690 matches found
Netgear WGR614v9 - Wireless Router Get Request Denial of Service Vuln
No description provided by source. LUNOSEC ADVISORY Synopsis: Denial of Service condition in Netgear's WGR614v9 Wireless Router Firmware version tested: v1.2.214.0.13NA LATEST Firmware version tested: WNR834Bv2 v2.0.82.0.8 GTADarkDude tested Proof of Concept: Appending a question mark to the...
Ipswitch WhatsUp Professional 2006 Authentication Bypass Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/18019/info Ipswitch WhatsUp Professional 2006 is susceptible to a remote authentication-bypass vulnerability. This issue allows remote attackers to gain administrative access to the web-based administrative interface of t...
Working Resources 1.7.x BadBlue Administrative Interface Arbitrary File Access
No description provided by source. source: http://www.securityfocus.com/bid/5276/info BadBlue is a P2P file sharing application distributed by Working Resources. It is available for Microsoft Windows operating systems. BadBlue does not sufficiently control access to the administrative interface. ...
FloosieTek FTGatePro 1.22 Mail Server Path Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/8527/info FloosieTek FTGatePro Mail Server may disclose its installation path to remote attackers. This information could be useful when mounting further attacks against the system. This issue exists in the web...
FortiGate Firewall 2.x Policy Admin Interface XSS
No description provided by source. source: http://www.securityfocus.com/bid/9033/info Multiple cross-site scripting vulnerabilities have been reported in the FortiGate Firewall web administrative interface. These issues could be exploited by enticing an administrative user to follow a malicious...
Seyeon FlexWATCH Network Video Server 2.2 Unauthorized Administrative Access Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/8942/info It has been reported that FlexWATCH Network Video Server may be prone to an access validation error that may allow a remote attacker to gain administrative access to the system. The problem is reported to presen...
PHPWCMS 1.4.5 r398 Cross Site Request Forgery Vulnerability
No description provided by source. ?php / Exploit Title: PHPWCMS Cross-Site Request Forgery Vulnerability Date: 06/16/2010 Author: Jeremiah Talamantes Software Link: http://phpwcms.googlecode.com/files/phpwcmsr398.zip Version: 1.4.5 r398 Tested on: WinXP SP2 EN on WAMP 2.0 CVE: N/A Jeremiah...
Ruslan Communications <Body>Builder SQL Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/5008/info Ruslan Communications BodyBuilder is a tool designed to assist a user in creating a website. It allows for remote administration through a web interface, and is implemented in Java. Reportedly, user input suppli...
[SECURITY] Stored Cross Site Scripting in Ektron CMS 8.7
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Stored Cross Site Scripting in Ektron CMS 8.7 CVE reference: CVE-2014-2729 Affected platforms: Ektron Web Content Management System Version: 8.7.0 Date: 2013-December-19 Security risk: Medium CVSS - AV:N/AC:L/Au:S/C:P/I:P/A:N Researcher: Joseph Zeng...
Symantec Messaging Gateway Management Console Reflected XSS
SUMMARY Symantecs Messaging Gateway management console is susceptible to a reflected cross-site scripting XSS issue found in one of the administrative interface pages. Successful exploitation could result in potential session hijacking or unauthorized actions directed against the console with the...
CVE-2014-1982
The administrative interface in Allied Telesis AT-RG634A ADSL Broadband router 3.3+, iMG624A firmware 3.5, iMG616LH firmware 2.4, and iMG646BD firmware 3.5 allows remote attackers to gain privileges and execute arbitrary commands via a direct request to cli.html...
Design/Logic Flaw
The administrative interface in Allied Telesis AT-RG634A ADSL Broadband router 3.3+, iMG624A firmware 3.5, iMG616LH firmware 2.4, and iMG646BD firmware 3.5 allows remote attackers to gain privileges and execute arbitrary commands via a direct request to cli.html...
GetSimple CMS 3.3.1 - Persistent Cross Site Scripting Vulnerability
Exploit for php platform in category web applications Exploit Title: etSimple CMS v3.3.1 Persistent Cross Site Scripting Google Dork: N/A Date: 24-03-2014 Exploit Author: Jeroen - IT Nerdbox Vendor Homepage: http://get-simple.info/ Software Link: http://get-simple.info/download/ Version: v3.3.1...
Allied Telesis AT-RG634A ADSL Broadband Router - Unauthenticated Webshell
Exploit for hardware platform in category web applications Title: Allied Telesis AT-RG634A ADSL Broadband router hidden administrative unauthenticated webshell. Vulnerability Information: - CVE: CVE-2014-1982 - Type of Vulnerability: - CWE-78 : OS Command Injection - CWE-306 : Missing...
Getsimple CMS 3.3.1 - Persistent Cross-Site Scripting
Getsimple CMS 3.3.1 - Persistent Cross-Site Scripting Exploit Title: etSimple CMS v3.3.1 Persistent Cross Site Scripting Google Dork: N/A Date: 24-03-2014 Exploit Author: Jeroen - IT Nerdbox Vendor Homepage: http://get-simple.info/ Software Link: http://get-simple.info/download/ Version: v3.3.1...
Getsimple CMS 3.3.1 - Persistent Cross-Site Scripting
Exploit Title: etSimple CMS v3.3.1 Persistent Cross Site Scripting Google Dork: N/A Date: 24-03-2014 Exploit Author: Jeroen - IT Nerdbox Vendor Homepage: http://get-simple.info/ Software Link: http://get-simple.info/download/ Version: v3.3.1 Tested on: N/A CVE : N/A Description: In the...
SQL Injection in doorGets CMS
Advisory ID: HTB23197 Product: doorGets CMS Vendor: doorGets Vulnerable Versions: 5.2 and probably prior Tested Version: 5.2 Advisory Publication: January 15, 2014 without technical details Vendor Notification: January 15, 2014 Vendor Patch: January 15, 2014 Public Disclosure: February 5, 2014...
SQL Injection in doorGets CMS
High-Tech Bridge Security Research Lab discovered vulnerability in doorGets CMS, which can be exploited to perform SQL Injection attacks. 1 SQL Injection in doorGets CMS: CVE-2014-1459 The vulnerability exists due to insufficient validation of "positiondownid" HTTP POST parameter passed to...
Cisco Context Directory Agent Privilege Escalation Vulnerability
A vulnerability in the administrative interface of Cisco Context Directory Agent CDA could allow an authenticated, remote attacker to perform administrative actions. The vulnerability is due to insufficient authorization enforcement. An attacker could exploit this vulnerability by accessing an...
Design/Logic Flaw
The administrative interface in Cisco Context Directory Agent CDA does not properly enforce authorization requirements, which allows remote authenticated users to obtain administrative access by hijacking a session, aka Bug ID CSCuj45347...