Indio Networks Unibox SMB Cross-Site Request Forgery Vulnerability

Indio Networks Unibox SMB and others are a wireless Wi-Fi from Indio Networks India. A cross-site request forgery vulnerability exists in Unibox SMB version 2.4 and UniBox Enterprise Series version 2.4 and UniBox Campus Series version 2.4, which stems from a cross-site request forgery CSRF...

iDS6 DSSPro Digital Signage System 6.2 Privilege Escalation

iDS6 DSSPro Digital Signage System 6.2 Improper Access Control Privilege Escalation Vendor: Guangzhou Yeroo Tech Co., Ltd. Product web page: http://www.yerootech.com Affected version: V6.2 B2014.12.12.1220 V5.6 B2017.07.12.1757 V4.3 Summary: iDS6 Software's DSSPro network digital signage manageme...

Serpico Cross-Site Scripting Vulnerability (CNVD-2020-03856)

Serpico is a penetration test report generation and collaboration tool. A cross-site scripting vulnerability exists in Serpico version 1.3.0 in admin/listuser, which stems from the lack of proper validation of client-side data by the WEB application and can be exploited by an attacker to execute...

PT-2020-10263

Name of the Vulnerable Software and Affected Versions Serpico version 1.3.0 Description An issue was discovered that allows stored XSS via the type parameter in the User Type on the "admin/list user" page. Recommendations For Serpico version 1.3.0, consider restricting access to the "admin/list...

PT-2020-10262

Name of the Vulnerable Software and Affected Versions Serpico version 1.3.0 Description An issue was discovered in Serpico, allowing stored XSS via the auth type parameter in the admin/list user endpoint. Recommendations For Serpico version 1.3.0, consider restricting access to the admin/list use...

ASUS SmartHome Access Control Error Vulnerability

ASUS SmartHome is a smart home control and management application from Asus Taiwan, China. A security vulnerability exists in ASUS SmartHome 3.0.42190515 and later Android and 2.0.22 and earlier iOS. The vulnerability can be exploited by an attacker with the http://target/smarthome/devicecontrol...

CVE-2019-12791

A directory traversal vulnerability in the v-list-user script in Vesta Control Panel 0.9.8-24 allows remote attackers to escalate from regular registered users to root via the password reset form...

CVE-2019-12791: Improper Limitation of a Pathname to a Restricted Directory

A directory traversal vulnerability in the v-list-user script in Vesta Control Panel 0.9.8-24 allows remote attackers to escalate from regular registered users to root via the password reset form...

PT-2019-12945

Name of the Vulnerable Software and Affected Versions Vesta Control Panel version 0.9.8-24 Description A directory traversal issue in the v-list-user script allows remote attackers to escalate privileges from regular registered users to root via the password reset form. Recommendations For Vesta...

CVE-2018-18449

EmpireCMS 7.5 allows CSRF for adding a user account via an enews=AddUser action to e/admin/user/ListUser.php, a similar issue to CVE-2018-16339...

CVE-2018-1002008

There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. There is an XSS vulnerability in list-user.html.php:4: via GET request offset variable...

K-Shell by kikicoco VHS version 1.2 edition (.aspx)

Данная утилита предназначенна для системных администраторов для удаленного управления своим сервером. Любое незаконное использование скрипта преследуется по закону. last update: 06.05.2013 21:20 Что может: Wso-style Server IP Client IP HostName Username OS Version IIS Version System Dir...

CVE-2013-3057

Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote authenticated users to bypass intended privilege requirements and list the privileges of arbitrary users via unspecified vectors...

CVE-2009-1825: Improper Authentication

modules/admuser.php in myColex 1.4.2 does not require administrative authentication, which allows remote authenticated users to list user accounts via a Find action...

CVE-2009-1826: Improper Authentication

modules/admuser.php in myGesuad 0.9.14 aka 0.9 does not require administrative authentication, which allows remote authenticated users to list user accounts via a Find action...

OpenJDK allows to list files within the user home directory (6484091)

Unspecified vulnerability in Java Runtime Environment JRE for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.218 and earlier allows untrusted applications and applets to list the contents of the operating user's directory via unknown vectors...

CVE-2008-3717: Undefined Security Weakness

Harmoni before 1.6.0 does not require administrative privileges to list 1 user names or 2 asset ids, which allows remote attackers to obtain sensitive information...

sharecms-sql.txt

============================================================== ShareCMS 0.1 Multiple Remote SQL Injection Vulnerabilities ============================================================== ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Underground Hacking Team...