IBM Network Security Protection XGS Default Credentials

Nessus was able to login to the remote IBM Network Security Protection XGS device using a known set of default credentials. This allows a remote attacker to gain administrative access to the device. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

Default Password (abc123) for 'admin' Account

The account 'admin' on the remote host has the default password 'abc123'. An attacker can leverage this issue to gain full access to the affected system. Note that Junos Space is known to use these credentials by default. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. account = "admin";...

CVE-2014-9406

ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier has a default password of password for the admin account, which makes it easier for remote attackers to obtain access via a request to homeloggedout.php...

Default credentials

ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier has a default password of password for the admin account, which makes it easier for remote attackers to obtain access via a request to homeloggedout.php...

CVE-2014-9406

CVE-2014-9406 affects the ARRIS Touchstone TG862G/CT Telephony Gateway (firmware 7.6.59S.CT and earlier). The underlying issue is a default admin password of 'password' , which allows remote attackers to gain access via a request to home_loggedout.php. The entry documents a network-accessible, hi...

CVE-2014-9406

ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier has a default password of password for the admin account, which makes it easier for remote attackers to obtain access via a request to homeloggedout.php...

CVE-2014-9344

Cross-site request forgery CSRF vulnerability in Snowfox CMS before 1.0.10 allows remote attackers to hijack the authentication of administrators for requests that add a new admin account via a submit action in the admin/accounts/create uri to snowfox/...

CVE-2014-9344

Cross-site request forgery CSRF vulnerability in Snowfox CMS before 1.0.10 allows remote attackers to hijack the authentication of administrators for requests that add a new admin account via a submit action in the admin/accounts/create uri to snowfox/...

某OA办公系统储存型XSS第二发(demo演示)

简要描述： 涉及大量政府，医院，房产，电视台等网站 详细说明： 这个和 WooYun: 华天动力oa系统多处xss漏洞打包--专业盲打管理员2 这个洞很相似，但是绝对不一样哈，只是相似。。 问题属于过滤不严格，还是在在文档中心，随便点个进去，新建文件夹，名字插入xss代码，构造之前Mosuan大牛插入的代码试试先：alert/3/,保存后发现是没有弹窗的 应该是被过滤了，不怕，然后我们继续构造"/alert/3/再保存看看 可以看到成功弹窗 但是这个时候我们登陆的是普通用户，然后登陆管理员账号看看吧，成功弹窗 img...

xEpan 1.0.1 Cross Site Request Forgery Vulnerability

xEpan version 1.0.1 suffers from a cross site request forgery vulnerability. Product: xEpan Vendor: Xavoc Technocrats Pvt. Ltd. Vulnerable Versions: 1.0.1 and probably prior Tested Version: 1.0.1 Advisory Publication: October 22, 2014 without technical details Vendor Notification: October 22, 201...

CVE-2014-8953

Multiple cross-site request forgery CSRF vulnerabilities in Php Scriptlerim Who's Who script allow remote attackers to hijack the authentication of administrators or requests that 1 add an admin account via a request to filepath/yonetim/plugin/adminsave.php or have unspecified impact via a reques...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Php Scriptlerim Who's Who script allow remote attackers to hijack the authentication of administrators or requests that 1 add an admin account via a request to filepath/yonetim/plugin/adminsave.php or have unspecified impact via a reques...

Who's Who Script Cross Site Request Forgery

Title : Who's Who Script CSRF Exploit Add Admin Account Author : ZoRLu / [email protected] / [email protected] Home : http://milw00rm.com / its online Date : 30.10.2014 Demo : http://demo.phpscriptlerim.com/free/whoswho/ Download1 : http://www.phpscriptlerim.com/download/indir.php?id=14...

Who's Who Script - CSRF Exploit (Add Admin Account)

No description provided by source. Title : Who's Who Script CSRF Exploit Add Admin Account Author : ZoRLu / [email protected] / [email protected] Home : http://milw00rm.com / its online Date : 30.10.2014 Demo : http://demo.phpscriptlerim.com/free/whoswho/ Download1 :...

Who's Who Script - Cross-Site Request Forgery (Add Admin)

Title : Who's Who Script CSRF Exploit Add Admin Account Author : ZoRLu / [email protected] / [email protected] Home : http://milw00rm.com / its online Date : 30.10.2014 Demo : http://demo.phpscriptlerim.com/free/whoswho/ Download1 : http://www.phpscriptlerim.com/download/indir.php?id=14...

Whos Who Script - Cross-Site Request Forgery (Add Admin)

Whos Who Script - Cross-Site Request Forgery Add Admin Title : Who's Who Script CSRF Exploit Add Admin Account Author : ZoRLu / [email protected] / [email protected] Home : http://milw00rm.com / its online Date : 30.10.2014 Demo : http://demo.phpscriptlerim.com/free/whoswho/ Download1 :...

ShopBuilder 5.6.1 /module/news/admin/news.php SQL注入漏洞

No description provided by source. !/usr/bin/env python coding=utf-8 import re import urllib2 from comm import cmdline from comm import generic pocinfo = 'VulId': '1568', 'Name': 'ShopBuilder 5.6.1 /module/news/admin/news.php SQL注入漏洞 POC', 'AppName': 'ShopBuilder', 'AppPowerLink':...

Phpok漏洞礼包组合可shell

简要描述： Phpok漏洞礼包，组合可shell 详细说明： 1.2处存储行xss 2.添加管理员帐号密码+利用点 3.后台写shell 1. 第一处 我们先来注册一个帐号。 其中帐号这内容为 a';document.write''// 注册好之后。 后台 需要点击才能激活xss 第二处 留言 留言主题...

Tccms sql注入获得管理账号密码

简要描述： 直接看到/app/model/attackAction.class.php这个文件 public function initLogHacker /get/ foreach$GET as $key=$value if !inarray$key, array'ac','a','c','do'//防止控制器和方法命名不规范被过滤 $this-StopAttack$key,$value,"get",$this-getfilter; $GET$key = StringUtil::safereplace$value; $GET$key =...

CVE-2014-4018

The ZTE ZXV10 W300 router with firmware W300V1.0.0aZRDLK has a default password of admin for the admin account, which makes it easier for remote attackers to obtain access via unspecified vectors...