Dell SonicWALL Scrutinizer 11.0.1 - setUserSkin/deleteTab SQL Injection Remote Code Execution

!/usr/local/bin/python """ Dell SonicWall Scrutinizer Summary: ======== This exploits an pre-auth SQL Injection in the login.php script within an update statement to steal session data. You could also steal login creds which require absolutely no hash cracking since the target uses symmetric...

Gemtek CPE7000 / WLTCS-106 - Multiple Vulnerabilities

!/usr/bin/python ''' Exploit Title: Gemtek CPE7000 / WLTCS-106 multiple vulnerabilities Date: 04/06/2016 Exploit Author: Federico Ramondino - framondino0x40mentat0x2eis Vendor Homepage: gemtek.com.tw Version: Firmware Version 01.01.02.082 Tested on: Product Name : CPE7000 Model ID : WLTCS-106...

Cacti Security Bypass Vulnerability

Cacti is a suite of open source network traffic monitoring and analysis tools from the Cacti Group. A security bypass vulnerability exists in the authlogin.php file in versions of Cacti prior to 0.8.8g, which can be exploited by a remote attacker to bypass established access restrictions by loggi...

CVE-2016-2313

authlogin.php in Cacti before 0.8.8g allows remote authenticated users who use web authentication to bypass intended access restrictions by logging in as a user not in the cacti database...

FruityWifi v2.4 - Wireless Network Auditing Tool

FruityWifi is a wireless network auditing tool. The application can be installed in any Debian based system adding the extra packages. Tested in Debian, Kali Linux, Kali Linux ARM Raspberry Pi, Raspbian Raspberry Pi, Pwnpi Raspberry Pi, Bugtraq. v2.4 Utils have been added replaces "ifconfig -a"...

samba: crash in dcesrv_auth_bind_ack due to missing error check

Multiple flaws were found in Samba's DCE/RPC protocol implementation. A remote, authenticated attacker could use these flaws to cause a denial of service against the Samba server high CPU load or a crash or, possibly, execute arbitrary code with the permissions of the user running Samba root. Thi...

samba: crash in dcesrv_auth_bind_ack due to missing error check

Multiple flaws were found in Samba's DCE/RPC protocol implementation. A remote, authenticated attacker could use these flaws to cause a denial of service against the Samba server high CPU load or a crash or, possibly, execute arbitrary code with the permissions of the user running Samba root. Thi...

Fedora 21 : php-udan11-sql-parser-3.0.4-1.fc21 / phpMyAdmin-4.5.1-1.fc21 (2015-5c06260c4b)

phpMyAdmin 4.5.1.0 2015-10-23 =============================== - Invalid argument supplied for foreach - arraykeyexists expects parameter 2 to be array - Notice Undefined index: dropdatabase - Server variable edition in ANSIQUOTES sqlmode: losing current value - Propose table structure broken -...

OracleVM 3.2 : openssh (OVMSA-2016-0030)

The remote OracleVM system is missing necessary patches to address critical security updates : - change default value of MaxStartups - CVE-2010-5107 John Haxby - improve RNG seeding from /dev/random 681291,708056 - make ssh1's ConnectTimeout option apply to both the TCP connection and SSH banner...

CVE-2016-0948

CVE-2016-0948 is an Adobe Connect CSRF vulnerability affecting Adobe Connect prior to 9.5.2. It allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. The documented remediation is Adobe’s APSB16-07 security update, which addresses input validation/conten...

ProjectSend r582 - Multiple Vulnerabilities

ProjectSend r582 - Multiple Vulnerabilities Advisory ID: SGMA-16001 Title: ProjectSend multiple vulnerabilities Product: ProjectSend previously cFTP Version: r582 and probably prior Vendor: www.projectsend.org Vulnerability type: SQL-injection, Auth bypass, Arbitrary File Access, Insecure Object...

Authentication Bypass

Overview Versions of hapi-auth-jwt2 prior to version 5.1.2 are affected by a complete authentication bypass vulnerability when in the try authentication mode. Recommendation Update to version 5.1.2 or later. References - Issue 111 - PR 112 - GitHub Advisory...

Classic Infomedia Authentication Bypass

Document Title: =============== Classic Infomedia Login - Auth Bypass Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1679 Release Date: ============= 2016-01-25 Vulnerability Laboratory ID VL-ID: ==================================== 16...

CVE-2015-7706

Multiple cross-site scripting XSS vulnerabilities in Secure Data Space SDS-API before 3.5.7 allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO to api/v3/public/shares/downloads/, the 2 authType parameter to api/v3/auth/login, or the 3 login parameter to...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Secure Data Space SDS-API before 3.5.7 allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO to api/v3/public/shares/downloads/, the 2 authType parameter to api/v3/auth/login, or the 3 login parameter to...

imap-ntlm-info NSE Script

This script enumerates information from remote IMAP services with NTLM authentication enabled. Sending an IMAP NTLM authentication request with null credentials will cause the remote service to respond with a NTLMSSP message disclosing information to include NetBIOS, DNS, and OS build version...

XRace Pro 1.0 SQL Injection

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 + Site : http://0day.today 0 1 + Support e-mail :...

Dahua DVR Auth Bypass Scanner

Scans for Dahua-based DVRs and then grabs settings. Optionally resets a user's password and clears the device logs This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule %qDahua DVR Auth Bypass Scanner...

Immunity Canvas: VBULLETIN_PREAUTH_DECODEARGUMENTS

Name| vbulletinpreauthdecodeArguments ---|--- CVE| CVE-2015-7808 Exploit Pack| CANVAS Description| vBulletin pre-auth remote code execution Notes| CVE Name: CVE-2015-7808 VENDOR: vBulletin Solutions NOTES: Tested on Ubuntu 14.04 against: - vBulletin 5.1.4 - vBulletin 5.0.4 Repeatability: Infinite...

curl security, bug fix, and enhancement update

7.29.0-25.0.1 - disable check to make build pass 7.29.0-25 - fix spurious failure of test 1500 on ppc64le 1218272 7.29.0-24 - use the default min/max TLS version provided by NSS 1170339 - improve handling of timeouts and blocking direction to speed up FTP 1218272 7.29.0-23 - require credentials t...