PT-2018-18148 · Openvpn +3 · Openvpn +3

Name of the Vulnerable Software and Affected Versions: OpenVPN versions through 2.4.5 Description: A cross-protocol scripting issue was discovered in the management interface of OpenVPN. When this interface is enabled over TCP without a password and no other clients are connected, attackers can...

Mobile's customized "Magic Box" smart set-top box has smart hardware vulnerabilities

Smart Set Top Box is a set top box product from ZTE Corporation. A smart hardware vulnerability exists in the mobile customized "Magic Box" smart set-top box. An attacker can use the vulnerability to communicate with the device using a ttl line, log in to the operating system without password...

PT-2018-5455

Name of the Vulnerable Software and Affected Versions: Moxa SoftCMS Live Viewer versions 1.6 and earlier Description: A SQL Injection issue has been discovered, allowing attackers to exploit an improper neutralization of special elements used in an SQL command. This enables access to SoftCMS...

Moxa SoftCMS Live Viewer SQL Injection Vulnerability

Moxa SoftCMS Live Viewer is a video surveillance software designed for industrial automation systems. A SQL injection vulnerability exists in Moxa SoftCMS Live Viewer 1.6 and earlier versions, which can be exploited by an attacker to access SoftCMS without knowing the user's password...

CVE-2017-10601

A specific device configuration can result in a commit failure condition. When this occurs, a user is logged in without being prompted for a password while trying to login through console, ssh, ftp, telnet or su, etc., This issue relies upon a device configuration precondition to occur. Typically...

(0Day) Schneider Electric U.motion Builder Local Privilege Escalation Vulnerability

This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Schneider Electric U.motion Builder. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of the system configuration. The web administration account is s...

Get User without Password and User which have an PW and days since last Password change

This plugin uses SSH to get User without Password and User which have an PW and days since last Password change. If the testuser have no access to /etc/shadow an KB entry will set. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and a...

TPO Duyuru Insecure Cookie Handling

Discovered by : Septemb0x + Script Name : TPO Duyuru Scripti + Download Script : http://phpexplorer.com/Goster/980 + Bug Description : Can be accessed without password Exploit Code : javascript:document.cookie = "kullanici=; path=/"; Enter to http://target/path/duyuruyonetim.php + Greetz :...

Mandriva Update for kdebase MDKSA-2007:190 (kdebase)

Check for the Version of kdebase OpenVAS Vulnerability Test Mandriva Update for kdebase MDKSA-2007:190 kdebase Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it unde...

KDE kdm privilege escalation

It's possible to login without password under certain circumstances...

Debian DSA-1376-1 : kdebase - programming error

iKees Huijgen discovered that under certain circumstances KDM, an X session manager for KDE, could be tricked into allowing user logins without a password. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Securi...

nabopoll 1.1.2 sensitive file (admin without password)

nabopoll 1.1.2 sensitive file admin without password By : sn0oPy Risk : high site : http://nabocorp.com/ Dork : inurl:"nabopoll/" exploit : acces without password to : http://target/nabopoll/admin/configedit.php http://target/nabopoll/admin/templateedit.php...

Vulnerability in Helpdesk software Hesk 0.92

By The Name Of Allah Vulnerability in Helpdesk software Hesk .. Vulnerability Type : Login into The Administrator Menu With out Password Injected version : Helpdesk software Hesk 0.92 Vulnerability Example http://www.springporttwppd.com/helpdesk/ add : admin.php...

Microsoft ActiveSync multiple vulnerabilities

During synchronization with broadcast media LAN or Wi-Fi all data, including authentication is sent cleartext and it's possible to spoof client or server. It's possible to access device without password, DoS...

phpMyFamily <= 1.4.0 Admin Bypass SQL Injection

Exploit for unknown platform in category web applications =============================================== phpMyFamily = 1.4.0 Admin Bypass SQL Injection =============================================== Tested with version 1.2.5 /str0ke Login as admin without pass: Login: "' OR 'a'='a' AND...

CVE-2003-0174: Origin Validation Error

The LDAP name service nsd in IRIX 6.5.19 and earlier does not properly verify if the USERPASSWORD attribute has been provided by an LDAP server, which could allow attackers to log in without a password...