default with a password of admin for the admin account. This allows remote attackers to obtain potentially sensitive information, perform database operations, or manipulate the demo via a JMX RMI session, aka a...