870 matches found
CVE-2020-7255
Privilege escalation vulnerability in the administrative user interface in McAfee Endpoint Security ENS for Windows prior to 10.7.0 February 2020 Update allows local users to gain elevated privileges via ENS not checking user permissions when editing configuration in the ENS client interface...
CVE-2020-9544
An issue was discovered on D-Link DSL-2640B E1 EU1.01 devices. The administrative interface doesn't perform authentication checks for a firmware-update POST request. Any attacker that can access the administrative interface can install firmware of their choice...
CVE-2020-9544
An issue was discovered on D-Link DSL-2640B E1 EU1.01 devices. The administrative interface doesn't perform authentication checks for a firmware-update POST request. Any attacker that can access the administrative interface can install firmware of their choice...
PT-2020-20725
Name of the Vulnerable Software and Affected Versions D-Link DSL-2640B E1 EU 1.01 Description An issue was discovered where the administrative interface does not perform authentication checks for a firmware-update POST request. This allows any attacker with access to the administrative interface ...
HackerOne: 404-response contains debug-information with all headers
Summary: When requesting a page that does not exist under www.hackerone.com the page returns a hidden HTML-element debugData that reflects all headers in the GET-request, including http-only cookies. Description: This in itself is not a serious vulnerablity, but as the program description mention...
Unraid 6.8.0 Auth Bypass PHP Code Execution
This module exploits two vulnerabilities affecting Unraid 6.8.0. An authentication bypass is used to gain access to the administrative interface, and an insecure use of the extract PHP function can be abused for arbitrary code execution as root. Module Options msf use...
CVE-2012-2593
Cross-site scripting XSS vulnerability in the administrative interface in Atmail Webmail Server 6.4 allows remote attackers to inject arbitrary web script or HTML via the Date field of an email...
Cross site scripting
Cross-site scripting XSS vulnerability in the administrative interface in Atmail Webmail Server 6.4 allows remote attackers to inject arbitrary web script or HTML via the Date field of an email...
CVE-2012-2593: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the administrative interface in Atmail Webmail Server 6.4 allows remote attackers to inject arbitrary web script or HTML via the Date field of an email...
PT-2020-7206
Name of the Vulnerable Software and Affected Versions Atmail Webmail Server version 6.4 Description The issue is related to a cross-site scripting XSS vulnerability in the administrative interface. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the Date fiel...
Wago PFC200 - Authenticated Remote Code Execution (Metasploit)
Wago PFC200 - Authenticated Remote Code Execution Metasploit Exploit Title: Wago PFC200 - Authenticated Remote Code Execution Metasploit Date: 2020-02-05 Exploit Author: Nico Jansen 0x483d Vendor Homepage: https://www.wago.com/ Version: 'Wago PFC200 authenticated remote code execution',...
CVE-2019-15806
CommScope ARRIS TR4400 devices with firmware through A1.00.004-180301 are vulnerable to an authentication bypass to the administrative interface because they include the current base64 encoded password within http://192.168.1.1/basicsett.html. Any user connected to the Wi-Fi can exploit this...
CVE-2019-15805
CommScope ARRIS TR4400 devices with firmware through A1.00.004-180301 are vulnerable to an authentication bypass to the administrative interface because they include the current base64 encoded password within http://192.168.1.1/login.html. Any user connected to the Wi-Fi can exploit this...
Authentication flaw
CommScope ARRIS TR4400 devices with firmware through A1.00.004-180301 are vulnerable to an authentication bypass to the administrative interface because they include the current base64 encoded password within http://192.168.1.1/login.html. Any user connected to the Wi-Fi can exploit this...
Authentication flaw
CommScope ARRIS TR4400 devices with firmware through A1.00.004-180301 are vulnerable to an authentication bypass to the administrative interface because they include the current base64 encoded password within http://192.168.1.1/basicsett.html. Any user connected to the Wi-Fi can exploit this...
CVE-2019-15805
CommScope ARRIS TR4400 devices with firmware through A1.00.004-180301 are vulnerable to an authentication bypass to the administrative interface because they include the current base64 encoded password within http://192.168.1.1/login.html. Any user connected to the Wi-Fi can exploit this...
CVE-2019-15806
CommScope ARRIS TR4400 devices with firmware through A1.00.004-180301 are vulnerable to an authentication bypass to the administrative interface because they include the current base64 encoded password within http://192.168.1.1/basicsett.html. Any user connected to the Wi-Fi can exploit this...
CVE-2019-15805: Inadequate Encryption Strength
CommScope ARRIS TR4400 devices with firmware through A1.00.004-180301 are vulnerable to an authentication bypass to the administrative interface because they include the current base64 encoded password within http://192.168.1.1/login.html. Any user connected to the Wi-Fi can exploit this...
PT-2019-14398
Name of the Vulnerable Software and Affected Versions CommScope ARRIS TR4400 devices with firmware through A1.00.004-180301 Description The issue concerns an authentication bypass to the administrative interface. It is possible because the current base64 encoded password is included within the...
CVE-2019-15806: Inadequate Encryption Strength
CommScope ARRIS TR4400 devices with firmware through A1.00.004-180301 are vulnerable to an authentication bypass to the administrative interface because they include the current base64 encoded password within http://192.168.1.1/basicsett.html. Any user connected to the Wi-Fi can exploit this...