4069 matches found
QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit)
This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'base64' class MetasploitModule 'QNAP TS-431 QTS %q This module creates a virtual web server and uploads the php payload into it. Admin privileges cannot access a...
Weak Password Vulnerability in Cygnus WAC
Shenzhen Xinrui Network Technology Co., Ltd. is a wholly owned subsidiary of SZSG, a next-generation enterprise-grade wireless, IoT and switch solution vendor. A weak password vulnerability exists in Cygnus WAC. An attacker can exploit this vulnerability to gain administrative privileges of the...
devolo dLAN 550 duo+ Starter Kit - Cross-Site Request Forgery
devolo dLAN 550 duo+ Starter Kit - Cross-Site Request Forgery devolo dLAN 550 duo+ Starter Kit Cross-Site Request Forgery Vendor: devolo AG Product web page: https://www.devolo.com Affected version: dLAN 500 AV Wireless+ 3.1.0-1 i386 Summary: Devolo dLAN® 550 duo+ Starter Kit is Powerlineadapter...
Code injection
In Vignette Content Management version 6, it is possible to gain remote access to administrator privileges by discovering the admin password in the vgn/ccb/user/mgmt/user/edit/0,1628,0,00.html?uid=admin HTML source code, and then creating a privileged user account. NOTE: this product is...
CVE-2018-18941
In Vignette Content Management version 6, it is possible to gain remote access to administrator privileges by discovering the admin password in the vgn/ccb/user/mgmt/user/edit/0,1628,0,00.html?uid=admin HTML source code, and then creating a privileged user account. NOTE: this product is...
CVE-2018-18941
In Vignette Content Management version 6, a vulnerability allows an attacker to gain remote administrator privileges by discovering the admin password in the vgn/ccb/user/mgmt/user/edit/0,1628,0,00.html?uid=admin HTML source code and then creating a privileged user account. The issue arises from ...
Leica Geosystems GR10GR25GR30GR50 GNSS 4.30.063 - Cross-Site Request Forgery
Leica Geosystems GR10GR25GR30GR50 GNSS 4.30.063 - Cross-Site Request Forgery...
SugarCRM Web Logic Hooks Module PHP Code Injection Vulnerability
SugarCRM versions prior to 7.9.5.0, 8.0.2, and 8.2.0 suffer from a PHP code injection vulnerability. User input passed through the "triggerevent" parameter is not properly sanitized before being used to save PHP code into the 'logichooks.php' file through the Web Logic Hooks module. This can be...
SugarCRM addLabels PHP Code Injection Vulnerability
SugarCRM versions prior to 7.9.5.0, 8.0.2, and 8.2.0 suffer from a PHP code injection vulnerability. User input passed through key values of the 'labels' parameters is not properly sanitized before being used to save PHP code within the "ParserLabel::addLabels" method when saving labels through t...
SugarCRM SaveDropDown PHP Code Injection
-------------------------------------------------------- SugarCRM SaveDropDown PHP Code Injection Vulnerability -------------------------------------------------------- - Software Link: http://www.sugarcrm.com - Affected Versions: All versions prior to 7.9.5.0, 8.0.2, and 8.2.0. - Vulnerability...
The vulnerability of network monitoring software for PRTG Network Monitor, related to insecure privilege management, allows a intruder to create users with privileges for “read and write” operations.
The vulnerability of the network monitoring software PRTG Network Monitor relates to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor to create users with “read-write” privileges, including administrators. This can be achieved by replacing the...
ThinkCMF SQL Injection Vulnerability (CNVD-2019-07958)
ThinkCMF is a Chinese content management framework based on PHP+MYSQL. The listorders function in AdminbaseController.class.php in ThinkCMF X2.2.2 has a SQL injection vulnerability that can be exploited by users with administrator privileges via the listorderskey1 parameter in the Link listorders...
CVE-2018-1941
IBM Campaign 9.1.0 and 9.1.2 could allow a local user to obtain admini privileges due to the application not validating access permissions. IBM X-Force ID: 153382...
Code injection
IBM Campaign 9.1.0 and 9.1.2 could allow a local user to obtain admini privileges due to the application not validating access permissions. IBM X-Force ID: 153382...
CVE-2018-1002002
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit...
CVE-2018-1002007
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. There is an XSS vulnerability in integration-contact-form.html.php:15: via POST request variable htmlid...
CVE-2018-1002004
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit...
CVE-2018-1002002
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit...
