CVE-2018-16339

CVE-2018-16339 affects EmpireCMS 7.0 and is described as a Cross‑Site Request Forgery vulnerability that can add administrators via the endpoint upload/e/admin/user/AddUser.php?enews=AddUser. The connected documents confirm the affected product and the vulnerable action, but do not provide remedi...

Gleez CMS 1.2.0 - Cross-Site Request Forgery (Add Admin)

Gleez CMS 1.2.0 - Cross-Site Request Forgery Add Admin Exploit Title: Gleez CMS 1.2.0 - Cross-Site Request Forgery Add Admin Date: 2018-08-24 Exploit Author: GunEggWang Vendor Homepage: https://gleezcms.org/ Software Link: https://github.com/gleez/cms Version: 1.2.0 CVE : CVE-2018-15845...

CVE-2018-10592

Yokogawa STARDOM FCJ controllers R4.02 and prior, FCN-100 controllers R4.02 and prior, FCN-RTU controllers R4.02 and prior, and FCN-500 controllers R4.02 and prior utilize hard-coded credentials that could allow an attacker to gain unauthorized administrative access to the device, which could...

CVE-2018-1000506

Metronet Tag Manager version 1.2.7 contains a Cross ite Request Forgery CSRF vulnerability in Settings page /wp-admin/options-general.php?page=metronet-tag-manager that can result in allows anybody to do almost anything an admin can. This attack appear to be exploitable via Logged in user must...

PT-2018-3907 · Cisco · Cisco Fxos +2

Name of the Vulnerable Software and Affected Versions: Cisco FXOS Software versions prior to the fixed version Cisco NX-OS Software versions prior to the fixed version Description: A vulnerability in the write-erase feature of Cisco FXOS Software and Cisco NX-OS Software could allow an...

SKT LTE Wi-Fi SDT-CW3B1 - Unauthorized Admin Credential Change

SKT LTE Wi-Fi SDT-CW3B1 - Unauthorized Admin Credential Change Exploit Title: SKT LTE Wi-Fi SDT-CW3B1 - Unauthorized Admin Credential Change Shodan Dork: SDT-CW3B1 Date: 2018-05-23 Exploit Author: Safak Aslan Vendor Homepage: http://telesquare.co.kr/ Version: SKT CW3B1 sw version 1.2.0 Tested on:...

CVE-2018-10265

An issue was discovered in HongCMS v3.0.0. There is a CSRF vulnerability that can add an administrator account via the admin/index.php/users/save URI...

CVE-2018-10117

An issue was discovered in idreamsoft iCMS V7.0.7. There is a CSRF vulnerability that can add an admin account via admincp.php?app=members&do=save&frame=iPHP...

CVE-2017-18223

BMC Remedy AR System before 9.1 SP3, when Remedy AR Authentication is enabled, allows attackers to obtain administrative access...

CVE-2016-4928

Cross site request forgery vulnerability in Junos Space before 15.2R2 allows remote attackers to perform certain administrative actions on Junos Space...

Dedecms CSRF Vulnerability

Dedecms is an open source PHP open source website management system. Dedecms has a CSRF vulnerability that allows an attacker to exploit the vulnerability to perform unauthorized operations as an administrator and delete the account of any user...

ZKTeco ZKBioSecurity 3.0 CSRF Add Superadmin Exploit

Summary ZKBioSecurity3.0 is the ultimate "All in One" web based security platform developed by ZKTeco. It contains four integrated modules: access control, video linkage, elevator control and visitor management. With an optimized system architecture designed for high level biometric identificatio...

Intellinet IP Camera INT-L100M20N - Unauthorized Admin Credential Change

!/bin/bash INTELLINET IP Camera INT-L100M20N remote change admin user/password Copyright 2016 c Todor Donev http://www.ethical-hacker.org/ https://www.facebook.com/ethicalhackerorg Disclaimer: This or previous programs is for Educational purpose ONLY. Do not use it without permission. The usual...

Observium 0.16.7533 Cross Site Request Forgery

& retype password instead of having to insert the older password. such an attack would look like this: -- Change admin password...

EMC ViPR SRM Cross-Site Request Forgery Vulnerability (NVD-C-2016-22474)

EMC ViPR SRM is storage resource management software. A cross-site request forgery vulnerability exists in multiple administration pages of EMC ViPR SRM, which can be exploited by an attacker to execute unauthorized requests as an administrator...

CVE-2015-6020

ZyXEL PMG5318-B20A devices with firmware 1.00AANC0b5 allow remote authenticated users to obtain administrative privileges by leveraging access to the user account...

Mango Automation 2.6.0 CSRF Add Admin Exploit

Summary Mango Automation is a flexible SCADA, HMI And Automation software application that allows you to view, log, graph, animate, alarm, and report on data from sensors, equipment, PLCs, databases, webpages, etc. It is easy, affordable, and open source. Description The application allows users ...

Nukedit CMS <= 4.9.6 Unauthorized Admin Add Exploit

No description provided by source. KAPDA - Security Science Researchers Institute Advisory : http://www.kapda.ir/advisory-337.html Vendor : http://www.nukedit.com/ What is : Nukedit is a Free Content Management Vulnerability : Unauthorized Admin Add Exploit if register.asp be enable! Discovered :...

A remote code execution vulnerability to get Yahoo, Microsoft, Orange-vulnerability warning-the black bar safety net

Write ahead: An Egyptian hacker through a file upload, scored several large manufacturers its web site. And this dude talking was funny, a Comedy effect. The English version look here. Body: Hello guys, today I will show you a“Unauthorized Admin Access” caused by the “Remote Code Injection” I was...

CVE-2011-5098

chef-server-api/app/controllers/clients.rb in Chef Server in Chef before 0.9.20, and 0.10.x before 0.10.6, does not require administrative privileges for creating admin clients, which allows remote authenticated users to bypass intended access restrictions by leveraging read permission for the...