DaloRadius CSRF / XSS / SQL Injection

------------------------------------------------------------------------- Software : DaloRadius SQLi / CSRF / XSS Author : Saadat Ullah , [email protected] Author home : http://security-geeks.blogspot.com Date : 15/3/13 Vendors : http://www.daloradius.com/ Download Link :...

Design/Logic Flaw

The domain management tool rhevm-manage-domains in Red Hat Enterprise Virtualization Manager RHEV-M 3.1 and earlier, when the validate action is enabled, logs the administrative password to a world-readable log file, which allows local users to obtain sensitive information by reading this file...

CVE-2012-6115

The domain management tool rhevm-manage-domains in Red Hat Enterprise Virtualization Manager RHEV-M 3.1 and earlier, when the validate action is enabled, logs the administrative password to a world-readable log file, which allows local users to obtain sensitive information by reading this file...

PT-2013-1900 · Red Hat · Red Hat Enterprise Virtualization Manager

Name of the Vulnerable Software and Affected Versions: Red Hat Enterprise Virtualization Manager versions 3.1 and earlier Description: The issue affects the domain management tool, specifically when the validate action is enabled, causing the administrative password to be logged to a world-readab...

D-Link DIR-645 Router Authentication Bypass Vulnerability (Feb 2013) - Active Check

D-Link DIR-645 Router devices are prone to an authentication bypass vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only nb: Running...

rhev: rhevm-manage-domains logs admin passwords

The domain management tool rhevm-manage-domains in Red Hat Enterprise Virtualization Manager RHEV-M 3.1 and earlier, when the validate action is enabled, logs the administrative password to a world-readable log file, which allows local users to obtain sensitive information by reading this file...

WordPress Plugin Google Document Embedder Arbitrary File Disclosure

This Metasploit module exploits an arbitrary file disclosure flaw in the WordPress blogging software plugin known as Google Document Embedder. The vulnerability allows for database credential disclosure via the /libs/pdf.php script. The Google Document Embedder plug-in versions 2.4.6 and below ar...

WordPress Plugin Google Document Embedder Arbitrary File Disclosure

This module exploits an arbitrary file disclosure flaw in the WordPress blogging software plugin known as Google Document Embedder. The vulnerability allows for database credential disclosure via the /libs/pdf.php script. The Google Document Embedder plug-in versions 2.4.6 and below are vulnerabl...

Smoke Loader SQL Injection

Like other http-based exploit kits, I've discovered that the smoke loader malware downloader has a sql injection in its C&C administration panel that can be used to revel the administrator's password. sqlmap can identify the vulnerable parameter with the string:...

CVE-2012-3002

The web interface on 1 Foscam and 2 Wansview IP cameras allows remote attackers to bypass authentication, and perform administrative functions or read the admin password, via a direct request to an unspecified URL...

Authentication flaw

The web interface on 1 Foscam and 2 Wansview IP cameras allows remote attackers to bypass authentication, and perform administrative functions or read the admin password, via a direct request to an unspecified URL...

CVE-2012-3002

The web interface on 1 Foscam and 2 Wansview IP cameras allows remote attackers to bypass authentication, and perform administrative functions or read the admin password, via a direct request to an unspecified URL...

MyBB DyMy User Agent Plugin - newreply.php SQL Injection

MyBB DyMy User Agent Plugin - newreply.php SQL Injection Exploit title : MyBB DyMy User Agent Plugin SQL injection vulnerability. Author: JoinSe7en Date : 13 Dec 2012 Tested on : Linux Category : Web Applications Software Link : http://mods.mybb.com/view/dymy-user-agent PoC receive admin username...

MyBB DyMy User Agent SQL Injection

Exploit title : MyBB DyMy User Agent Plugin SQL injection vulnerability. Author: JoinSe7en Date : 13 Dec 2012 Tested on : Linux Category : Web Applications Software Link : http://mods.mybb.com/view/dymy-user-agent PoC receive admin username We fire up HTTP Live Headers or a similar tool, post...

MyBB DyMy User Agent Plugin - 'newreply.php' SQL Injection

Exploit title : MyBB DyMy User Agent Plugin SQL injection vulnerability. Author: JoinSe7en Date : 13 Dec 2012 Tested on : Linux Category : Web Applications Software Link : http://mods.mybb.com/view/dymy-user-agent PoC receive admin username We fire up HTTP Live Headers or a similar tool, post...

Buffalo Linkstation Privilege Escalation

Release Date. 5-Dec-2012 Last Update. - Vendor Notification Date. - Product. Linkstation & Others Platform. Buffalo Technology Affected versions. Including Actual Version Severity Rating. High Impact. Admin Password Reset Attack Vector. From remote Solution Status. Don't use Buffalo CVE reference...

Buffalo Linkstation Privilege Escalation Vulnerability

Buffalo Linkstation and various other Buffalo products suffer from a privilege escalation vulnerability where a permanent guest account can be used to change the administrative password. Product. Linkstation & Others Platform. Buffalo Technology Affected versions. Including Actual Version Severit...

pulp /etc/pulp/pulp.conf world readable, contains default admin password

Pulp in Red Hat CloudForms before 1.1 uses world-readable permissions for pulp.conf, which allows local users to read the administrative password by reading this file...

Buffalo Linkstation Privilege Escalation / Information Disclosure Vulnerabilities

Buffalo Linkstation suffers from information disclosure and privilege escalation vulnerabilities. Product. Linkstation & Others Platform. Buffalo Technology Affected versions. Including Actual Version Severity Rating. Medium Impact. Privilege escalation, Information Disclosure Attack Vector. From...

Buffalo Linkstation Privilege Escalation / Information Disclosure

Release Date. 30-Nov-2012 Last Update. - Vendor Notification Date. 23.Dec.2011 Product. Linkstation & Others Platform. Buffalo Technology Affected versions. Including Actual Version Severity Rating. Medium Impact. Privilege escalation, Information Disclosure Attack Vector. From remote Solution...