Lansweeper 7.2 - Incorrect Access Control

Exploit Title: Lansweeper 7.2 - Incorrect Access Control SHODAN DORK : title:"Lansweeper - Login" Date: 2020-06-14 Exploit Author: Amel BOUZIANE-LEBLOND Vendor Homepage: https://www.lansweeper.com/ Software Link: https://www.lansweeper.com Version: 6.0.x through 7.2.x Tested on: Windows CVE :...

CVE-2020-14011

Lansweeper 6.0.x through 7.2.x has a default installation in which the admin password is configured for the admin account, unless "Built-in admin" is manually unchecked. This allows command execution via the Add New Package and Scheduled Deployments features...

CVE-2020-14011

Lansweeper 6.0.x through 7.2.x has a default installation in which the admin password is configured for the admin account, unless "Built-in admin" is manually unchecked. This allows command execution via the Add New Package and Scheduled Deployments features...

Command injection

Lansweeper 6.0.x through 7.2.x has a default installation in which the admin password is configured for the admin account, unless "Built-in admin" is manually unchecked. This allows command execution via the Add New Package and Scheduled Deployments features...

CVE-2020-14011

CVE-2020-14011 affects Lansweeper 6.0.x–7.2.x. The default installation leaves the admin password configured for the admin account unless the built-in admin option is unchecked, enabling command execution via Add New Package and Scheduled Deployments. Multiple sources (NVD/Red Hat/CNVD/Exploits d...

CVE-2020-5363

Select Dell Client Consumer and Commercial platforms include an issue that allows the BIOS Admin password to be changed through Dell's manageability interface without knowledge of the current BIOS Admin password. This could potentially allow an unauthorized actor, with physical access and/or OS...

CVE-2020-5363

Dell CVE-2020-5363 affects select Dell Client Client Consumer and Commercial platforms, where the BIOS Admin password can be changed through Dell’s manageability interface without the current password. This could allow an attacker with physical access or OS administrator privileges to gain privil...

CVE-2020-5363

Select Dell Client Consumer and Commercial platforms include an issue that allows the BIOS Admin password to be changed through Dell's manageability interface without knowledge of the current BIOS Admin password. This could potentially allow an unauthorized actor, with physical access and/or OS...

CVE-2020-5363

Select Dell Client Consumer and Commercial platforms include an issue that allows the BIOS Admin password to be changed through Dell's manageability interface without knowledge of the current BIOS Admin password. This could potentially allow an unauthorized actor, with physical access and/or OS...

Exploit for Incorrect Default Permissions in Sonatype Nexus

CVE-2020-11444 Nexus 3 越权漏洞利用脚本 更多脚本文件另参：https://github.com/...

NukeViet VMS 4.4.00 Cross Site Request Forgery

Exploit Title: NukeViet VMS 4.4.00 - Cross-Site Request Forgery Change Admin Password Date: 2020-05-18 Exploit Author: JEBARAJ Vendor Homepage: https://nukeviet.vn/ Software Link: https://github.com/nukeviet/nukeviet/releases/download/4.4.00/nukeviet4.4.00setup.zip Version: 4.4.00 Tested on:...

NukeViet VMS 4.4.00 - Cross-Site Request Forgery (Change Admin Password) Vulnerability

Exploit for php platform in category web applications Exploit Title: NukeViet VMS 4.4.00 - Cross-Site Request Forgery Change Admin Password Exploit Author: JEBARAJ Vendor Homepage: https://nukeviet.vn/ Software Link:...

Unspecified Vulnerability in Bond Technology Management JetSelect (CNVD-2020-29621)

Bond Technology Management JetSelect is an application for managing IP and networks on board ships from Bond Technology Management in Cyprus. An unspecified vulnerability exists in Bond Technology Management JetSelect, which arises from the administrator password being stored in an unprotected fi...

Unauthorized Access Vulnerability in RG-RSR20-14E Router

The RG-RSR20-14E is a multi-service router. An unauthorized access vulnerability exists in the RG-RSR20-14E router, which can be exploited by an attacker to remove or modify the administrator user password...

Exploit for OS Command Injection in Pi-Hole

CVE-2020-8816 A Python script to exploit CVE-2020-8816, a remo...

WAVLINK WL-WN579G3 and WL-WN575A3 Information Disclosure Vulnerability

WAVLINK WL-WN579G3 and WL-WN575A3 are both wireless network signal extenders from China-based RuiYin Technology WAVLINK. A security vulnerability exists in the backup function in WAVLINK WL-WN579G3 - M79X3.V5030.180719 version and WL-WN575A3 - RPT75A3.V4300.180801 version. An attacker can exploit...

CVE-2020-10916

This vulnerability allows network-adjacent attackers to escalate privileges on affected installations of TP-Link TL-WA855RE Firmware Ver: 855rev4-up-ver1-0-1-P120191213-rel60361 Wi-Fi extenders. Although authentication is required to exploit this vulnerability, the existing authentication mechani...

CVE-2020-10973

An issue was discovered in Wavlink WN530HG4, Wavlink WN531G3, Wavlink WN533A8, and Wavlink WN551K1 affecting /cgi-bin/ExportAllSettings.sh where a crafted POST request returns the current configuration of the device, including the administrator password. No authentication is required. The attacke...

CVE-2020-10972

An issue was discovered where a page is exposed that has the current administrator password in cleartext in the source code of the page. No authentication is required in order to reach the page a certain live?.shtml page with the variable syspasswd. Affected Devices: Wavlink WN530HG4, Wavlink...

IBM Data Risk Manager Code Execution Vulnerability

IBM Data Risk Manager is a data risk manager from IBM USA. The product supports discovery, analysis and visualization of business risk data, among other things. A code execution vulnerability exists in IBM Data Risk Manager, which stems from the use of a default password for the IDRM administrati...