Backdoor Vulnerability in Juniper Networks ScreenOS (CNVD-2015-08307)

ScreenOS is an operating system developed by Juniper Networks that runs on the NetScreen family of firewall products. An unauthorized access vulnerability exists in Juniper Networks ScreenOS, which can be exploited by an attacker to remotely gain administrative access to the device via SSH or...

Juniper ScreenOS contains multiple vulnerabilities

Overview Juniper Networks ScreenOS versions 6.3.0r17 through 6.3.0r20 allows unauthorized remote administration access to the device. Juniper Networks ScreenOS versions 6.2.0r15 through 6.2.0r18 and 6.3.0r12 through 6.3.0r20 allow for an attacker to monitor and decrypt VPN traffic. Description...

Seagate GoFlex Satellite Remote Telnet Default Password Vulnerability

Seagate GoFlex Satellite Mobile Wireless Storage devices contain a hardcoded backdoor account. An attacker could use this account to remotely tamper with the underlying operating system when Telnet is enabled. Title: Seagate GoFlex Satellite Remote Telnet Default Password Publication URL:...

Seagate GoFlex Satellite Remote Telnet Default Password

Vulnerability Details Affected Vendor: Seagate Affected Product: GoFlex Satellite Affected Version: 1.3.7 Platform: Embedded Linux CWE Classification: CWE-288: Authentication Bypass Using an Alternate Path or Channel; CWE-798: Use of Hard-coded Credentials Impact: Remote Administration Attack...

Seagate GoFlex Satellite Remote Telnet Default Password

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 KL-001-2015-007 : Seagate GoFlex Satellite Remote Telnet Default Password Title: Seagate GoFlex Satellite Remote Telnet Default Password Advisory ID: KL-001-2015-007 Publication Date: 2015.12.18 Publication URL:...

Linksys EA6100 Wireless Router Authentication Bypass

Vulnerability Details Affected Vendor: Linksys Affected Product: EA6100 - EA6300 Wireless Router Affected Version: 1.1.5 Platform: Embedded Linux CWE Classification: CWE-288: Authentication Bypass Using an Alternate Path or Channel Impact: Remote Administration Attack vector: HTTP CVE-ID: 2...

CVE-2015-5323

CVE-2015-5323 affects Jenkins: versions before 1.638 and the LTS line prior to 1.625.2 do not properly restrict access to API tokens, which could allow a remote administrator to gain privileges and run scripts using another user’s API token. Mitigation is to upgrade to Jenkins 1.638 or later, and...

ARRIS cable modems generate passwords deterministically and contain XSS and CSRF vulnerabilities

Overview Multiple models of ARRIS cable modems contain multiple, deterministically generated backdoor passwords, as well as multiple cross-site scripting XSS and cross-site request forgery CSRF vulnerabilities. Description CWE-255: Credentials Management - CVE-2009-5149The 'password of the day'...

PageFair Hack Serves Up Fake Flash Update to 500 Sites

More than 500 users of a free analytics service may have had their websites compromised over the weekend after a hacker was able to execute malicious JavaScript through the service. On Halloween night, an attacker was able to hijack a “key email account” at PageFair, an ad blocking analytics...

Cisco FireSIGHT Management Center Arbitrary Command Execution Vulnerability

Cisco FireSIGHT Management Center enables centralized management of network security and operational functions for Cisco ASA with FirePOWER Services and Cisco FirePOWER devices. A security vulnerability exists in the policy implementation of Cisco FireSIGHT Management Center 5.3.1.7, 5.4.0.4, 6.0...

Netgear Patches Routers Under Attack

After a pair of very public disclosures in the last two weeks, Netgear published new firmware for vulnerabilities in its routers that have been publicly exploited. Researchers discovered as many as 10,000 routers had been taken over, according to data lifted from one of the command and control...

Pupy - Multi-Platform Remote Administration Tool

Pupy is an opensource, multi-platform Remote Administration Tool written in Python. On Windows, Pupy uses reflective dll injection and leaves no traces on disk. Features : On windows, the Pupy payload is compiled as a reflective DLL and the whole python interpreter is loaded from memory. Pupy doe...

JSPMySQL Administrador - Multiple Vulnerabilities

Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-JSPMYSQLADMINISTRADOR-0904.txt Vendor: ================================ JSPMySQL Administrador https://sites.google.com/site/mfpledon/producao-de-software Product:...

JSPMySQL Administrador 1 Cross Site Request Forgery / Cross Site Scripting

Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-JSPMYSQLADMINISTRADOR-0904.txt Vendor: ================================ JSPMySQL Administrador https://sites.google.com/site/mfpledon/producao-de-software Product:...

JSPMySQL Administrador CSRF & XSS Vulnerabilities

Exploit for php platform in category web applications Vendor: ================================ JSPMySQL Administrador https://sites.google.com/site/mfpledon/producao-de-software Product: ================================ JSPMySQL Administrador v.1 is a remote administration of MySQL databases that...

PT-2015-3362 · D Link · Dir-815

Name of the Vulnerable Software and Affected Versions: D-Link DIR-815 versions prior to 2.03.B02 Description: The issue is related to insufficient input validation in the remote administration interface, allowing remote attackers to execute arbitrary commands via specially crafted HTTP requests...

Aruba Networks CPPM SQL Injection Vulnerability

Aruba Networks ClearPass Policy Manager is an advanced policy management platform for role- and device-based network access control. A security vulnerability exists in Aruba Networks ClearPass Policy Manager CPPM, which can be exploited by remote administrators to execute arbitrary SQL commands...

Apache James Server 2.3.2 - Remote Command Execution

Apache James Server 2.3.2 - Remote Command Execution !/usr/bin/python Exploit Title: Apache James Server 2.3.2 Authenticated User Remote Command Execution Date: 16\10\2014 Exploit Author: Jakub Palaczynski, Marcin Woloszyn, Maciej Grabiec Vendor Homepage: http://james.apache.org/server/ Software...

Apache James Server 2.3.2 - Remote Command Execution

!/usr/bin/python Exploit Title: Apache James Server 2.3.2 Authenticated User Remote Command Execution Date: 16\10\2014 Exploit Author: Jakub Palaczynski, Marcin Woloszyn, Maciej Grabiec Vendor Homepage: http://james.apache.org/server/ Software Link:...

Hikvision DVR RTSP Request Remote Code Execution Exploit

This module exploits a buffer overflow in the RTSP request parsing code of Hikvision DVR appliances. The Hikvision DVR devices record video feeds of surveillance cameras and offer remote administration and playback of recorded footage. The vulnerability is present in several models / firmware...