4688 matches found
Hardcoded credentials
Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 have a hardcoded password of admin for the admin account, which makes it easier for remote attackers to obtain access via the web management interface...
CVE-2016-5670
Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 have a hardcoded password of admin for the admin account, which makes it easier for remote attackers to obtain access via the web management interface...
Crestron Electronics DM-TXRX-100-STR Hardcoded Password Vulnerability
The Crestron Electronics DM-TXRX-100-STR is a multimedia streaming codec. The Crestron Electronics DM-TXRX-100-STR 1.3039.00040 has a hard-coded password for the admin account. This could allow a remote attacker to gain access through the web management interface...
SQL Injection Vulnerability in VNet Series WEB Management System of Guangzhou Zhonghaida Satellite Navigation Technology Co.
Vnet series receivers are high precision GNSS system products tailored by COSCO for monitoring applications. SQL injection vulnerability exists in the VNet series WEB management system of Guangzhou Zhonghaida Satellite Navigation Technology Co., Ltd, which can be exploited by attackers to obtain...
CVE-2016-3481
Unspecified vulnerability in the ILOM component in Oracle Sun Systems Products Suite 3.0, 3.1, and 3.2 allows remote authenticated users to affect availability via vectors related to Web...
Cisco Meeting Server Cross-Site Scripting Vulnerability
Cisco Meeting Server formerly known as Acano Conferencing Server is the United States Cisco Cisco company's set of audio and video conferencing server software. A cross-site scripting vulnerability exists in the Web-based management interface of Cisco Meeting Server version 1.7 to 1.9. A remote...
CVE-2016-1451
Cross-site scripting XSS vulnerability in the web-based management interface in Cisco Meeting Server formerly Acano Conferencing Server 1.7 through 1.9 allows remote attackers to inject arbitrary web script or HTML via crafted parameters, aka Bug ID CSCva19922...
SQL Injection Vulnerability in Hohhot's Web Management System
HaoHui Enterprise Management SystemHaoHui Enterprise Management System is an enterprise management system for small and medium-sized enterprises in China. A SQL injection vulnerability exists in the Hohui Technology Website Management System. It allows attackers to utilize commonly used SQL...
Schneider Electric PowerLogic PM8ECC 模块未授权访问漏洞
PowerLogic PM8ECC是800 PowerMeter系列设备的通讯模块。根据施耐德电气描述, PowerLogic PM8ECC部署于商业设施部门并已在全世界广泛使用。 漏洞描述： 1.访问/status.htm页面。在没登录的情况下发现“User”处有一字符串； 2.以该字符串作为用户名和密码即可登录该设备的Web管理界面和FTP（如有），虽然用户列表中无该用户。...
Centreon Remote Code Execution Vulnerability
Merethis Centreon is an open source IT monitoring software from Merethis France that needs to be paired with Nagios to manage Nagios via the web web and to enable monitoring of networks, operating systems and applications via third-party components. A remote code execution vulnerability exists in...
Cisco Wireless LAN Controller Web Management Interface Denial of Service Vulnerability
The Cisco WLC is responsible for system-wide wireless LAN functions such as security policy, intrusion protection, RF management, quality of service, and mobility. A denial of service vulnerability in the Web management interface of the Cisco Wireless LAN Controller WLC Software could allow an...
The vulnerability of the microprogramming software of the Medialink MWN-WARP300N router allows a hacker to enhance their privileges.
The vulnerability of the web-management interface of the Medialink MWN-WARP300N router software relates to the use of default passwords for user accounts. Exploiting this vulnerability could allow an attacker to gain increased privileges by utilizing Wi-Fi sessions...
IBM Tivoli Directory Server and Security Directory Server Command Execution Vulnerability
IBM Tivoli Directory Server is a suite of enterprise identity management software that uses the Lightweight Directory Access Protocol LDAP. A security vulnerability exists in the IBM Tivoli Directory Server and Security Directory Server web management tools. An attacker could exploit the...
PLANET Technology IP Surveillance Cameras - Multiple Vulnerabilities
PLANET Technology IP Surveillance Cameras - Multiple Vulnerabilities | | | | | | | | | | | | / | '\ \ /\ / / \ | | |/ | ' / | | | | \ V V / / | | | | | | \ \ /|| // ||||,|./|/ Security Adivisory 2016-04-06 www.orwelllabs.com Twitter:@orwelllabs mantra: ...not affect a product that is in...
Apache ActiveMQ Web Console Cross-Site Scripting Vulnerability
Apache ActiveMQ is a popular messaging and integration model provider . Apache ActiveMQ 5.0.0 - 5.13.1 Multiple cross-site scripting vulnerabilities exist in the Web Management Console and in Java memory dumps due to incorrect user data output validation and improper privilege settings within...
Ubiquiti Inc.: Unauthenticated Cross-Site Scripting in Web Management Console
The researcher demonstrated that an attacker could exploit an XSS vulnerability on airOS devices by luring a user to attacker-controlled website. For the exploit to work, there must be no previous visits to the device from the same browser no cookies stored for the device. Fixes have been release...
Ubiquiti Inc.: Shell Injection via Web Management Console (dl-fw.cgi)
NCC Group Security Advisory https://www.nccgroup.trust -------------------------------------------- Shell Injection via Web Management Console Vendor: Ubiquiti Networks Vendor URL: https://www.ubnt.com Versions affected: airOS XM board line potentially all airOS lines, unverified Systems Affected...
PLANET IP ICA-5350V LFI / XSS / CSRF / Bypass
Overview ======= Technical Risk: high Likelihood of Exploitation: medium Tested version: ICA-5350V/ICA- Credits: Discovered and researched by GT.Omaz from OrwellLabs Issues ===== I. Local File Inclusion II. Arbitrary file read/Authentication bypass III. Sensitive information disclosure IV...
D-Link DVGN5402SP - Multiple Vulnerabilities
Exploit Title: DLink DVGN5402SP Multiple Vulnerabilities Discovered by: Karn Ganeshen Vendor Homepage: www.dlink.com/ Versions Reported: Multiple - See below CVE-IDs: CVE-2015-7245 + CVE-2015-7246 + CVE-2015-7247 DLink DVGN5402SP File Path Traversal, Weak Credentials Management, and Sensitive...
Cisco Small Business SG300 Denial of Service Vulnerability
Cisco Small Business SG300 is the SG300 series of smart switch products from Cisco. A security vulnerability in the web-management GUI implementation of the Cisco Small Business SG300 allows remote attackers to conduct denial-of-service attacks by sending specially crafted HTTPS requests...