CVE-2015-2904

Actiontec GT784WN modems with firmware before NCS01-1.0.13 have hardcoded credentials, which makes it easier for remote attackers to obtain root access by connecting to the web administration interface...

EMC Isilon OneFS code execution

Command injection in web administration...

ESA-2015-112: EMC Isilon OneFS Command Injection Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2015-112: EMC Isilon OneFS Command Injection Vulnerability EMC Identifier: ESA-2015-112 CVE Identifier: CVE-2015-4525 Severity Rating: CVSS v2 Base Score: 9.0 AV:N/AC:L/Au:S/C:C/I:C/A:C Affected products: • EMC Isilon OneFS 7.2.0.0 - 7.2.0.1 • EMC...

IBM Tivoli Security Directory Server Security Bypass Vulnerability

IBM Tivoli Security Directory Server now known as IBM Security Directory Server, ISDS is a suite of enterprise identity management software from IBM in the United States that uses the Lightweight Directory Access Protocol LDAP. The software provides a trusted identity data infrastructure for...

CVE-2015-1974

The web administration tool in IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 allows remote authenticated users to bypass intended command restrictions via unspecified vectors...

[SECURITY] Fedora 20 Update: phpMyAdmin-4.4.6.1-1.fc20

phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL over the World Wide Web. Most frequently used operations are supported by the user interface managing databases, tables, fields, relations, index es, users, permissions, while you still have the ability to directly...

CVE-2015-0726

CVE-2015-0726 affects Cisco Wireless LAN Controller (WLC) web administration interfaces. Affected releases include before 7.0.241, 7.1.x–7.4.x before 7.4.122, and 7.5.x–7.6.x before 7.6.120. The issue is caused by improper validation of certain form parameters, enabling an authenticated, remote a...

Cisco Wireless LAN Controller Web Administration Interface Authenticated Remote Denial of Service Vulnerability

A vulnerability in the web administration interface of Cisco Wireless LAN Controllers WLC could allow an authenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper validation of certain parameters submitted as part of form...

[SECURITY] Fedora 22 Update: mailman-2.1.20-1.fc22

Mailman is software to help manage email discussion lists, much like Majordomo and Smartmail. Unlike most similar products, Mailman gives each mailing list a webpage, and allows users to subscribe, unsubscribe, etc. over the Web. Even the list manager can administer his or her list entirely from...

Barracuda Firmware 5.0.0.012 - (Authenticated) Remote Command Execution (Metasploit)

Barracuda Firmware 5.0.0.012 - Authenticated Remote Command Execution Metasploit Exploit Title: Barracuda Firmware 'Barracuda Firmware %q This module exploits a remote command execution vulnerability in the Barracuda Firmware Version 'xort', metasploit module , 'Version' = '$Revision: 12345 $',...

Barracuda Firmware 5.0.0.012 Post-Auth Remote Root

Exploit Title: Barracuda Firmware 'Barracuda Firmware %q This module exploits a remote command execution vulnerability in the Barracuda Firmware Version 'xort', metasploit module , 'Version' = '$Revision: 12345 $', 'References' = 'none', 'none', , 'Platform' = 'linux', 'Privileged' = true, 'Arch'...

Barracuda Firmware <= 5.0.0.012 reporting Post Auth Remote Root Exploit

This Metasploit module exploits a remote command execution vulnerability in Barracuda Firmware versions 5.0.0.012 and below by exploiting a vulnerability in the web administration interface. By sending a specially crafted request it's possible to inject system commands while escalating to root do...

ManageEngine NetFlow Analyzer Default Credentials

The remote ManageEngine NetFlow Analyzer web administration interface uses a known set of default credentials. An attacker can use these to gain access to the system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

[SECURITY] Fedora 20 Update: phpMyAdmin-4.3.11.1-1.fc20

phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL over the World Wide Web. Most frequently used operations are supported by the user interface managing databases, tables, fields, relations, index es, users, permissions, while you still have the ability to directly...

Symantec Data Center Security Web Administration Interface Detection

Binary data symantecdcswebinterfacedetect.nbin...

ovirt-engine-webadmin: does not invalidate all sessions upon logout

It was found that oVirt did not correctly terminate sessions when a user logged out from the web interface. Upon logout, only the engine session was invalidated but the restapi session persisted. An attacker able to obtain the session data, and able to log in with their own credentials, could...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the web based administration console in Apache ActiveMQ 5.x before 5.10.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Fortinet FortiWeb CSRF Vulnerability (FG-IR-14-013)

Fortinet FortiWeb is prone to multiple cross-site request forgery CSRF vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2015-1444

Multiple cross-site scripting XSS vulnerabilities in the web administration frontend in the httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30 allow remote attackers to inject arbitrary web script or HTML via the 1 conntrack.cgi, 2 index.cgi, 3 logsyslog.cgi, 4 problems.cgi, 5...

ManageEngine Password Manager Pro Default Credentials

The remote ManageEngine Password Manager Pro web administration interface uses a known set of default credentials. An attacker can use these to gain access to the remote host. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if descriptio...