Tenda N11 Wireless Router 5.07.43_en_NEX01 - Remote DNS Change

Tenda N11 Wireless Router 5.07.43enNEX01 - Remote DNS Change !/bin/bash Tenda N11 Wireless Router V5.07.43enNEX01 Cookie Session Weakness Remote DNS Change PoC Exploit Copyright 2018 c Todor Donev https://ethical-hacker.org/ https://facebook.com/ethicalhackerorg Once modified, systems use foreign...

The vulnerability of the Saperion Web Client web application lies in its lack of access control mechanisms, which allows attackers to execute arbitrary code.

The vulnerability of the Saperion Web Client web application is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to execute arbitrary code with elevated privileges remotely...

Tenda N11 Wireless Router 5.07.43_en_NEX01 - Remote DNS Change

!/bin/bash Tenda N11 Wireless Router V5.07.43enNEX01 Cookie Session Weakness Remote DNS Change PoC Exploit Copyright 2018 c Todor Donev https://ethical-hacker.org/ https://facebook.com/ethicalhackerorg Once modified, systems use foreign DNS servers, which are usually set up by cybercriminals. Use...

Reverb.com: Stored xss in shop name @ lp.reverb.com

hello team, There is a stored xss in lp.reverb.com. Attacker can inject malicious script into server while adding shop name as lll"alert'xss';. Exploit: https://lp.reverb.com/shops/faniyos-boutique/listings Steps to reproduce: 1. Navogate to https://reverb.com/my/lpshop/edit 2. Change your lp sho...

Tenda N11 Wireless Router 5.07.43_en_NEX01 Remote DNS Changer Exploit

Exploit for hardware platform in category web applications !/bin/bash Tenda N11 Wireless Router V5.07.43enNEX01 Cookie Session Weakness Remote DNS Change PoC Exploit Copyright 2018 c Todor Donev https://ethical-hacker.org/ https://facebook.com/ethicalhackerorg Once modified, systems use foreign D...

CVE-2018-7445

A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system. The overflow occurs before authentication takes place, so it is...

The vulnerability of the LDAP server in the Samba networking software package allows a hacker to alter the passwords of other users.

The vulnerability of the LDAP server of the Samba networking software, which is configured as an Active Directory domain controller, is related to deficiencies in the authentication mechanism. Exploiting this vulnerability allows a malicious actor to remotely change the passwords of other users...

U.S. Dept Of Defense: SSRF on █████████ Allowing internal server data access

Summary: An end point on ██████ allows an internal access to the network thus revealing sensitive data and allowing internal tunneling Description: OAuth Plugin allows you to provide a url that gives a snap shot of the web page. We can pass internal URLS and conduct SSRF. Impact Critical...

Stored XSS Vulnerability in xycms Ad Design Center Web System

xycms advertising design center website system is to asp + access for the development of advertising company website. A stored XSS vulnerability exists in the xycms Advertising Design Center website system. The vulnerability stems from the program's failure to perform effective filtering. A remot...

CVE-2018-5461

An Inadequate Encryption Strength issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switches. An inadequate encryption strength vulnerability in the web interface has been identified, which may allow an attacker to obtain sensiti...

The vulnerability of microprogramming software in media devices. Valve’s Steam Link allows a intruder to gain access to the device.

The vulnerability of Valve’s Steam Link media controller software relates to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to gain access to the device with root privileges, using the IPv6 TCP port 22...

Gemalto SafeNet Authentication Service TokenValidator Proxy Agent Elevation of Privilege Vulnerability

Gemalto SafeNet Authentication Service TokenValidator Proxy Agent is a proxy program from Gemalto USA. The program implements proxy authentication requests from other proxies to the SAS. A security vulnerability exists in the Gemalto SafeNet Authentication Service TokenValidator Proxy Agent that...

Code injection

SafeNet Authentication Service Windows Logon Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module, a different vulnerability than CVE-2015-7965...

CVE-2015-7596

SafeNet Authentication Service End User Software Tools for Windows uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module...

The vulnerability of the quickTemplateSelect.xhtml component of the HPE Intelligent Management Center PLAT software platform allows a perpetrator to execute arbitrary code.

The vulnerability of the quickTemplateSelect.xhtml component in the HPE Intelligent Management Center PLAT software platform is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code using the beanName parameter...

OpenJDK: insufficient strength of key agreement (JCE, 8185292)

It was discovered that the key agreement implementations in the JCE component of OpenJDK did not guarantee sufficient strength of used keys to adequately protect generated shared secret. This could make it easier to break data encryption by attacking key agreement rather than the encryption using...

foreman: models with a 'belongs_to' association to an Organization do not verify association belongs to that Organization

It was found that foreman in Satellite 6 did not properly enforce access controls on certain resources. An attacker with access to the API and knowledge of the resource name can access resources in other organizations...

The vulnerability of the MembersApp component of the SAP NetWeaver software integration platform allows a hacker to disclose user information.

The vulnerability of the MembersApp component of the SAP NetWeaver software integration platform is related to insufficient data protection. Exploiting this vulnerability allows a malicious actor to obtain user information such as listing user names by taking advantage of the temporary difference...

The vulnerability of Phoenix Contact FL SWITCH router microprogramming software, related to deficiencies in authentication procedures, allows a intruder to access diagnostic information.

The vulnerability of Phoenix Contact FL SWITCH router microprogramming software is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to remotely access diagnostic information by using the device’s monitoring mode...

The vulnerability of Phoenix Contact FL SWITCH router microprogramming software, related to deficiencies in authentication procedures, allows a malicious actor to gain access to the device with administrator privileges.

The vulnerability of Phoenix Contact FL SWITCH router microprogramming software is related to deficiencies in the authentication process. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain administrator privileges through specially crafted HTTP requests...