Binatone DT 850W Wireless Router - Multiple Cross-Site Request Forgery Vulnerabilities

Exploit Title: Binatone DT 850W Wireless Router - Multiple CSRF Vulnerabilities Date: 05/20/2014 Author: Samandeep Singh - SaMaN @samanL33T Vendor Homepage:http://www.binatonetelecom.in/4port-adsl2-wifi-router1.html Category: Hardware/Wireless Router Firmware Version: T6W-A1.005 and below Tested...

Respondly: Clickjacking - changing role

Hi, I'm able to frame the page, when I make a frame with a opacity of 0 and a button at the position of the role switch I can change the role without the victim knowing that. a POC screen : http://prntscr.com/3ay0mh a POC code : Best regards, Olivier Beg...

AIX PowerHA Cluster Management Unspecified Remote Configuration Manipulation

An unspecified vulnerability in the IBM PowerHA Cluster Management monitoring of port 6177 could allow a remote attacker to make unauthorized changes the remote host's AIX configuration. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

Hacker arrested by Taiwan Investigation Bureau

A suspect hacker 'Shih' was arrested by Taiwan Criminal Investigation Bureau CIB last week for hacking into a popular local classic music website. The police raided the apartment of the suspect and seized his computer. The investigation was launched by the bureau after it received a report from t...

doorGets CMS - Cross-Site Request Forgery

doorGets CMS - Cross-Site Request Forgery Title: Doorgets CSRF Vulnerability Author: n0pe Software Link: http://www.doorgets.com/ Download: http://www.doorgets.com/?sourcescms Tested: BackBox Linux 3 With this vulnerability you can change the configuration of the site. Proof of concept: Title...

doorGets CMS - Cross-Site Request Forgery

Title: Doorgets CSRF Vulnerability Author: n0pe Software Link: http://www.doorgets.com/ Download: http://www.doorgets.com/?sourcescms Tested: BackBox Linux 3 With this vulnerability you can change the configuration of the site. Proof of concept: Title Slogan Description Copyright Year of creation...

WordPress SolveMedia 1.1.0 CSRF Vulnerability

SolveMedia is a capatcha service that allows webmasters to monetize from correct captcha type-ins, solvemedia.admin.inc is vulnerable to CSRF, there is no anti-CSRF tokens implemented nor is the wp-nonce function used, therefore an attacker can change the webmasters SolveMedia API Keys public key...

FCMS CMS 2.7.2 - Multiple Cross-Site Request Forgery Vulnerabilities

FCMS2.7.2 cms and earlier multiple CSRF Vulnerability =================================================================================== Exploit Title: FCMS2.7.2 cms multiple CSRF Vulnerability Download link...

Multiple SKYARC System Co., Ltd. products fail to restrict access permissions

Overview Multiple products provided by SKYARC System Co., Ltd. contain an issue where access permissions are not restricted. MTCMS and multiple Movable Type plugins provided by SKYARC System Co., Ltd. contain an issue where access permissions are not restricted. Impact A user without the...

CentOS Update for NetworkManager CESA-2010:0616 centos5 i386

Check for the Version of NetworkManager OpenVAS Vulnerability Test CentOS Update for NetworkManager CESA-2010:0616 centos5 i386 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/...

National Nuclear Lab IT Systems at Risk

Confidential Information about the nation’s nuclear stockpile could be at risk according to an audit of Lawrence Livermore National Laboratory issued by the Department of Energy DOE earlier this week. The audit .PDF found the government-funded Bay Area-lab failed to effectively implement its...

phpKF Forum 1.80 profil_degistir.php CSRF Exploit

Exploit for php platform in category web applications ================================================= phpKF Forum 1.80 profildegistir.php CSRF Exploit ================================================= Exploit Title : phpKF Forum profildegistir.php CSRF Exploit. Google Dork : php Kolay Forum php...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in user/main/updateuser in DiamondList 0.1.6, and possibly earlier, allow remote attackers to hijack the authentication of administrators for requests that 1 change the administrative password or 2 change the site's configuration...

RHEL 5 : sudo (RHSA-2010:0475)

The remote Redhat Enterprise Linux 5 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2010:0475 advisory. The sudo superuser do utility allows system administrators to give certain users the ability to run commands as root. A flaw was found in the way sud...

Abyss Web Server X1 - Cross-Site Request Forgery

Abyss Web Server X1 - Cross-Site Request Forgery http://osvdb.org/show/osvdb/64693 http://cross-site-scripting.blogspot.com/2010/05/abyss-web-server-x1-xsrf.html : Abyss Web Server X1 XSRF A cross-site request forgery vunlerability in the Abyss Web Server X1 management console can be exploited to...

r57shell Backdoor Detection

At least one instance of r57shell is hosted on the remote web server. This is a PHP script that acts as a backdoor and provides a convenient set of tools for attacking the affected host. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

Facebook Cross-Site Request Forgery vulnerability

Exploit for unknown platform in category web applications ================================================= Facebook Cross-Site Request Forgery vulnerability ================================================= ============================================= INTERNET SECURITY AUDITORS ALERT 2010-002 -...

AccStatistics 1.1 Cross Site Request Forgery

------------------------------------------------------------------------------------------------- Title: AccStatistics v1.1 XSRF Vulnerability Change Admin Settings Author: Milos Zivanovic Date: 13. December 2009...

CVE-2009-3939

The pollmodeio file for the megaraidsas driver in the Linux kernel 2.6.31.6 and earlier has world-writable permissions, which allows local users to change the I/O mode of the driver by modifying this file...

DreamPoll 3.1 Vulnerabilities

During a recent security audit of the DreamPoll 3.1 software by Dreamlevels, I discovered a number of XSS and SQL Injection vulnerabilities in the application. These vulnerabilities could be exploited to make unauthorized changes to a web site or compromise a client accessing a site that utilizes...