CVE-2019-13402

/usr/sbin/default.sh and /usr/apache/htdocs/cgi-bin/admin/hardfactorydefault.cgi on Dynacolor FCM-MB40 v1.2.0.0 devices implement an incomplete factory-reset process. A backdoor can persist because neither system accounts nor the set of services is reset...

Authorization

/usr/sbin/default.sh and /usr/apache/htdocs/cgi-bin/admin/hardfactorydefault.cgi on Dynacolor FCM-MB40 v1.2.0.0 devices implement an incomplete factory-reset process. A backdoor can persist because neither system accounts nor the set of services is reset...

CVE-2019-13402

/usr/sbin/default.sh and /usr/apache/htdocs/cgi-bin/admin/hardfactorydefault.cgi on Dynacolor FCM-MB40 v1.2.0.0 devices implement an incomplete factory-reset process. A backdoor can persist because neither system accounts nor the set of services is reset...

CVE-2019-13402

CVE-2019-13402 affects Dynacolor FCM-MB40 devices (v1.2.0.0). The issue stems from an incomplete factory-reset process implemented by /usr/sbin/default.sh and /usr/apache/htdocs/cgi-bin/admin/hardfactorydefault.cgi, which fails to reset system accounts and the full set of services. This can allow...

Huawei HG530 Cross Site Request Forgery Vulnerability

Exploit for hardware platform in category web applications Multiple CSRF reboot and restore Vulnerability =========================== The Huawei HG530 suffers from multiple CSRF vulnerability allows local attackers to reboot the device or to restore to factory Configuration. ================== Th...

Huawei HG530 Cross Site Request Forgery

Multiple CSRF reboot and restore Vulnerability =========================== The Huawei HG530 suffers from multiple CSRF vulnerability allows local attackers to reboot the device or to restore to factory Configuration. ================== The vulnerability is located in form POST data parameter in...

FortiCam FCM-MB40 Code Execution / Privilege Escalation

Original posting: https://xor.cat/2019/06/19/fortinet-forticam-vulns/ Background In March of 2019 I discovered five vulnerabilities in Fortinet's FortiCam FCM-MB401 product. Part-way through disclosing this vulnerability, I discovered that the FCM-MB40 is manufactured by a company called Dynacolo...

Dutch Auction Factory Component SQL Injection Vulnerability in Joomla!

Joomla! is a U.S. Open Source Matters team using PHP and MySQL development of a set of open source, cross-platform content management system CMS. Dutch Auction Factory is used in one of the auction site to create extensions . A SQL injection vulnerability exists in the Dutch Auction Factory...

Micro Deal Factory SQL Injection Vulnerability in Joomla!

Joomla! is a U.S. Open Source Matters team using PHP and MySQL development of a set of open source, cross-platform content management system CMS. Micro Deal Factory is used in one of the web marketing promotion plug-ins. A SQL injection vulnerability exists in Joomla! The vulnerability stems from...

Auction Factory SQL Injection Vulnerability

Joomla! is a U.S. Open Source Matters team using PHP and MySQL development of a set of open source , cross-platform content management system CMS. Auction Factory is used in one of the auction component . An SQL injection vulnerability exists in Joomla! The vulnerability stems from a lack of...

CVE-2018-17386

SQL Injection exists in the Micro Deal Factory 2.4.0 component for Joomla! via the id parameter, or the PATHINFO to mydeals/ or listdeals/...

CVE-2018-17381

SQL Injection exists in the Dutch Auction Factory 2.0.2 component for Joomla! via the filterorderDir or filterorder parameter...

CVE-2018-17374

SQL Injection exists in the Auction Factory 4.5.5 component for Joomla! via the filterorderDir or filterorder parameter...

CVE-2018-17386

SQL Injection exists in the Micro Deal Factory 2.4.0 component for Joomla! via the id parameter, or the PATHINFO to mydeals/ or listdeals/...

CVE-2018-17381

SQL Injection exists in the Dutch Auction Factory 2.0.2 component for Joomla! via the filterorderDir or filterorder parameter...

CVE-2018-17374

SQL Injection exists in the Auction Factory 4.5.5 component for Joomla! via the filterorderDir or filterorder parameter...

Sql injection

SQL Injection exists in the Micro Deal Factory 2.4.0 component for Joomla! via the id parameter, or the PATHINFO to mydeals/ or listdeals/...

Sql injection

SQL Injection exists in the Auction Factory 4.5.5 component for Joomla! via the filterorderDir or filterorder parameter...

Sql injection

SQL Injection exists in the Dutch Auction Factory 2.0.2 component for Joomla! via the filterorderDir or filterorder parameter...

CVE-2018-17374

SQL Injection exists in the Auction Factory 4.5.5 component for Joomla! via the filterorderDir or filterorder parameter...