Advantech ADAM-3600

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Advantech Equipment: ADAM-3600 Vulnerability: Use of Hard-coded Cryptographic Key 2. RISK EVALUATION Successful exploitation of this vulnerability could allow unauthorized access to intercept traffic...

MongoDB Server Login Possible

Binary data mongodblogin.nbin...

Citrix Provisioning Services - Target Fails To BDM Boot When Running The Imaging Wizard

When using BDM to boot the Master Target Device to capture a new vDisk it fails to boot. With verbose mode enabled in the bootstrap you will see the Target download the bootstrap and then login to a PVS Server at which point it will sit at a black screen indefinitely...

Command Execution Vulnerability in SeaCMS V210530

Ocean CMS is a PHP MYSQL-based architecture, professional open source free PHP film and television system, can be cross-platform operation of the web content management system. A command execution vulnerability exists in SeaCMS V210530. An attacker can exploit this vulnerability to obtain web...

"You cannot logon to the specified server" error when login to Storefront server.

Only certain users cannot log on to storefront. Following events can be seen on the storefront server : Security events logs : Event 4625, Microsoft Window security auditing Failure Information : Failure Reason : User not allowed to logon at this computer. Status : 0xC000006E Citrix Delivery...

UBUNTU-CVE-2019-13045

Irssi before 1.0.8, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, when SASL is enabled, has a use after free when sending SASL login to the server...

Improper access control

Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9, the setting of LDAP for authentication with STARTTLS, and System Account for authorization, allows an attacker to log into the server by sending any valid username with an arbitrary password...

Application Shortcuts disappear when connecting to server where the profile already exists

When first logging into a server and the user profile is created for the first time, application shortcuts as configured in WEM appears on Desktop. Application shortcuts configured in WEM: Shortcuts created on desktop of new user profile: Shortcuts deleted after subsequent logins...

CVE-2016-3946

SAP Console aka SAPConsole 7.30 allows local users to discover SAP Server login credentials by reading the Windows registry, aka SAP Security Note 2121461...

Code injection

SAP Console aka SAPConsole 7.30 allows local users to discover SAP Server login credentials by reading the Windows registry, aka SAP Security Note 2121461...

MySQL Server Login Possible

Nessus was able to log into the remote MySQL server using the supplied credentials. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid91823; scriptversion"1.5"; scriptsetattributeattribute:"pluginmodificationdate", value:"2026/01/27"; scriptnameenglish:"MySQL Server Log...

SHOUTcast DNAS 2.2.1 - Stored XSS

No description provided by source. There is an XSS\HTML Injection in a song history in song history, allowing inject a JavaScript script or HTML code in site. PoC: 1. Open yours MP3 file setting, and open details overlap. 2. In the title field enter your HTML code 3. Start streaming your MP3 file...

Microsoft SQL Server 7.0/2000,Data Engine 1.0/2000 xp_peekqueue Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2040/info The API Srvparaminfo, which is implemented by Extended Stored Procedures XPs in Microsoft SQL Server and Data Engine, is susceptible to a buffer overflow vulnerability which may cause the application to fail or...

SHOUTcast DNAS 2.2.1 Cross Site Scripting

Exploit Title: SHOUTcast DNAS v2.2.1 win32 XSS\HTML Injection in Song history other version may be also affected Date: 2014-06-11 Exploit Author: robercik101 Vendor Homepage: http://www.shoutcast.com/ ?t=373139 Software Link: http://forums.winamp.com/showthread.php?t=373139 Version: 2.2.1 for Win...

CVE-2013-0142

QNAP VioStor NVR devices with firmware 4.0.3, and the Surveillance Station Pro component in QNAP NAS, have a hardcoded guest account, which allows remote attackers to obtain web-server login access via unspecified vectors...

CVE-2013-0142

QNAP VioStor NVR devices with firmware 4.0.3, and the Surveillance Station Pro component in QNAP NAS, have a hardcoded guest account, which allows remote attackers to obtain web-server login access via unspecified vectors...

CVE-2013-0142

CVE-2013-0142 affects QNAP VioStor NVR devices (firmware 4.0.3 and possibly earlier) and the Surveillance Station Pro component in QNAP NAS. The root cause is a hardcoded guest account that can be leveraged to obtain web-server login access, enabling remote attackers to access administrative func...

Active! mail vulnerable to information disclosure

Overview Active! mail contains an information disclosure vulnerability. Active! mail provided by TransWARE is a webmail software. Active! mail contains an information disclosure vulnerability. Mitsuru Ogino of Sugiyama Jogakuen reported this vulnerability to IPA. JPCERT/CC coordinated with the...

Microsoft SQL Server Database Link Crawling Command Execution

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core'...

Microsoft SQL Server Database Link Crawling Command Execution

This module can be used to crawl MS SQL Server database links and deploy Metasploit payloads through links configured with sysadmin privileges using a valid SQL Server Login. If you are attempting to obtain multiple reverse shells using this module we recommend setting the "DisablePayloadHandler"...