TIBCO ActiveSpaces administrative daemon component cross-site request forgery vulnerability

TIBCO ActiveSpaces is a TIBCO solution for in-memory computing, in-memory data grids, and fault-tolerant datastores. administrative daemon tibdgadmind is one of the daemon components. A cross-site request forgery vulnerability exists in the administrative daemon component in TIBCO ActiveSpaces. A...

CVE-2018-7778

In Schneider Electric Evlink Charging Station versions prior to v3.2.0-12v1, the Web Interface has an issue that may allow a remote attacker to gain administrative privileges without properly authenticating remote users...

Micro Focus Secure Messaging Gateway Web administration and quarantine component SQL injection vulnerability

Micro Focus Secure Messaging Gateway SMG is a suite of outbound and inbound protection software for enterprise networks and messaging systems from Micro Focus, UK. The product includes features such as virus protection, anti-spam, anti-DDos attacks, and image analysis.Web administration is one of...

CVE-2018-12464

A SQL injection vulnerability in the web administration and quarantine components of Micro Focus Secure Messaging Gateway allows an unauthenticated remote attacker to execute arbitrary SQL statements against the database. This can be exploited to create an administrative account and used in...

Local File Inclusion vulnerability in Zenphoto

Overview Zenphoto is a content management system CMS. Zenphoto contains a Local File Inclusion vulnerability. ASAI Ken reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact Sensitive information may be obtained or...

PT-2018-1375 · Canon · Canon Lbp3370 +3

Name of the Vulnerable Software and Affected Versions: Canon LBP6650 versions Canon LBP3370 versions Canon LBP3460 versions Canon LBP7750C versions Description: The issue is related to a weakness in the authentication procedure of Canon printer software when using standard device settings. It...

CVE-2018-11018

An issue was discovered in PbootCMS v1.0.7. Cross-site request forgery CSRF vulnerability in apps/admin/controller/system/RoleController.php allows remote attackers to add administrator accounts via admin.php/role/add.html...

CVE-2018-1239

Dell EMC Unity Operating Environment OE versions prior to 4.3.0.1522077968 are affected by multiple OS command injection vulnerabilities. A remote application admin user could potentially exploit the vulnerabilities to execute arbitrary OS commands as system root on the system where Dell EMC Unit...

Interspire Email Marketer Administrative Authentication Bypass

''' Exploit Title: Interspire Email Marketer - Remote Admin Authentication Bypass Google Dork: intitle:"Control Panel" + emailmarketer Date: 4-22-18 Exploit Author: devcoinfet Vendor Homepage: www.interspire.com/emailmarketer Software Link: Can't legally provide link but can be found on net...

Interspire Email Marketer 6.1.6 - Remote Admin Authentication Bypass

Interspire Email Marketer 6.1.6 - Remote Admin Authentication Bypass ''' Exploit Title: Interspire Email Marketer - Remote Admin Authentication Bypass Google Dork: intitle:"Control Panel" + emailmarketer Date: 4-22-18 Exploit Author: devcoinfet Vendor Homepage: www.interspire.com/emailmarketer...

CVE-2017-2871

Insufficient security checks exist in the recovery procedure used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. An attacker who is in the same subnetwork of the camera or has remote administrator access can fully compromise the device by performing a firmware recovery...

CVE-2018-6000

An issue was discovered in AsusWRT before 3.0.0.4.38410007. The dovpnuploadpost function in router/httpd/web.c in vpnupload.cgi provides functionality for setting NVRAM configuration values, which allows attackers to set the admin password and launch an SSH daemon or enable infosvr command mode,...

FiberHome LM53Q1 - Multiple Vulnerabilities

!/usr/bin/python /$$$$$$$$ /$$ /$$ /$$ /$$ /$$$$$$$ /$$ /$$$$$$$$ /$$ /$$ /$$ | $$/|/| $$ | $$ | $$ | $$ $$ | $$ | $$/ | $$ |/ | $$ | $$ /$$| $$$$$$$ /$$$$$$ /$$$$$$ | $$ | $$ /$$$$$$ /$$$$$$/$$$$ /$$$$$$ | $$ \ $$ /$$$$$$ /$$$$$$/$$$$ /$$$$$$ /$$$$$$ /$$$$$$ | $$ /$$ /$$ /$$$$$$ | $$ /$$$$$$ /$$...

PT-2017-15701 · D Link · D-Link Dir-330 +1

Name of the Vulnerable Software and Affected Versions: D-Link DIR-130 version 1.23 D-Link DIR-330 version 1.12 Description: The issue allows a remote attacker to bypass authentication on the remote login page. By manipulating the POST request, an attacker can access administrator-only pages, such...

Security Advisory - Multiple Vulnerabilities in Intel Management Engine Firmware

There are multiple vulnerabilities in Intel Management Engine ME firmware. Some Huawei devices are affected for using related Intel products. Multiple buffer overflows in kernel in Intel Manageability Engine Firmware 11.0/11.5/11.6/11.7/11.10/11.20 allow attacker with local access to the system t...

The vulnerability of the microprogramming software of the iBaby M3S wireless video camera lies in the presence of a pre-installed account, which allows a intruder to gain access to the device with administrator rights.

The vulnerability of the microprogrammed software of the iBaby M3S wireless video camera is related to the presence of a pre-set administrator account “admin”. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to the device with administrator privileges via...

The vulnerability of the microprogramming software of the Siklu EtherHaul radio relay station, related to the use of pre-installed account data, allows a intruder to gain access to the embedded operating system with administrator privileges.

The vulnerability of the microprogramming software of the Siklu EtherHaul radio relay station is related to the use of a pre-installed root account. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain access to the embedded operating system with administrator...

Salutation Responsive WordPress + BuddyPress Theme Cross-Site Scripting Vulnerability

Salutation Responsive WordPress + BuddyPress Theme is a responsive WordPress theme used in WordPress. A cross-site scripting vulnerability exists in Salutation Responsive WordPress+BuddyPress Theme version 3.0.15. A remote attacker can exploit this vulnerability to perform administrator actions...

CVE-2017-5712

Buffer overflow in Active Management Technology AMT in Intel Manageability Engine Firmware 8.x/9.x/10.x/11.0/11.5/11.6/11.7/11.10/11.20 allows attacker with remote Admin access to the system to execute arbitrary code with AMT execution privilege...

Siemens 7KT PAC1200 Data Manager Authentication Bypass Vulnerability

The 7KT PAC1200 data manager 7KT1260 from the SENTRON portfolio is a fully integrated smart meter with a Web interface. An authentication bypass vulnerability exists in the 7KT PAC1200 data manager from the SENTRON portfolio, which could allow a remote attacker to bypass the authentication...