Conceptronic CIPCAMPTIWL 21.37.2.49 Cross Site Request Forgery

Hello List, Here I inform you about an easily exploitable CSRF discovered in Conceptronic cameras CIPCAMPTIWL. General Details Affected Product: Conceptronic camera CIPCAMPTIWL Tested Firmware: 21.37.2.49 Tested Web UI Firmware: 0.61.4.18 Assigned CVE: CVE-2013-7204 CVSSv2 Base Score: 5.8...

Ability Mail Server 2013 3.1.1 - Web UI Persistent Cross-Site Scripting

!/usr/bin/env python ''' Exploit Title: Ability Mail Server 2013 Stored XSS Date: 12/20/2013 Exploit Author: David Um Vendor Homepage: http://www.code-crafters.com/ Software Link: http://download.code-crafters.com/ams.exe Version: 3.1.1 Tested on: Windows Server 2003 SP2 CVE : CVE-2013-6162...

Palo Alto Networks PAN-OS Firewall/Panorama Web UI Detection

Binary data paloaltowebuidetect.nbin...

Ability Mail Server 2013 3.1.1 - Web UI Persistent Cross-Site Scripting

Ability Mail Server 2013 3.1.1 - Web UI Persistent Cross-Site Scripting !/usr/bin/env python ''' Exploit Title: Ability Mail Server 2013 Stored XSS Date: 12/20/2013 Exploit Author: David Um Vendor Homepage: http://www.code-crafters.com/ Software Link: http://download.code-crafters.com/ams.exe...

Intersystems Cache Remote Code Execution (via Default 'Minimal Security' Install)

------------------- 1 Overview Title: Intersystems Cache Remote Code Execution via Default 'Minimal Security' Install Product: Intersystems Cache Product URL: http://www.intersystems.com/cache/index.html Vendor: Intersystems Affected Versions: Tested on Cache for Windows x86-64 & i386 2009. thru...

D-Link Router 2760N Cross Site Scripting Vulnerability

D-Link Router 2760N suffers from multiple persistent and reflective cross site scripting vulnerabilities. Advisory: D-Link Router 2760N DSL-2760U-BN Multiple XSS Author: Liad Mizrachi Vendor URL: http://www.dlink.com Status: Fixed CVE-ID: CVE-2013-5223 ========================== Vulnerability...

D-Link Router 2760N Cross Site Scripting

Advisory: D-Link Router 2760N DSL-2760U-BN Multiple XSS Author: Liad Mizrachi Vendor URL: http://www.dlink.com Status: Fixed CVE-ID: CVE-2013-5223 ========================== Vulnerability Description ========================== Multiple Cross-Site Scripting XSS vulnerabilities present in D-Link...

McAfee Email Gateway Appliance 7.x Multiple Vulnerabilities (SB10037)

According to the version of the Web UI on the remote McAfee Email Gateway appliance, it is potentially affected by the following vulnerabilities : - The web mail client does not properly sanitize email attachment names allowing for cross-site scripting. - The web mail client does not properly...

CVE-2013-3782

Unspecified vulnerability in the Secure Global Desktop component in Oracle Virtualization 4.6 prior to 4.63 and 4.7 prior to 4.71 allows remote attackers to affect integrity via unknown vectors related to Web UI...

CVE-2013-3779

Unspecified vulnerability in the Secure Global Desktop component in Oracle Virtualization All 4.6 releases including 4.63 and 4.7 prior to 4.71 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Web UI...

Buffer overflow

Unspecified vulnerability in the Secure Global Desktop component in Oracle Virtualization All 4.6 releases including 4.63 and 4.7 prior to 4.71 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Web UI...

Buffer overflow

Unspecified vulnerability in the Secure Global Desktop component in Oracle Virtualization 4.6 prior to 4.63 and 4.7 prior to 4.71 allows remote attackers to affect integrity via unknown vectors related to Web UI...

CVE-2013-3779

Oracle Secure Global Desktop (Secure Global Desktop component) in Oracle Virtualization, all 4.6 releases (including 4.63) and 4.7 prior to 4.71, has an unspecified remote vulnerability via Web UI that can affect confidentiality, integrity, and availability. The NVD score is CVSSv2 7.5 (HIGH). No...

CVE-2013-3782

Unspecified vulnerability in the Secure Global Desktop component in Oracle Virtualization 4.6 prior to 4.63 and 4.7 prior to 4.71 allows remote attackers to affect integrity via unknown vectors related to Web UI...

CVE-2013-3779

Unspecified vulnerability in the Secure Global Desktop component in Oracle Virtualization All 4.6 releases including 4.63 and 4.7 prior to 4.71 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Web UI...

CVE-2013-3782

CVE-2013-3782 concerns the Secure Global Desktop component in Oracle Virtualization, affected in 4.6 before 4.63 and 4.7 before 4.71. The vulnerability allows remote attackers to affect integrity via unknown vectors related to the Web UI; root cause and exact exploit details are not specified in ...

[CVE-2013-2612] Huawei E587 3G Mobile Hotspot Command Injection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2013-2612 Huawei E587 3G Mobile Hotspot Command Injection Summary: Huawei E587 3G Mobile Hotspot, version 11.203.27, is prone to a command injection vulnerability in the Web UI. Successful exploitation allows unauthenticated attackers to execute...

Huawei E587 3G Mobile Hotspot Web UI Cross Site Scripting vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Huawei E587 3G Mobile Hotspot Web UI Cross Site Scripting vulnerability Summary: Huawei E587 3G Mobile Hotspot, version 11.203.27, is prone to a XSS vulnerability in the Web UI. A specialy crafted SMS can bypass the function used to sanitize incoming...

Huawei E587 3G Mobile Hotspot Command Injection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2013-2612 Huawei E587 3G Mobile Hotspot Command Injection Summary: Huawei E587 3G Mobile Hotspot, version 11.203.27, is prone to a command injection vulnerability in the Web UI. Successful exploitation allows unauthenticated attackers to execute...

Fedora 17 : roundcubemail-0.8.6-1.fc17 (2013-4536)

Fix for local file inclusion via web UI modification of certain config options. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...