Net-creds - Sniff passwords and hashes from an interface or pcap file

Thoroughly sniff passwords and hashes from an interface or pcap file. Concatenates fragmented packets and does not rely on ports for service identification. Sniffs URLs visited POST loads sent HTTP form logins/passwords HTTP basic auth logins/passwords HTTP searches FTP logins/passwords IRC...

PT-2015-5883

Name of the Vulnerable Software and Affected Versions Websense TRITON AP-EMAIL versions prior to 8.0.0 Description The issue concerns multiple cross-site request forgery CSRF vulnerabilities in the Personal Email Manager PEM component. These vulnerabilities allow remote attackers to hijack the...

kernel: net: slab corruption from use after free on INIT collisions

A use-after-free flaw was found in the way the Linux kernel's SCTP implementation handled authentication key reference counting during INIT collisions. A remote attacker could use this flaw to crash the system or, potentially, escalate their privileges on the system...

KLA10497 Security bypass vulnerability in IBM Rational ClearQuest

Cross site reference forgery was found in IBM Rational ClearQuest. By exploiting this vulnerability malicious users can bypass security restrictions. This vulnerability can be exploited remotely via a auth hijack. Original advisories - Exploitation Related products IBM-Rational-ClearQuest CVE lis...

Smart PHP Poll - Auth Bypass Vulnerability

Exploit for php platform in category web applications Exploit Title: Smart PHP Poll Auth Bypass Vulnerability Google Dork: Copyright Smart PHP Poll. All Rights Reserved. Exploit Author: Mr.tro0oqy from Yemen Email : email protected Download Script...

ipa security, bug fix, and enhancement update

4.1.0-18.0.1 - Replace login-screen-logo.png 20362818 - Drop subscription-manager requires for OL7 - Drop redhat-access-plugin-ipa requires for OL7 - Blank out header-logo.png product-name.png 4.1.0-18 - Fix ipa-pwd-extop global configuration caching 1187342 - group-detach does not add correct...

Apple iOS 8.0 - 8.0.2 - Controls Re Auth Bypass Vulnerability

Document Title: =============== Apple iOS 8.0 - 8.0.2 - Controls Re Auth Bypass Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1322 Video: http://www.vulnerability-lab.com/getcontent.php?id=1334 Release Date: ============= 2015-03-02...

Apple iOS 8.x - Local Controls Re Auth Bypass Vulnerability

Document Title: =============== Apple iOS 8.x - Local Controls Re Auth Bypass Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1334 View: https://www.youtube.com/watch?v=H3lefsmqO4o Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1322 Release...

Apple iOS 8.x - Local Controls Re Auth Bypass Vulnerability

Document Title: =============== Apple iOS 8.x - Local Controls Re Auth Bypass Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1334 View: https://www.youtube.com/watch?v=H3lefsmqO4o Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1322 Release...

Apple iOS 8.0 - 8.0.2 - Controls Re Auth Bypass Vulnerability

Document Title: =============== Apple iOS 8.0 - 8.0.2 - Controls Re Auth Bypass Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1322 Video: http://www.vulnerability-lab.com/getcontent.php?id=1334 Release Date: ============= 2015-03-02...

Red Hat JBoss Enterprise Application Platform Role Based Access Control Component Security Bypass Vulnerability

Red Hat JBoss Enterprise Application Platform is an open source, J2EE-based middleware platform for building, deploying, and hosting Java applications and services.JBoss Application Server AS, also known as WildFly is an open source JavaEE-based application server; the JacORB subsystem is a...

CVE-2015-1580: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Redirection Page plugin 1.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings or conduct cross-site scripting XSS attacks via the 2 source or 3 redir...

CVE-2015-1169

Apereo Central Authentication Service CAS Server before 3.5.3 allows remote attackers to conduct LDAP injection attacks via a crafted username, as demonstrated by using a wildcard and a valid password to bypass LDAP authentication...

CVE-2014-9045: Improper Authentication

The FTP backend in userexternal in ownCloud Server before 5.0.18 and 6.x before 6.0.6 allows remote attackers to bypass intended authentication requirements via a crafted password...

Mobile Vikings: Number, username and name disclosure

when user request a new card he can input some viking's number as a referrer and in order review page he can see viking's username When he add authorization to his own sim, he can use not only email but username and as a result he can get full vikings name in auth list. See attach...

CVE-2015-0385

Unspecified vulnerability in Oracle MySQL Server 5.6.21 and earlier allows remote authenticated users to affect availability via unknown vectors related to Pluggable Auth...

Design/Logic Flaw

Unspecified vulnerability in Oracle MySQL Server 5.6.21 and earlier allows remote authenticated users to affect availability via unknown vectors related to Pluggable Auth...

CVE-2015-0385

Unspecified vulnerability in Oracle MySQL Server 5.6.21 and earlier allows remote authenticated users to affect availability via unknown vectors related to Pluggable Auth...

CVE-2015-0385

CVE-2015-0385 concerns an unspecified vulnerability in Oracle MySQL Server 5.6.21 and earlier, related to Pluggable Auth, that can affect availability. The impact is described as a partial availability loss via unknown vectors with remote authenticated access. Public sources in the connected docu...

PT-2015-4193

Name of the Vulnerable Software and Affected Versions MIT Kerberos 5 versions 1.11.5 and earlier MIT Kerberos 5 versions 1.12.x through 1.12.2 MIT Kerberos 5 versions 1.13.x before 1.13.1 Description The issue is related to the auth gssapi unwrap data function, which does not properly handle...