Change CMS 3.6.8 - Multiple CSRF Vulnerabilities

No description provided by source. Exploit Title: RBS Change Complet Open Source multiple CSRF vulnerabilities POST and GET Date: 10/10/2014 Exploit Author: KrustyHack Vendor Homepage: http://www.rbschange.fr/ Software Link:...

WordPress Web Dorado Spider Video Player XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wordpress:wordpress"; ifdescription...

WordPress Multi View Event Calendar SQL Injection Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wordpress:wordpress"; ifdescription...

TomatoCart SQL Injection and Cross Site Scripting Vulnerabilities

TomatoCart is prone to sql-injection and cross-site scripting. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

HttpFileServer code execution

Code execution via GET request...

Change CMS 3.6.8 - Multiple Cross-Site Request Forgery Vulnerabilities

Exploit Title: RBS Change Complet Open Source multiple CSRF vulnerabilities POST and GET Date: 10/10/2014 Exploit Author: KrustyHack Vendor Homepage: http://www.rbschange.fr/ Software Link: http://www.rbschange.fr/addons/distributions/RBS-Change-complet-Open-Source,67203.html Version: 3.6.8 Teste...

Huawei E5332 vulnerable to denial-of-service (DoS)

Overview Huawei E5332 contains a denial-of-service DoS vulnerability. Huawei E5332 provided by Huawei Technologies is a mobile router. Huawei E5332 contains an issue when processing a GET request that contains an extremely long parameter, which lead to the device rebooting. Shuto Imai of Chukyo...

Twiki Perl 4.x, 5.x, 6.x Upload Bypass / Code Execution Vulnerabilities

The debugenableplugins request parameter in Twiki versions 4.x, 5.x, and 6.0.0 allows arbitrary Perl code execution and suffer from a file upload bypass vulnerability. This is an advisory for TWiki administrators: The debugenableplugins request parameter allows arbitrary Perl code execution...

JVN#63587560: Huawei E5332 vulnerable to denial-of-service (DoS)

Huawei E5332 provided by Huawei Technologies is a mobile router. Huawei E5332 contains an issue when processing a GET request that contains an extremely long parameter, which lead to the device rebooting. Impact An attacker that can send requests to the device may cause the device to become...

twiki -- remote Perl code execution

TWiki developers report: The debugenableplugins request parameter allows arbitrary Perl code execution. Using an HTTP GET request towards a TWiki server, add a specially crafted debugenableplugins request parameter to TWiki's view script typically port 80/TCP. Prior authentication may or may not ...

CVE-2014-4728

The web server in the TP-LINK N750 Wireless Dual Band Gigabit Router TL-WDR4300 with firmware before 140916 allows remote attackers to cause a denial of service crash via a long header in a GET request...

Cross site request forgery (csrf)

The web server in the TP-LINK N750 Wireless Dual Band Gigabit Router TL-WDR4300 with firmware before 140916 allows remote attackers to cause a denial of service crash via a long header in a GET request...

SENKAS Kolibri Webserver GET Request Buffer Overflow (CVE-2014-4158)

A stack buffer overflow vulnerability has been reported in SENKAS Kolibri Webserver 2.0. The vulnerability is due to a boundary error when handling GET request. A remote unauthenticated attacker can exploit the service by sending a crafted GET request to the target service...

WWW File Share Pro v7.0 - Denial of Service Vulnerability

Document Title: =============== WWW File Share Pro v7.0 - Denial of Service Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1310 Video: http://www.vulnerability-lab.com/getcontent.php?id=1309 http://cwe.mitre.org/data/definitions/121.html...

BF and XSS vulnerabilities in Zyxel P660RT2 EE

Hello 3APA3A! These are Brute Force and Cross-Site Scripting vulnerabilities in Zyxel P660RT2 EE ADSL Router. ------------------------- Affected products: ------------------------- Vulnerable is the next model: Zyxel P660RT2 EE. ZyNOS Firmware Version: V3.40 AXN.1. This model with other firmware...

ArticleFR CMS 'id' Parameter SQL Injection Vulnerability

ArticleFR CMS is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ManageEngine Desktop Central / Password Manager LinkViewFetchServlet.dat SQL Injection

This module exploits an unauthenticated blind SQL injection in LinkViewFetchServlet, which is exposed in ManageEngine Desktop Central v7 build 70200 to v9 build 90033 and Password Manager Pro v6 build 6500 to v7 build 7002 including the MSP versions. The SQL injection can be used to achieve remot...

ManageEngine Password Manager MetadataServlet.dat SQL Injection Exploit

This Metasploit module exploits an unauthenticated blind SQL injection in LinkViewFetchServlet, which is exposed in ManageEngine Desktop Central v7 build 70200 to v9 build 90033 and Password Manager Pro v6 build 6500 to v7 build 7002 including the MSP versions. The SQL injection can be used to...

WordPress Slider Revolution Arbitrary File Download Vulnerability

WordPress Slider Revolution is prone to an arbitrary file download vulnerability SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

ManageEngine Desktop Central / Password Manager Pro / IT360 SQL Injection

ManageEngine Desktop Central, Password Manager Pro, and IT360 suffer from remote blind SQL injection vulnerabilities. Metasploit module included. TL;DR CVE-2014-3996 / CVE-2014-3997 Blind SQL injection in ManageEngine Desktop Central, Password Manager Pro and IT360 including MSP versions Scroll t...