151 matches found
TurboMail 前台sql注入漏洞
简要描述： 前台注入存在注入，可查看管理员密码甚至getshell。 详细说明： 0x1 前台注入 turbomail\web\webapps\ROOT\enterprise\noteadd.jsp: ... UserInfo userinfo = ms.userinfo; if userinfo == null XInfo.gotoInfoms,request,response,"info.loginfail",null,0; return; String id = request.getParameter"id";//id参数传入，没有过滤 Note note = null;...
Pandora FMS < 5.1 SP1 Multiple Vulnerabilities - Active Check
Pandora FMS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:artica:pandorafms"; ifdescripti...
Oracle Password Auditor - Oracle Password Recovery & Auditing Tool
Oracle Password Auditor is the FREE Oracle database password recovery and auditing software. It not only helps you to recover lost or forgotten Oracle database password but also audit Oracle database setup in an corporate environment by discovering the weak password configurations. During auditin...
Security Advisory - Huawei VSM Default User Groups’ Privilege Escalation
VSM Versatile Security Manager is a unified security service management system launched by Huawei for carrier and enterprise customers. VSM contains a vulnerability that default user groups’ privilege could be escalated when one user logs in to the system to modify default user groups’ permission...
HP SiteScope IntegrationViewer Default Credentials Information Disclosure
An information disclosure vulnerability has been reported in HP SiteScope.The vulnerability is due to the usage of a default user name and password as login credentials on a fresh installation of SiteScope. Attackers may exploit this breach to perform administrative operations such as creating ne...
http-joomla-brute NSE Script
Performs brute force password auditing against Joomla web CMS installations. This script initially reads the session cookie and parses the security token to perfom the brute force password auditing. It uses the unpwdb and brute libraries to perform password guessing. Any successful guesses are...
CSRF and XSS vulnerabilities in ADSL modem Callisto 821+
Hello 3APA3A! I want to warn you about security vulnerabilities in ADSL modem Callisto 821+ SI2000 Callisto821+ Router. These are Cross-Site Request Forgery and Cross-Site Scripting vulnerabilities. These attacks should be conducted on modem owner, which is logged into control panel. Taking into...
CA ARCserve D2D r15 - Web Service Servlet Code Execution
CA ARCserve D2D r15 - Web Service Servlet Code Execution Computer Associates ARCserve D2D r15 Web Service Apache Axis2 World Accessible Servlet Code Execution Vulnerability Poc product homepage: https://support.ca.com/phpdocs/0/8363/support/arcserved2dsupport.html vulnerability: The Tomcat Server...
RedHat Piranha Virtual Server Package passwd.php3 Arbitrary Command Execution
$Id: piranhapasswdexec.rb 8497 2010-02-14 20:27:24Z patrickw $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...
Cisco Application Networking Manager Default User Credentials Security Bypass (CVE-2009-0616)
Cisco Application Networking Manager ANM is a network management application that manages Cisco Application Control Engine ACE modules or appliances. The vulnerability is due to a design error in the ANM that does not force credential changes during installation. A remote attacker may exploit thi...
Cisco Security Advisory: Cisco ACE Application Control Engine Device Manager and Application Networking Manager Vulnerabilities
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco ACE Application Control Engine Device Manager and Application Networking Manager Vulnerabilities Advisory ID: cisco-sa-20090225-anm http://www.cisco.com/warp/public/707/cisco-sa-20090225-anm.shtml Revision 1.0 For Public...
CVE-2008-1543
The Advanced User Interface Pages in the ProST Web Management component on the Airspan WiMAX ProST have a certain default User ID and password, which makes it easier for remote attackers to obtain partial administrative access, a different vulnerability than CVE-2008-1262...
CVE-2003-1457
Auerswald COMsuite CTI ControlCenter 3.1 creates a default "runasositron" user account with an easily guessable password, which allows local users or remote attackers to gain access...
XAMPP for Windows <= 1.6.0a mssql_connect() Remote BoF Exploit
Exploit for unknown platform in category remote exploits ============================================================== XAMPP for Windows Connect$POST'host', $POST'user', $POST'password', $POST'database'; echo "DBServer: $POSTdbserver"; $result = $db-Execute"SELECT FROM $POSTtable";...
mAlbum v0.3 admin by default user/pass
mAlbum v0.3 admin by default user/pass By : sn0oPy Risk : high exploit : at http://www.target.ma/malbum/index.php when private images Login : login Password : pass after login, you can creat new admin account, delete it,... Dork : inurl:"malbum/" Default user/pass present here :...
Wordpress <= 2.x dictionnary & Bruteforce attack
Source code !usr/bin/python Flaw found on Wordpress that allow Dictionnary & Bruteforce attack Greetz goes to : NeoMorphS, Tiky Vendor : http://wordpress.org/ Found by : Kad [email protected] / [email protected] import urllib , urllib2, sys, string tab = "sss" string.asciiletters,...
[SA22041] Fi Win WiFi Phone SS28S Debug Console Security Issue
---------------------------------------------------------------------- Want to work within IT-Security? Secunia is expanding its team of highly skilled security experts. We will help with relocation and obtaining a work permit. Currently the following type of positions are available:...
Wavecon Advisory: Open-Xchange <= 0.8.2 defaultuser with /bin/bash and default password
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Advisory Name Open-Xchange defaultuser with /bin/bash Vendor Open-Xchange Inc. Product Open-Xchange Version 0.8.2 Author Cemil Degirmenci Risk high o Description: ======================= The OPEN-XCHANGE Collaboration and Integration Server Environmen...
Sick cats regardless of the home-the spare ADSL cats initiate network attacks-vulnerability warning-the black bar safety net
Some time ago the home installation of a telecommunications broadband, and the use of the gift of the terminal device with a routing function of the cat, and was only allowed dial-up Internet, and later still there every time you dial a lot of trouble, simply do it yourself in the cat configurati...
CVE-2002-1691
Alcatel OmniPCX 4400 installs known user accounts and passwords in the /etc/password file by default, which allows remote attackers to gain unauthorized access...