4689 matches found
WordPress Plugin PWGRandom Has Multiple Cross-Site Request Forgery Vulnerabilities
WordPress is a blogging platform developed using the PHP language that allows users to set up their own weblogs on servers that support PHP and MySQL databases.PWGRandom plugin is a plugin that supports the random display of images from the PhpWebGallery. The WordPress plugin PWGRandom suffers fr...
wordpress 3.0-3.92 adding administrator Payload-vulnerability warning-the black bar safety net
var a = location. href. split'/'; var xurl = location. href. replaceaa. length-1,"user-new.php"; jQuery. ajax url: xurl, type: 'GET', dataType: 'html', data: , . donefunctiondata var temp = jQuerydata; var Xtoken = ""; temp. find'inputwpnoncecreate-user'. eachfunctioni,o var o=jQueryo; Xtoken=o...
RomPager Authentication Security Bypass - Misfortune Cookie (CVE-2014-9222)
An authentication bypass vulnerability exists in RomPager Server. The vulnerability is due to an insecure design in the RomPager Server. Remote attacker could exploit this vulnerability to access the RomPager web-server under administrator privileges...
ManageEngine Password Manager SQLAdvancedALSearchResult.cc Pro SQL Injection
ManageEngine Password Manager Pro PMP has an authenticated blind SQL injection vulnerability in SQLAdvancedALSearchResult.cc that can be abused to escalate privileges and obtain Super Administrator access. A Super Administrator can then use his privileges to dump the whole password database in CS...
CVE-2014-5246
The Shenzhen Tenda Technology Tenda A5s router with firmware 3.02.05CN allows remote attackers to bypass authentication and gain administrator access by setting the admin:language cookie to zh-cn...
Authentication flaw
The Shenzhen Tenda Technology Tenda A5s router with firmware 3.02.05CN allows remote attackers to bypass authentication and gain administrator access by setting the admin:language cookie to zh-cn...
CVE-2014-5246: Undefined Security Weakness
The Shenzhen Tenda Technology Tenda A5s router with firmware 3.02.05CN allows remote attackers to bypass authentication and gain administrator access by setting the admin:language cookie to zh-cn...
PT-2014-6362
Name of the Vulnerable Software and Affected Versions Tenda A5s router version 3.02.05 CN Description The issue allows remote attackers to bypass authentication and gain administrator access. This is achieved by setting the admin:language cookie to zh-cn, allowing unauthorized access to the...
Akiva WebBoard 8.x SQL Injection Vulnerability
No description provided by source. Exploit Title: Akiva Webboard 8.x SQL Injection + Plaintext Passwords in Profiles. Google Dork: /Powered by WebBoard 8/ Date: 30.12.2011 Author: Alexander Fuchs Software Link: http://www.akiva.com/default.asp?l=1&id=8 Version: 8.x Tested on: Windows, Linux. CVE ...
webERP 3.11.4 - Multiple Vulnerabilities
No description provided by source. Title: webERP Multiple Vulnerabilities Author: ADEO Security Published: 30/06/2010 Version: 3.11.4 Possible all versions Vendor: http://www.weberp.org Description: webERP is a complete web based accounting/ERP system that requires only a web-browser and pdf read...
WikiWebHelp 0.3.3 - Cross-Site Request Forgery Vulnerability
No description provided by source. Blog: yoyahack.blogspot.com Site: foro.undersecurity.net Mail: [email protected] CMS: WikiWebHelp The entire system is vulnerable to CSRF Cross-site request forgery since this does not include a system to prevent CSRF attacks ... Example Change the...
Friendly Technologies TR-069 ACS 2.8.9 Login SQL Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/38634/info Friendly Technologies TR-069 ACS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an...
No-CMS 0.6.6 rev 1 - Admin Account Hijacking / RCE Exploit via Static Encryption Key
No description provided by source. ?php / Static encryptionkey of No-CMS lead to Session Array Injection in order to hijack administrator account then you will be able for upload php files to server via theme/module upload. This exploit generates cookie for administrator access from non-privilege...
Blue Coat Reporter 7.0/7.1 - Remote Privilege Escalation Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/13723/info Blue Coat Reporter is prone to a remote privilege escalation vulnerability. This issue is due to a failure in the application to properly authenticate a user prior to permitting access to administrator function...
best software saleslogix 2000.0 - Multiple Vulnerabilities
No description provided by source. source: http://www.securityfocus.com/bid/11450/info Best Software SalesLogix is affected by multiple vulnerabilities. These issues are due to design errors that reveal sensitive information, access control validation issues that allow unauthorized access and inp...
Alpha Networks ADSL2/2+ Wireless Router ASL-26555 Password Disclosure
No description provided by source. - Title: Alpha Networks ADSL2/2+ Wireless Router ASL-26555 Remote Administration Password Disclosure - Author: Alberto Ortega @a0rtega [email protected] - Version: Tested on firmware version v2.0.0.30BES. Laboratory subject:...
PHPYUN cloud talent system background CSRF Getshell-a vulnerability warning-the black bar safety net
phpyun background no authentication token, by the CSRF directly getshell First, from the background getshell start. The web site's configuration file,/plus/config.php using double quotes to do the key value, which leads to security issues. We can put php code to write into the double quotes insid...
No-CMS 0.6.6 rev 1 - Admin Account Hijacking / RCE Exploit via Static Encryption Key
Exploit for php platform in category web applications ?php / Static encryptionkey of No-CMS lead to Session Array Injection in order to hijack administrator account then you will be able for upload php files to server via theme/module upload. This exploit generates cookie for administrator access...
Asus RT Password Disclosure Vulnerability
ASUS RT series of routers disclose administrative credentials. This is true for the RT-AC68U, RT-AC68U, RT-AC66R, RT-AC66U, RT-AC56R, RT-AC56U, RT-N66R, RT-N66U, RT-N56R, RT-N56U models. In mid February, I wrote that a substantial portion of ASUS wireless routers would fail to update their...
Dell SonicWall EMail Security Appliance Multiple HTML Injection Vulnerabilities
Multiple cross-site scripting XSS vulnerabilities in Dell SonicWALL Email Security 7.4.5 and earlier allow remote authenticated administrators to inject arbitrary web script or HTML via 1 the uploadPatch parameter to the System/Advanced page settingsadvanced.html or 2 the uploadLicenses parameter...