ManageEngine EventLog Analyzer - Multiple Vulnerabilities (2)

ManageEngine EventLog Analyzer - Multiple Vulnerabilities 2 Multiple vulnerabilities in ManageEngine EventLog Analyzer Discovered by Pedro Ribeiro [email protected], Agile Information Security ========================================================================== Disclosure: 05/11/2014 / Last...

BMC Track-It! - Multiple Vulnerabilities

No description provided by source. Multiple critical vulnerabilities in BMC Track-It! Discovered by Pedro Ribeiro [email protected], Agile Information Security ================================================================================= The application exposes several .NET remoting services o...

(0Day) F5 Data Manager discoverFilerBasicInfo.jsft filerName SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of F5 Data Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the discoverFilerBasicInfo.jsft page. An attacker is able to inject SQL through the...

Netgear WNR1000v3 - Password Recovery Credential Disclosure (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework Exploit Title: Netgear WNR1000v3 Password Recovery Credential Disclosure Vulnerability Date: 7-5-14 Exploit Author: c1ph04 Vendor Homepage: http://www.netgear.com/ Version...

Conceptronic Grab’n’Go and Sitecom Storage Center Password Disclosure

No description provided by source. Updated to include Sitecom MD-253 and MD254 Minor textual changes == Conceptronic Grab’n’Go and Sitecom Storage Center - Password disclosure Vulnerability - Security Advisory AA-002 Severity Rating: High Discovery Date: May 5, 2012 Vendor Notification: May 31,...

代码审计系列8: 蝉知企业门户2.4正式版 猥琐获取管理员账户密码

简要描述： 青岛息壤网络信息有限公司成立于2013年，由禅道软件公司青岛易软天创全资投资创办，位于美丽的青岛开发区，团队成员拥有丰富的网站设计、系统研发、服务器维护和SEO经验。我们正在打造一款开源免费的企业门户系统，以帮助企业建立品牌网站，进行宣传推广、市场营销、产品销售和客户跟踪。息壤，为天下企业提供专业的营销工具！ 详细说明： 蝉知企业门户系统在安装完成后会在 \system\tmp\log\ 下生成类似 的两个文件. 我们打开 sql.20140701.log 内容如下： 20140701 13:28:01: /install.php 20140701 13:28:04:...

WHMCS 4.x (invoicefunctions.php, id param) - SQL Injection Vulnerability

No description provided by source. Title: WHMCS 4.x SQL Injection Vulnerability Google Dork: intext:Powered by WHMCompleteSolution OR inurl:submitticket.php?? Author: Ahmed Aboul-Ela Contact: Ahmed.Aboul3laatgmaildotcom Date: 14/5/2013 Vendor: http://www.whmcs.com Version: 4.5.2 and perior versio...

Zix Forum <= 1.12 (layid) SQL Injection Vulnerability

No description provided by source. Zix Forum = 1.12 layid SQL Injection Vulnerability Vulnerability: -------------------- SQLInjection: Input passed to the layid parameter in 'settings.asp' not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by...

GSC Client 1.00 2067 - Privilege Escalation Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/29718/info GSC Client is prone to a privilege-escalation vulnerability because it fails to sufficiently validate administrator credentials. An attacker can exploit this vulnerability to perform unauthorized administrative...

Microsoft Workstation Service NetpManageIPCConnect Overflow

No description provided by source. $Id: ms06070wkssvc.rb 10554 2010-10-05 19:29:10Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of...

http-vuln-wnr1000-creds NSE Script

A vulnerability has been discovered in WNR 1000 series that allows an attacker to retrieve administrator credentials with the router interface. Tested On Firmware Versions: V1.0.2.6060.0.86 Latest and V1.0.2.5460.0.82NA Vulnerability discovered by c1ph04. Script Arguments...

CVE-2014-2719

AdvancedSystemContent.asp in the ASUS RT series routers with firmware before 3.0.0.4.374.5517, when an administrator session is active, allows remote authenticated users to obtain the administrator user name and password by reading the source code...

Command injection

Citrix VDI-in-a-Box 5.3.x before 5.3.6 and 5.4.x before 5.4.3 allows local users to obtain administrator credentials by reading the log...

GSC Client 1.00 2067 - Privilege Escalation Vulnerability

Exploit for multiple platform in category remote exploits source: http://www.securityfocus.com/bid/29718/info GSC Client is prone to a privilege-escalation vulnerability because it fails to sufficiently validate administrator credentials. An attacker can exploit this vulnerability to perform...

CVE-2013-5668

The ADS/NT Support page on the Thecus NAS server N8800 with firmware 5.03.01 allows remote attackers to discover the administrator credentials by reading this page's cleartext content...

Code injection

The ADS/NT Support page on the Thecus NAS server N8800 with firmware 5.03.01 allows remote attackers to discover the administrator credentials by reading this page's cleartext content...

CVE-2013-4775

NETGEAR ProSafe GS724Tv3 and GS716Tv2 with firmware 5.4.1.13 and earlier; GS748Tv4 with firmware 5.4.1.14; GS510TP with firmware 5.4.0.6; GS752TPS, GS728TPS, GS728TS, and GS725TS with firmware 5.3.0.17; and GS752TXS and GS728TXS with firmware 6.1.0.12 allows remote attackers to read encrypted...

MOXA EDR-G903 Series Multiple Vulnerabilities

OVERVIEW This advisory provides mitigation details for vulnerabilities that impact Moxa EDR-G903 Series Routers. Independent researcher Neil Smith identified a hard-coded user account vulnerability and an insufficient entropy vulnerability in Moxa’s EDR-G903 series routers. By impersonating the...

Hewlett-Packard Intelligent Management Center CommonUtils Static DES/ECB Decryption Key Vulnerability

This vulnerability allows remote attackers to obtain sensitive information on vulnerable installations of Hewlett-Packard Intelligent Management Center. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CommonUtil class. This application uses a stat...

Multiple NetGear ProSafe Switches Information Disclosure Vulnerability

Multiple NetGear ProSafe switches are prone to an information- disclosure vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if...