RICOH SP 4510SF Printer - HTML Injection

Exploit Title: RICOH SP 4510SF Printer - HTML Injection Date: 2019-05-06 Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.ricoh.com/ Hardware Link: http://support.ricoh.com/bb/html/drute/re1/model/sp4510/sp4510.htm Software: RICOH Printer Product Version: SP 4510SF Vulernability Type:...

AVE DOMINAplus 1.10.x - Unauthenticated Remote Reboot

AVE DOMINAplus 1.10.x - Unauthenticated Remote Reboot Exploit: AVE DOMINAplus 1.10.x - Unauthenticated Remote Reboot Date: 2019-12-30 Author: LiquidWorm Vendor: AVE S.p.A. Product web page: https://www.ave.it | https://www.domoticaplus.it Affected version: Web Server Code 53AB-WBS - 1.10.62...

RICOH SP 4510SF Printer - HTML Injection

RICOH SP 4510SF Printer - HTML Injection Exploit Title: RICOH SP 4510SF Printer - HTML Injection Date: 2019-05-06 Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.ricoh.com/ Hardware Link: http://support.ricoh.com/bb/html/drute/re1/model/sp4510/sp4510.htm Software: RICOH Printer Produ...

CVE-2019-20047

An issue was discovered on Alcatel-Lucent OmniVista 4760 devices, and 8770 devices before 4.1.2. An incorrect web server configuration allows a remote unauthenticated attacker to retrieve the content of its own session files. Every session file contains the administrative LDAP credentials encoded...

CVE-2019-20047

An issue was discovered on Alcatel-Lucent OmniVista 4760 devices, and 8770 devices before 4.1.2. An incorrect web server configuration allows a remote unauthenticated attacker to retrieve the content of its own session files. Every session file contains the administrative LDAP credentials encoded...

CVE-2019-20047

The CVE-2019-20047 issue affects Alcatel-Lucent OmniVista 4760 and OmniVista 8770 prior to version 4.1.2. A misconfigured web server allows a remote unauthenticated attacker to retrieve the contents of its own session files located under /sessions/sess_. Each session file contains administrative ...

CVE-2019-20047

An issue was discovered on Alcatel-Lucent OmniVista 4760 devices, and 8770 devices before 4.1.2. An incorrect web server configuration allows a remote unauthenticated attacker to retrieve the content of its own session files. Every session file contains the administrative LDAP credentials encoded...

AVE DOMINAplus 1.10.x Unauthenticated Remote Reboot Vulnerability

AVE DOMINAplus =1.10.x Unauthenticated Remote Reboot Vendor: AVE S.p.A. Product web page: https://www.ave.it | https://www.domoticaplus.it Affected version: Web Server Code 53AB-WBS - 1.10.62 Touch Screen Code TS01 - 1.0.65 Touch Screen Code TS03x-V | TS04X-V - 1.10.45a Touch Screen Code TS05 -...

AVE DOMINAplus 1.10.x Authentication Bypass Vulnerability

AVE DOMINAplus =1.10.x Authentication Bypass Exploit Vendor: AVE S.p.A. Product web page: https://www.ave.it | https://www.domoticaplus.it Affected version: Web Server Code 53AB-WBS - 1.10.62 Touch Screen Code TS01 - 1.0.65 Touch Screen Code TS03x-V | TS04X-V - 1.10.45a Touch Screen Code TS05 -...

Waitress Environment Issue Vulnerability

Waitress is a WSGI Web Server Gateway Interface server for Python. An environmental issue vulnerability exists in Waitress 1.4.0 and earlier versions. The vulnerability stems from an unreasonable environmental factor in a networked system or product. An attacker could exploit this vulnerability t...

AVE DOMINAplus 1.10.x Cross Site Request Forgery / Cross Site Scripting

AVE DOMINAplus =1.10.x CSRF/XSS Vulnerabilities Vendor: AVE S.p.A. Product web page: https://www.ave.it | https://www.domoticaplus.it Affected version: Web Server Code 53AB-WBS - 1.10.62 Touch Screen Code TS01 - 1.0.65 Touch Screen Code TS03x-V | TS04X-V - 1.10.45a Touch Screen Code TS05 - 1.10.3...

AVE DOMINAplus 1.10.x Credential Disclosure Exploit

!/usr/bin/env python AVE DOMINAplus =1.10.x Credentials Disclosure Exploit Vendor: AVE S.p.A. Product web page: https://www.ave.it | https://www.domoticaplus.it Affected version: Web Server Code 53AB-WBS - 1.10.62 Touch Screen Code TS01 - 1.0.65 Touch Screen Code TS03x-V | TS04X-V - 1.10.45a Touc...

AVE DOMINAplus <=1.10.x CSRF/XSS Vulnerabilities

Summary DOMINAplus - Sistema Domotica Avanzato. Advanced Home Automation System. Designed to revolutionize your concept of living. DOMINA plus is the AVE home automation proposal that makes houses safer, more welcoming and optimized. In fact, our home automation system introduces cutting-edge...

SQL Injection Bypass Vulnerability in D-Shield Firewalls

D Shield Firewall is a free IIS firewall software, this software protects websites and servers from intrusion. D Shield Firewall suffers from a SQL injection bypass vulnerability. An attacker can exploit the vulnerability to gain access to sensitive database information...

Unauthorized access vulnerability in geoserver

GeoServer is a J2EE implementation of the OpenGIS Web Server specification. GeoServer makes it easy to publish map data, allows users to update, delete and insert feature data, and makes it easy to share spatial geographic information between users. There is an unauthorized access vulnerability i...

Waitress Environmental Vulnerability (CNVD-2020-01313)

Waitress is a WSGI Web Server Gateway Interface server for Python. An environmental issue vulnerability exists in Waitress 1.3.1 and earlier versions. The vulnerability stems from an unreasonable environmental factor in a networked system or product. No detailed vulnerability details are provided...

Waitress Environmental Vulnerabilities (CNVD-2020-01314)

Waitress is a WSGI Web Server Gateway Interface server for Python. An environmental issue vulnerability exists in Waitress 1.3.1 and earlier versions. The vulnerability stems from an unreasonable environmental factor in a networked system or product. No detailed vulnerability details are provided...

File Containment Vulnerability in Huake Network Enterprise Management System

Huake Enterprise Management System is an intelligent website builder based on PHP+MySQL, with only one set of templates, 3 channel models + 1 detail model, and no duration of use or functionality limitations. Huake Network Enterprise Management System has a file inclusion vulnerability, which can...

UBUNTU-CVE-2019-16785

Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a line terminator and ignore any preceding CR." Unfortunately if a front-end serve...

Reliable Controls MACH-ProWebCom/Sys Cross-Site Scripting Vulnerability

The Reliable Controls MACH-ProWebCom/Sys is a building controller from Canada's Reliable Controls that supports custom programming and has a built-in web server. A cross-site scripting vulnerability exists in Reliable Controls MACH-ProWebCom/Sys, which can be exploited by an attacker to execute...