CVE-2016-2561

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 4.4.x before 4.4.15.5 and 4.5.x before 4.5.5.1 allow remote authenticated users to inject arbitrary web script or HTML via 1 normalization.php or 2 js/normalization.js in the database normalization page, 3...

perfact::mpa Persistent Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2015-066 Product: perfact::mpa Manufacturer: PerFact Innovation GmbH & Co. KG Affected Versions: Custom versions using PerFact DBUtils Toolkit v3.2 Tested Versions: Custom version with PerFact DBUtils Toolkit v3.2 Vulnerability Typ...

phpmyadmin -- multiple XSS and a man-in-the-middle vulnerability

The phpMyAdmin development team reports: XSS vulnerability in SQL parser. Using a crafted SQL query, it is possible to trigger an XSS attack through the SQL query page. We consider this vulnerability to be non-critical. Multiple XSS vulnerabilities. By sending a specially crafted URL as part of t...

central-care.org.ng XSS vulnerability

Vulnerable URL: http://central-care.org.ng/acornaid/user/index.php?p=p.kbssearch=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 554249...

Siemens SIMATIC S7-1500 Denial of Service Vulnerability (CNVD-2016-00931)

The Siemens SIMATIC S7-1500 is a controller family with a modular structure. A denial of service vulnerability exists in Siemens SIMATIC S7-1500 versions prior to 1.8.3 when processing specially crafted TCP packets. An attacker can exploit the vulnerability to cause the CPU to automatically reboo...

The vulnerability of the centralized device management system of Cisco Unified Computing System Central and the Cisco Firepower Extensible Operating System allows a perpetrator to execute arbitrary commands.

The vulnerability of the CGI script of the Cisco Unified Computing System Central device management system and the Cisco Firepower Extensible Operating System exists due to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this...

Log2Space Central 6.2 Cross Site Scripting

FULL DISCLOSURE Product : Log2Space Central Exploit Author : Rahul Pratap Singh Version : 6.2 Home page Link : http://www.spacecom.co.in/log2spacecentralserveroverview.html Website : 0x62626262.wordpress.com Linkedin : https://in.linkedin.com/in/rahulpratapsingh94 Date : 27/Jan/2016 XSS...

marca.com XSS vulnerability

Vulnerable URL: http://www.marca.com/deporte/central-de-datos/baloncesto/euroliga/2009-2010alert/XSSPOSED/...

moxa OnCell Central Manager 弱口令

No description provided by source...

Pacom RTU/1000 CCU/EMCS Encryption Weak Password Vulnerability

The Pacom 1000 CCU and RTU are both products of the Swedish company Pacom. The former is a set of network security panels for controlling, monitoring and maintaining remote sites and the latter is a set of security panels for controlling access control alarm systems. A security vulnerability exis...

CVE-2015-6481

The login function in the RequestController class in Moxa OnCell Central Manager before 2.2 has a hardcoded root password, which allows remote attackers to obtain administrative access via a login session...

CVE-2015-6480

The MessageBrokerServlet servlet in Moxa OnCell Central Manager before 2.2 does not require authentication, which allows remote attackers to obtain administrative access via a command, as demonstrated by the addUserAndGroup action...

Authentication flaw

The MessageBrokerServlet servlet in Moxa OnCell Central Manager before 2.2 does not require authentication, which allows remote attackers to obtain administrative access via a command, as demonstrated by the addUserAndGroup action...

Hardcoded credentials

The login function in the RequestController class in Moxa OnCell Central Manager before 2.2 has a hardcoded root password, which allows remote attackers to obtain administrative access via a login session...

CVE-2015-6480

The CVE-2015-6480 entry concerns Moxa OnCell Central Manager (pre-2.2). The vulnerable component is the MessageBrokerServlet, which does not require authentication, enabling remote attackers to gain administrative access by issuing commands such as addUserAndGroup. This authentication bypass is t...

CVE-2015-6481

CVE-2015-6481 affects Moxa OnCell Central Manager Software prior to version 2.2. The vulnerability arises from a hard-coded root credential in the RequestController.login function, enabling remote attackers to obtain administrative access and potentially execute code on affected systems. NVD and ...

CVE-2015-6480

The MessageBrokerServlet servlet in Moxa OnCell Central Manager before 2.2 does not require authentication, which allows remote attackers to obtain administrative access via a command, as demonstrated by the addUserAndGroup action...

CVE-2015-6481

The login function in the RequestController class in Moxa OnCell Central Manager before 2.2 has a hardcoded root password, which allows remote attackers to obtain administrative access via a login session...

ManageEngine Desktop Central 9.0.0 FileUploadServlet File Upload

File upload vulnerability in ManageEngine Desktop Central FileUploadServlet connectionId Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

ManageEngine Desktop Central 9 FileUploadServlet ConnectionId Exploit

This Metasploit module exploits a vulnerability found in ManageEngine Desktop Central 9. When uploading a 7z file, the FileUploadServlet class does not check the user-controlled ConnectionId parameter in the FileUploadServlet class. This allows a remote attacker to inject a null bye at the end of...