CIK Telecom VoIP Router SVG6000RW - Privilege Escalation / Command Execution

Exploit Title: CIK Telecom VoIP router SVG6000RW Privilege Escalation and Command Execution Date: 2014/12/10 Exploit Author: Chako Vendor Homepage: https://www.ciktel.com/ Description: CIK Telecom VoIP router SVG6000RW has a Privilege Escalation vulnerabilitie and can lead to Command Execution...

CIK Telecom SVG6000RW Default Account / Command Execution

Exploit Title: CIK Telecom VoIP router SVG6000RW Privilege Escalation and Command Execution Date: 2014/12/10 Exploit Author: Chako Vendor Homepage: https://www.ciktel.com/ Description: CIK Telecom VoIP router SVG6000RW has a Privilege Escalation vulnerabilitie and can lead to Command Execution...

Mozilla Firefox CSP Information Disclosure Vulnerability (Dec 2014) - Mac OS X

Mozilla Firefox is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Oracle database vulnerability analysis: the need for a username and password to access your database-vulnerability warning-the black bar safety net

Summary General database vulnerabilities that are in a successful connection or login to the database after the invasion; this article describes two in 2 0 1 2 years of exposure to the Oracle, by these two vulnerabilities combined may not grasp the username/password of the case of the invasion of...

Iwebmall 最新版SQL注入第五枚

简要描述： Iwebmall 最新版SQL注入第五枚 详细说明： 看到wooyun上有人提了几个iweb的漏洞（ WooYun: iwebmall商城程序sql注入 ， WooYun: Iwebsns sql 第五枚。 ），我来捡捡漏儿吧，希望不要重复。 先把注入点拿出来：www.xxx.com/do.php?act=shopguestbookdel ，POST的内容中有个参数favoriteshop，存在注入。 action/shop/guestbookdel.action.php 无关代码 //数据库操作 dbtarget'w',$dbServs; $dbo=new dbex;...

Iwebsns最新版SQL注入第八枚

简要描述： Iwebsns最新版SQL注入第八枚 详细说明： 在wooyun上看到雨牛提了5个iwebsns的漏洞了（ WooYun: Iwebsns sql 第五枚。 ），我来捡捡漏儿吧，已对比，不重复，下载Iwebsns最新的1.1.0来看看。 为了使审核的大大们容易确认是否有重复，我先把存在漏洞的文件和注入参数分别写在这里：/action/privacy/homeinputmessset.action.php inputmess 下面看看漏洞是怎么产生的 /action/privacy/homeinputmessset.action.php exeUpdate$sql;...

CVE-2014-9303

EntryPass N5200 Active Network Control Panel allows remote attackers to read device memory and obtain the administrator username and password via a URL starting with an ASCII character o through z or A through D, different vectors than CVE-2014-8868...

Default credentials

EntryPass N5200 Active Network Control Panel allows remote attackers to read device memory and obtain the administrator username and password via a URL starting with an ASCII character o through z or A through D, different vectors than CVE-2014-8868...

CVE-2014-9303

EntryPass N5200 Active Network Control Panel allows remote attackers to read device memory and obtain the administrator username and password via a URL starting with an ASCII character o through z or A through D, different vectors than CVE-2014-8868...

mysql: Remote Preauth User Enumeration flaw

Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, and possibly other versions, generates different error messages with different time delays depending on whether a user name exists, which allows remote attackers to enumerate valid usernames...

EntryPass N5200 - Credentials Exposure

EntryPass N5200 - Credentials Exposure Advisory: EntryPass N5200 Credentials Disclosure EntryPass N5200 Active Network Control Panels allow the unauthenticated downloading of information that includes the current administrative username and password. Details ======= Product: EntryPass N5200 Activ...

IPUX Cube Type CS303C IP Camera - 'UltraMJCamX.ocx' ActiveX Stack Buffer Overflow

IPUX Cube Type CS303C IP Camera UltraMJCamX.ocx ActiveX Stack Buffer Overflow Vendor: Big Good Holdings Limited | Fitivision Technology Inc. Product web page: http://www.ipux.net | http://www.fitivision.com Affected version: Cube Type ICS303C firmware: ICS303C 1.0.0-17 20140120 r1511 Summary: The...

EntryPass N5200 - Credentials Exposure

Advisory: EntryPass N5200 Credentials Disclosure EntryPass N5200 Active Network Control Panels allow the unauthenticated downloading of information that includes the current administrative username and password. Details ======= Product: EntryPass N5200 Active Network Control Panel Affected...

EntryPass N5200 Credential Disclosure Vulnerability

EntryPass N5200 Active Network Control Panels allow the unauthenticated downloading of information that includes the current administrative username and password. EntryPass N5200 Credentials Disclosure EntryPass N5200 Active Network Control Panels allow the unauthenticated downloading of...

X (Formerly Twitter): [Stored XSS] vine.co - profile page

Stored XSS via API request: While creating new account in Windows mobile app, i noticed this request: PUT /users/1147563919679037440 HTTP/1.1 avatarUrl=https%3A%2F%2Fvines.s3.amazonaws.com%2Favatarstrellis%2F2014%2F11%2F21%2F0B2EAE2EB811475639291495546881.3.4.jpg&username= it seems that the...

Keeping the Bots at Bay: How to Detect Brute Force Attacks

Thanks to recent events involving certain celebrities’ stolen pictures, “brute-force attack” is now one of the hot buzz words making its rounds. As an IT professional - do you know what a brute force attack is, how to spot one when it happens, and how to prevent it? A brute-force attack is, simpl...

UBUNTU-CVE-2014-7899

Google Chrome before 38.0.2125.101 allows remote attackers to spoof the address bar by placing a blob: substring at the beginning of the URL, followed by the original URI scheme and a long username string...

mysql: Remote Preauth User Enumeration flaw

Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, and possibly other versions, generates different error messages with different time delays depending on whether a user name exists, which allows remote attackers to enumerate valid usernames...

mysql: Remote Preauth User Enumeration flaw

Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, and possibly other versions, generates different error messages with different time delays depending on whether a user name exists, which allows remote attackers to enumerate valid usernames...

How To Setup Postfix

How To Setup Postfix Postfix is a very popular open source Mail Transfer Agent MTA that can be used to route and deliver email on a Linux system. It is estimated that around 25% of public mail servers on the internet run Postfix. In this guide, we’ll teach you how to get up and running quickly wi...