15775 matches found
CentOS Web Panel 0.9.8.740 - Cross-Site Request Forgery Cross-Site Scripting
CentOS Web Panel 0.9.8.740 - Cross-Site Request Forgery Cross-Site Scripting Title: CentOS Web Panel Root Account Takeover + Remote Command Execution var url = "http://targetserver:2030/admin/index.php?module=rootpwd"; var params = "ifpost=yes&password1=newpassword&password2=newpassword"; var vul...
CentOS Web Panel 0.9.8.740 - Cross-Site Request Forgery / Cross-Site Scripting
Title: CentOS Web Panel Root Account Takeover + Remote Command Execution var url = "http://targetserver:2030/admin/index.php?module=rootpwd"; var params = "ifpost=yes&password1=newpassword&password2=newpassword"; var vuln = new XMLHttpRequest; vuln.open"POST", url, true; vuln.withCredentials =...
CVE-2018-6442
A vulnerability in the Brocade Webtools firmware update section of Brocade Fabric OS before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow remote authenticated attackers to execute arbitrary commands...
CVE-2018-19081
An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The ONVIF devicemgmt SetDNS method allows remote attackers to execute arbitrary OS commands via the IPv4Address field...
CVE-2018-19070
An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. They allow remote attackers to execute arbitrary OS commands via shell metacharacters in the...
Linksys E1200 and E2500 OS Command Injection Vulnerability (CNVD-2019-22779)
The Belkin Linksys E1200 and E2500 are both wireless router products in the E-Series from Belkin USA. An operating system command injection vulnerability exists in the Belkin Linksys E1200 with firmware version 2.0.09 and the Linksys E2500 with firmware version 3.0.04, which can be exploited to...
PT-2018-2678 · Centos · Centos Web Panel
Name of the Vulnerable Software and Affected Versions: CentOS Web Panel versions through 0.9.8.740 Description: The issue is related to insufficient authentication of executed requests in the CentOS Web Panel application, specifically affecting the "admin/index.php?module=rootpwd" endpoint. This...
PT-2018-2679 · Centos · Centos Web Panel
Name of the Vulnerable Software and Affected Versions: CentOS Web Panel versions through 0.9.8.740 Description: The issue is related to insufficient authentication of requests, allowing for the execution of arbitrary OS commands. This can be exploited by a remote attacker to execute commands. The...
CentOS Web Panel Root Account Takeover <= v0.9.8.740 Remote Command Execution Exploit
CentOS Web Panel versions 0.9.8.740 and below suffer from cross site request forgery and cross site scripting vulnerabilities that can be leveraged to achieve remote code execution. + Title: CentOS Web Panel Root Account Takeover + Remote Command Execution var url =...
CentOS Web Panel 0.9.8.740 Root Account Takeover / Command Execution
Title: CentOS Web Panel Root Account Takeover + Remote Command Execution var url = "http://targetserver:2030/admin/index.php?module=rootpwd"; var params = "ifpost=yes&password1=newpassword&password2=newpassword"; var vuln = new XMLHttpRequest; vuln.open"POST", url, true; vuln.withCredentials =...
Server side request forgery (ssrf)
Typecho V1.1 allows remote attackers to send shell commands via base64-encoded serialized data, as demonstrated by SSRF...
The vulnerability of the web interface of the microprogramming software for Cisco RV110W Wireless-N VPN and the multifunctional VPN routers Cisco RV130W Wireless-N and Cisco RV215W Wireless-N VPN allows a hacker to execute arbitrary commands.
The vulnerability of the web interface of Microprogramming Software for Cisco RV110W Wireless-N VPN and Multi-Function VPN Routers such as Cisco RV130W Wireless-N and Cisco RV215W Wireless-N VPN lies in insufficient cleaning of input data used during command generation. Exploiting this...
CVE-2018-18652
A remote command execution vulnerability in Veritas NetBackup Appliance before 3.1.2 allows authenticated administrators to execute arbitrary commands as root. This issue was caused by insufficient filtering of user provided input...
CVE-2018-18652
A remote command execution vulnerability in Veritas NetBackup Appliance before 3.1.2 allows authenticated administrators to execute arbitrary commands as root. This issue was caused by insufficient filtering of user provided input...
Design/Logic Flaw
A remote command execution vulnerability in Veritas NetBackup Appliance before 3.1.2 allows authenticated administrators to execute arbitrary commands as root. This issue was caused by insufficient filtering of user provided input...
CVE-2018-18652
A remote command execution vulnerability in Veritas NetBackup Appliance before 3.1.2 allows authenticated administrators to execute arbitrary commands as root. This issue was caused by insufficient filtering of user provided input...
CVE-2018-18652
The CVE-2018-18652 entry concerns Veritas NetBackup Appliance prior to 3.1.2. It describes a remote command execution vulnerability caused by insufficient filtering of user-provided input, permitting authenticated administrators to execute arbitrary commands as root. The connected sources substan...
Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass)
Oracle Weblogic Server - Deserialization Remote Command Execution Patch Bypass // All respects goes to Zhiyi Zhang of 360 ESG Codesafe Team // URL: https://blogs.projectmoon.pw/2018/10/19/Oracle-WebLogic-Two-RCE-Deserialization-Vulnerabilities/ package ysoserial.payloads; import...
Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass)
// All respects goes to Zhiyi Zhang of 360 ESG Codesafe Team // URL: https://blogs.projectmoon.pw/2018/10/19/Oracle-WebLogic-Two-RCE-Deserialization-Vulnerabilities/ package ysoserial.payloads; import com.sun.jndi.rmi.registry.ReferenceWrapperStub; import sun.rmi.server.UnicastRef; import...
