JVN#75028871: CG-WLR300GNV Series does not limit authentication attempts

CG-WLR300GNV and CG-WLR300GNV-W provided by Corega Inc are wireless LAN routers. The WPS functionality in CG-WLR300GNV Series does not limit PIN authentication attempts, making it susceptible to brute force attacks. Impact An unauthenticated attacker within wireless range of the device may perfor...

SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2016:1560-1)

qemu was updated to fix 37 security issues. These security issues were fixed : - CVE-2016-4439: Avoid OOB access in 53C9X emulation bsc980711 - CVE-2016-4441: Avoid OOB access in 53C9X emulation bsc980723 - CVE-2016-4952: Avoid OOB access in Vmware PV SCSI emulation bsc981266 - CVE-2015-8817: Avo...

NerdyZine 2.0 SQL Injection

======================================================================== | Title : NerdyZine 2.0 SQL Injection vulnerability | Author : indoushka | email : [email protected] | Tested on: windows 8.1 Français V.Pro | Vendor : http://www.nerdyzine.net/...

中兴W-LAN无线接入控制器 /apgroup/getChannelByCountryCode.php 参数CountryCode注入漏洞

No description provided by source...

CVE-2016-4952

Quick EmulatorQemu built with the VMWARE PVSCSI paravirtual SCSI bus emulation support is vulnerable to an OOB r/w access issue. It could occur while processing SCSI commands 'PVSCSICMDSETUPRINGS' or 'PVSCSICMDSETUPMSGRING'. A privileged user inside guest could use this flaw to crash the Qemu...

On Ransomware Hitting an Online Casino, Brazil Taking WhatsApp Offline, And More

Mike Mimoso, Chris Brook, and Threatpost’s newest reporter, Tom Spring, discuss the week in news, including a first hand account of an online casino’s experience with a Teslacrypt infection, Brazil shutting down WhatsApp, and attackers mining an ADP portal for W-2s. Download:...

WordPress Hero Maps Pro plugin <= 2.1.0 - Cross Site-Scripting (XSS) vulnerability

Cross Site-Scripting XSS vulnerability discovered by Larry W. Cashdollar in WordPress Hero Maps Pro plugin versions = 2.1.0. Solution Plugin closed. Deactivate and delete...

W-Match : Chat & Dating App - Customized SSL, Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application W-Match : Chat & Dating App published at the 'play' market has multiple vulnerabilities...

Fedora 23 : xen-4.5.2-9.fc23 (2016-f4504e9445)

Qemu: nvram: OOB r/w access in processing firmware configurations CVE-2016-1714 1296080 Qemu: i386: NULL pointer dereference in vapicwrite CVE-2016-1922 1292767 qemu: Stack-based buffer overflow in megasasctrlgetinfo CVE-2015-8613 1293305 qemu-kvm: Infinite loop and out-of-bounds transfer start i...

w-o-s.ru XSS vulnerability

Vulnerable URL: http://w-o-s.ru/search/" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated Google Pagerank| 5 VIP website status:| No Check w-o-s.ru SSL...

Joomla Subcategory 1.2.15 SQL Injection

| Title : Joomla comsubcategory 1.2.15 SQL Injection Vulnerability | Author : indoushka | email : [email protected] | Tested on: windows 8.1 Français V.Pro | Vendor : http://sh.st/mGzXC ======================================================================== Sql injection :...

Oracle Linux 7 : qemu-kvm (ELSA-2016-0083)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-0083 advisory. - Resolves: bz1298047 CVE-2016-1714 qemu-kvm: Qemu: nvram: OOB r/w access in processing firmware configurations rhel-7.2.z Tenable has extracted the preceding...

W-Script 3.4.0 Cross Site Scripting / Shell Upload

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 + Site : souk naamane 0 1 + Support e-mail :...

WordPress Cool Video Gallery 1.9 Command Injection

Title: Command Injection in cool-video-gallery v1.9 Wordpress plugin Author: Larry W. Cashdollar, @larry0 Date: 2015-11-29 Download Site: https://wordpress.org/plugins/cool-video-gallery/ Vendor: https://profiles.wordpress.org/praveen-rajan/ Vendor Notified: 2015-11-30 Vendor Contact:...

Siemens Scalance W-700 系列设备SSL证书欺骗漏洞

Siemens Scalance W-700系列内置SSL证书欺骗漏洞 CNVD-ID CNVD-2013-11278 CVE-ID: CVE-2013-4651 在关于担保的管理 web 界面和命令行管理界面中的身份验证旁路硬编码的 SSL 证书的西门子 Scalance W7xx IEEE 802.11a/b/g 产品系列。Siemens Scalance W-700 Series是西门子开发的工业无线交换机设备。 Siemens Scalance W-700系列设备设备内置的SSL证书，不能通过管理接口来更换该证书，允许攻击者通过中间人攻击获取敏感信息。 如下固件版本...

Siemens Scalance W-700 Series 身份认证绕过漏洞

No description provided by source...

Page2Flip 2.5 Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2015-028 Product: Page2Flip Vendor: w!ssenswerft GmbH Affected Versions: Premium App 2.5, probably also in Business App and Basic App, and in lower versions Tested Versions: Premium App 2.5 Vulnerability Type: Cross-Site Scripting...

Page2Flip 2.5 Insecure Direct Object Reference

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2015-029 Product: Page2Flip Vendor: w!ssenswerft GmbH Affected Versions: Premium App 2.5, probably also in Business App and Basic App, and in lower versions Tested Versions: Premium App 2.5 Vulnerability Type: Insecure Direct Objec...

w-dubuque.k12.ia.us XSS vulnerability

Vulnerable URL: http://www.w-dubuque.k12.ia.us/Default.asp?PN=AdvancedSearch=SearchNow Details: Description| Value ---|--- Patched:| Yes, at 30.01.2016 Latest check for patch:| 30.01.2016 21:08 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...

D-Link DSP-W w110 v1.05b01 - Multiple Vulnerabilities

Exploit for hardware platform in category web applications Exploit Title: D-Link DSP-W Arbitrary Arbitrary file upload Date: 30/06/2015 Exploit Author: DNO Vendor Homepage: link Version: w110 v1.05b01 Tested on: linux CVE : N/A ======================================== the only 'filtering' on this...