CVE-2016-9738

IBM QRadar 7.2 and 7.3 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 119783...

CVE-2016-6093

IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts...

CVE-2017-1196

IBM BigFix Compliance TEMA SUAv1 SCA SCM 1.9.70 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 123671...

ManageEngine ServiceDesk Plus 9.0 Authentication Bypass

Title: ManageEngine ServiceDesk Plus Application Compromise Date: 19 May 2017 Researcher: Steven Lackey ByteM3 Product: ServiceDesk Plus http://www.manageengine.com/ Affected Version: 9.0 Other versions could also be affected Fixed Version: Service Pack 9241 a Build 9.2 Vulnerability Impact: High...

ManageEngine ServiceDesk Plus 9.0 - Authentication Bypass

ManageEngine ServiceDesk Plus 9.0 - Authentication Bypass Title: ManageEngine ServiceDesk Plus Application Compromise Date: 19 May 2017 Researcher: Steven Lackey ByteM3 Product: ServiceDesk Plus http://www.manageengine.com/ Affected Version: 9.0 Other versions could also be affected Fixed Version...

Multiple Hikvision Cameras Incorrect Authentication Vulnerability

Hikvision Cameras is a camera made by Hikvision. An incorrect authentication vulnerability exists in multiple Hikvision Cameras. An attacker could exploit this vulnerability to obtain sensitive information, bypass authentication mechanisms, and compromise a user's account...

Google Shuts Down Docs Phishing Spree

Google said it has disabled offending accounts involved in a widespread spree of phishing emails today impersonating Google Docs. The emails, at the outset, targeted journalists primarily and attempted to trick victims into granting the malicious application permission to access the user’s Google...

Weblate: Rate Limit Bypass on login Page

Hi, Your web authentication endpoint, https://demo.weblate.org/accounts/login/ POST, currently protects against credentials brute-force attacks only by requests rate-limiting based on IP. It was found that if an attacker sends login requests faster than every 4 seconds from the same IP address, i...

CVE-2016-8962

IBM BigFix Inventory 9.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 118851...

Panda Car Android APP has arbitrary cell phone number login vulnerability

Panda Car Android APP is a car sharing software. The Panda Car Android APP suffers from an arbitrary cell phone number login vulnerability. The vulnerability allows an attacker to log in to another person's account using only their cell phone number...

Mail.ru: Stored XSS in e.mail.ru (payload affect multiple users)

Hi, We have found a high risk level STORED XSS in e.mail.ru chat, the status change function allow to inject malicious payload in javascript & HTML, The attack affect multiple users and run in auto mode, no need a user interaction. Vulnerability affect any user that have been invited to your chat...

CVE-2016-5786

An issue was discovered in OmniMetrix OmniView, Version 1.2. The OmniView web application transmits credentials with the HTTP protocol, which could be sniffed by an attacker that may result in the compromise of account credentials...

CVE-2016-6616

An issue was discovered in phpMyAdmin. In the "User group" and "Designer" features, a user can execute an SQL injection attack against the account of the control user. All 4.6.x versions prior to 4.6.4 and 4.4.x versions prior to 4.4.15.8 are affected...

InVision: CORS Man-in-the-Middle account compromise

Description ==================== The invisionapp application implements HTTPS correctly by redirecting any HTTP traffic to HTTPS; this prevents, for example, the person sitting in the same office or home as you, or someone on the same open-wireless network as you e.g. McDonalds or airport, from...

OLX: Reflected XSS in OLX.in

Hello @olx I found the Reflected XSS in olx.in Mobile Site through which malicious javascript code can be executed Affected Parameter: searchcityid=xxxxxx POC: ====== Opening This URL will Popup a Alert Box Having "XSS" as Msg Screenshot Added in Attachments...

Phabricator: link reset problem

Hello, i found out about an issue in your password reset links and their expiration Steps to reproduce: Request a password reset link to an account Login to the account afterwards Logout and use the link to reset the password The link would not be expired Now i know that the links need to expire...

Gratipay: Reset Link Issue

Hello, i found out about an issue in your password reset links and their expiration Steps to reproduce: Request a password reset link to an account Login to the account afterwards Logout and use the link to reset the password The link would not be expired Now i know that the links need to expire...

Windows A high-risk vulnerability allows a hacker in the user access to phishing pages to steal their Microsoft account and related services-vulnerability warning-the black bar safety net

! In all Windows System are the presence of a security may cause the user to visit a phishing site case leaked their Microsoft account user name, password, and Microsoft account binding and is associated with a large number of important business, this information will also be affected Including:...

OLX: CSRF in account configuration leads to complete account compromise

Hello, Although listed as out of scope, this vulnerability presents serious risk that can compromise any account, and hope you consider it as such. When updating a user in the configuration tab, there is no CSRF token to prevent other pages from updating the user. This allows any third party site...

51 Million iMesh Accounts Available on Black Market

LeakedSource, an aggregator of data stolen in breaches, is advertising the availability of the account information of 51 million users of the now defunct iMesh peer-to-peer file-sharing music service. According to LeakedSource, the data is from a 2013 breach and includes email addresses, username...