CVE-2016-6093

IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts...

CVE-2016-6093: Undefined Security Weakness

IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts...

PT-2017-8889

Name of the Vulnerable Software and Affected Versions IBM Tivoli Key Lifecycle Manager affected versions not specified Description The issue is related to the default password requirements. By default, strong passwords are not required, making it easier for attackers to compromise user accounts...

CVE-2017-1196

IBM BigFix Compliance TEMA SUAv1 SCA SCM 1.9.70 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 123671...

CVE-2017-1196: Weak Password Requirements

IBM BigFix Compliance TEMA SUAv1 SCA SCM 1.9.70 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 123671...

PT-2017-12321

Name of the Vulnerable Software and Affected Versions IBM BigFix Compliance TEMA SUAv1 SCA SCM version 1.9.70 Description The issue makes it easier for attackers to compromise user accounts due to a lack of strong password requirements by default. Recommendations For IBM BigFix Compliance TEMA...

ManageEngine ServiceDesk Plus 9.0 Authentication Bypass

Title: ManageEngine ServiceDesk Plus Application Compromise Date: 19 May 2017 Researcher: Steven Lackey ByteM3 Product: ServiceDesk Plus http://www.manageengine.com/ Affected Version: 9.0 Other versions could also be affected Fixed Version: Service Pack 9241 a Build 9.2 Vulnerability Impact: High...

ManageEngine ServiceDesk Plus 9.0 - Authentication Bypass

ManageEngine ServiceDesk Plus 9.0 - Authentication Bypass Title: ManageEngine ServiceDesk Plus Application Compromise Date: 19 May 2017 Researcher: Steven Lackey ByteM3 Product: ServiceDesk Plus http://www.manageengine.com/ Affected Version: 9.0 Other versions could also be affected Fixed Version...

Multiple Hikvision Cameras Incorrect Authentication Vulnerability

Hikvision Cameras is a camera made by Hikvision. An incorrect authentication vulnerability exists in multiple Hikvision Cameras. An attacker could exploit this vulnerability to obtain sensitive information, bypass authentication mechanisms, and compromise a user's account...

Google Shuts Down Docs Phishing Spree

Google said it has disabled offending accounts involved in a widespread spree of phishing emails today impersonating Google Docs. The emails, at the outset, targeted journalists primarily and attempted to trick victims into granting the malicious application permission to access the user’s Google...

Weblate: Rate Limit Bypass on login Page

Hi, Your web authentication endpoint, https://demo.weblate.org/accounts/login/ POST, currently protects against credentials brute-force attacks only by requests rate-limiting based on IP. It was found that if an attacker sends login requests faster than every 4 seconds from the same IP address, i...

CVE-2016-8962

IBM BigFix Inventory 9.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 118851...

CVE-2016-8962: Undefined Security Weakness

IBM BigFix Inventory 9.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 118851...

PT-2017-9901

Name of the Vulnerable Software and Affected Versions IBM BigFix Inventory version 9.2 Description The issue makes it easier for attackers to compromise user accounts due to a lack of strong password requirements by default. Recommendations For IBM BigFix Inventory version 9.2, consider enforcing...

Panda Car Android APP has arbitrary cell phone number login vulnerability

Panda Car Android APP is a car sharing software. The Panda Car Android APP suffers from an arbitrary cell phone number login vulnerability. The vulnerability allows an attacker to log in to another person's account using only their cell phone number...

Mail.ru: Stored XSS in e.mail.ru (payload affect multiple users)

Hi, We have found a high risk level STORED XSS in e.mail.ru chat, the status change function allow to inject malicious payload in javascript & HTML, The attack affect multiple users and run in auto mode, no need a user interaction. Vulnerability affect any user that have been invited to your chat...

CVE-2016-5786

An issue was discovered in OmniMetrix OmniView, Version 1.2. The OmniView web application transmits credentials with the HTTP protocol, which could be sniffed by an attacker that may result in the compromise of account credentials...

CVE-2016-6616

An issue was discovered in phpMyAdmin. In the "User group" and "Designer" features, a user can execute an SQL injection attack against the account of the control user. All 4.6.x versions prior to 4.6.4 and 4.4.x versions prior to 4.4.15.8 are affected...

InVision: CORS Man-in-the-Middle account compromise

Description ==================== The invisionapp application implements HTTPS correctly by redirecting any HTTP traffic to HTTPS; this prevents, for example, the person sitting in the same office or home as you, or someone on the same open-wireless network as you e.g. McDonalds or airport, from...

OLX: Reflected XSS in OLX.in

Hello @olx I found the Reflected XSS in olx.in Mobile Site through which malicious javascript code can be executed Affected Parameter: searchcityid=xxxxxx POC: ====== Opening This URL will Popup a Alert Box Having "XSS" as Msg Screenshot Added in Attachments...