Zoom X4 / X5 SQL Injection / Authentication Bypass Vulnerabilities

Zoom X4 and X5 modems suffers from authentication bypass and remote SQL injection vulnerabilities. Vulnerable Products - Zoom X4 ADSL Modem and Router running Nucleus/4.3 UPnP/1.0Virata-EmWeb/R620 Server All GS Firmware versions Zoom X5 ADSL Modem and Router running Nucleus/4.3...

Zoom Telephonics X4/X5 ADSL Modem - Multiple Vulnerabilities

Vulnerable Products - Zoom X4 ADSL Modem and Router running Nucleus/4.3 UPnP/1.0Virata-EmWeb/R620 Server All GS Firmware versions Zoom X5 ADSL Modem and Router running Nucleus/4.3 UPnP/1.0Virata-EmWeb/R620 Server All GS Firmware versions Note: A similar vulnerability was reported several years ag...

Zoom X4/X5 ADSL Modem and Router -Unauthenticated Remote Root Command Execution

Vulnerable Products - Zoom X4 ADSL Modem and Router running Nucleus/4.3 UPnP/1.0Virata-EmWeb/R620 Server All GS Firmware versions Zoom X5 ADSL Modem and Router running Nucleus/4.3 UPnP/1.0Virata-EmWeb/R620 Server All GS Firmware versions Note: A similar vulnerability was reported several years ag...

Invision Power Board Admin 帐号接管命令执行漏洞

Invision Power Board是一个非常流行的PHP论坛程序。 Invision Power Board没有正确验证注册页面User Email字段的输入内容，导致远程攻击者能够修改任意用户的登录密码。通过修改管理员帐户的密码，攻击者能够远程执行代码。成功利用该漏洞需要攻击者获得目标帐户的用户名和注册邮件地址。 0 Invision Power Board Invision Power Board 3.4.4 厂商补丁： Invision Power Board -------------------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

On IPB just out of 0day vulnerabilities due to mysql truncation causes of vulnerability-vulnerability warning-the black bar safety net

First posted about the original: http://www.john-jean.com/blog/securite-informatique/ipb-invision-power-board-all-versions-1-x-2-x-3-x-admin-account-takeover-leading-to-code-execution-742 This is a good vulnerability, not IPB now using how widely although also in my day is used quite widely, sigh...

Invision Power Board 1.x / 2.x / 3.x Admin Account Takeover

Invision Power Board IPD versions 1.x, 2.x, and 3.x suffer from an administrative account takeover vulnerability that allows for code execution. IPB Invision Power Board all versions 1.x? / 2.x / 3.x Admin account Takeover leading to code execution Written on : 2013/05/02 Released on : 2013/05/13...

Invision Power Board 1.x?/2.x/3.x - Admin Takeover

IPB Invision Power Board all versions 1.x? / 2.x / 3.x Admin account Takeover leading to code execution Written on : 2013/05/02 Released on : 2013/05/13 Author: John JEAN @johnjean on twitter Affected application: Invision Power Board = 3.4.4 Type of vulnerability: Logical Vulnerability / Bad...

Invision Power Board 1.x / 2.x / 3.x Admin Account Takeover

IPB Invision Power Board all versions 1.x? / 2.x / 3.x Admin account Takeover leading to code execution Written on : 2013/05/02 Released on : 2013/05/13 Author: John JEAN @johnjean on twitter Affected application: Invision Power Board = 3.4.4 Type of vulnerability: Logical Vulnerability / Bad...

PHPSHE（简好技术）某功能储存xss，可以蠕虫，并成功搞到admin

简要描述： See your gifts, I came... 详细说明： 测试地址：http://www.phpshe.com/bbs/topic/46 1 漏洞缺陷地址 http://www.phpshe.com/bbs 2 论坛发帖子回复等，帖子内容只做了前端过滤，所以我用charles直接修改post数据就可以绕过了（服务端完全是啥都么有过滤的节奏啊）。 3 发了个帖子，诱骗了一下管理员。 图0 4 果然很快就上勾了，同时还搞到了其他一些其他用户的cookie。 图1 5 这个cookie是管理员的 图2 6 怕你不信我搞到了管理员的cookie，并成功登录，所以我留了几个记号。...

CVE-2013-0126

Multiple cross-site request forgery CSRF vulnerabilities in index.cgi on the Verizon FIOS Actiontec MI424WR-GEN3I router with firmware 40.19.36 allow remote attackers to hijack the authentication of administrators for requests that 1 add administrative accounts via the username and userlevel...

Exploit for stealing admin's account in Question2Answer

Hello! Here is exploit for stealing admin's account in Question2Answer. This exploit uses Cross-Site Request Forgery vulnerability at http://site/account and Insufficient Anti-automation vulnerabilities at http://site/forgot and http://site/reset, which I've described in the second advisory about...

osTicket 1.6 ST CSRF / SQL Injection

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 + Site : 1337day.com 0 1 + Support e-mail :...

Novell NetIQ Privileged User Manager modifyAccounts Security Bypass

Added: 12/07/2012 BID: 56535 OSVDB: 87335 Background Novell NetIQ Privileged User Manager NPUM allows IT administrators to work on systems without exposing superuser administrator or supervisor passwords or root-account credentials to the administrator. Problem NetIQ Privileged User Manager 2.3.1...

Novell NetIQ Privileged User Manager modifyAccounts Security Bypass

Added: 12/07/2012 BID: 56535 OSVDB: 87335 Background Novell NetIQ Privileged User Manager NPUM allows IT administrators to work on systems without exposing superuser administrator or supervisor passwords or root-account credentials to the administrator. Problem NetIQ Privileged User Manager 2.3.1...

Joke network to get a shell and fix-vulnerability warning-the black bar safety net

Keywords: Google news. asp? ID=2 0 goofy The default database download address: www.2ctoo.com/ data/lexiang. mdb 9 0%success Background default account: admin By the background backup to get the SHELL See the figure: ! Repair solutions: Modify the default download address and backstage password...

Magnum MNS-6K Hardcoded Admin Account

Binary data scadagarrettcomhardcodedpassword.nbin...

Netsweeper WebAdmin Portal CSRF / XSS / SQL Injection

Exploit Title: Netsweeper WebAdmin Portal CSRF, Reflective XSS, and SQL Injection "The later"\ Date: Discovered and reported CSRF and XSS 4/2012 and "The later" 7/2012\ Author: Jacob Holcomb/Gimppy042\ Software Link: Netsweeper Inc. - Netsweeper Internet Filter www.netsweeper.com\ CVE :...

RV Article Publisher - Cross-Site Request Forgery

RV Article Publisher - Cross-Site Request Forgery Exploit Title: RV Article publisher CSRF Vulnerability Date: 26/08/2012 Author: DaOne @LibyanCA Vendor: http://www.scripts4webmasters.com Greetings to LCA CSRF Add Admin...

ClipBucket 2.5 Cross Site Request Forgery

Exploit Title: ClipBucket 2.5 CSRF Vulnerability Author: DaOne LCA Date: 15/8/2012 Software Link: http://clip-bucket.com/ Or: http://sourceforge.net/projects/clipbucket/ CSRF Add Admin thanks to : Ly.Lolsec...

ClipBucket 2.5 CSRF Vulnerability

Exploit for php platform in category web applications Exploit Title: ClipBucket 2.5 CSRF Vulnerability Author: DaOne LCA Date: 15/8/2012 Software Link: http://clip-bucket.com/ Or: http://sourceforge.net/projects/clipbucket/ CSRF Add Admin thanks to : Ly.Lolsec 0day.today 2018-03-12...