9092 matches found
CVE-2020-13858
An issue was discovered on Mofi Network MOFI4500-4GXeLTE 3.6.1-std and 4.0.8-std devices. They contain two undocumented administrator accounts. The sftp and mofidev accounts are defined in /etc/passwd and the password is not unique across installations...
Design/Logic Flaw
An issue was discovered on Mofi Network MOFI4500-4GXeLTE 3.6.1-std and 4.0.8-std devices. They contain two undocumented administrator accounts. The sftp and mofidev accounts are defined in /etc/passwd and the password is not unique across installations...
CVE-2020-13858
CVE-2020-13858 affects Mofi Network MOFI4500-4GXeLTE devices running 3.6.1-std and 4.0.8-std. The issue stems from two undocumented administrator accounts (sftp and mofidev) defined in /etc/passwd, with passwords not unique across installations. This creates potential unauthorized access risk to ...
CVE-2020-13858
An issue was discovered on Mofi Network MOFI4500-4GXeLTE 3.6.1-std and 4.0.8-std devices. They contain two undocumented administrator accounts. The sftp and mofidev accounts are defined in /etc/passwd and the password is not unique across installations...
Mofi Network MOFI4500-4GXeLTE Trust Management Issues Vulnerability
The Mofi Network MOFI4500-4GXeLTE is a wireless router from Mofi Network. A security vulnerability exists in the Mofi Network MOFI4500-4GXeLTE 3.6.1-std and 4.0.8-std devices, which stems from the inclusion of two unarchived administrator accounts. sftp and mofidev accounts are defined in the etc...
ZINC attacks against security researchers
In recent months, Microsoft has detected cyberattacks targeting security researchers by an actor we track as ZINC. The campaign originally came to our attention after Microsoft Defender for Endpoint detected an attack in progress. Observed targeting includes pen testers, private offensive securit...
New Relic: Account Takeover via Email ID Change and Forgot Password Functionality
@dsdh discovered an issue with the email change flow, where emails would be sent to the new email address prior to that address being verified. An attacker could have abused this issue to access vulnerable user accounts...
International Action Targets Emotet Crimeware
Authorities across Europe on Tuesday said theyd seized control over Emotet, a prolific malware strain and cybercrime-as-service operation. Investigators say the action could help quarantine more than a million Microsoft Windows systems currently compromised with malware tied to Emotet infections...
Vulnerabilities fixed in Xerox WorkCentre
Xerox has fixed a number of vulnerabilities in Xerox WorkCentre multifunction printers. Passwords, which are stored on the multifunctional are better encrypted, system accounts have been made visible and manageable, and the ability to use the included McAfee Embedded Control has been removed. One...
CVE-2021-22871
Revive Adserver before 5.1.0 permits any user with a manager account to store possibly malicious content in the URL website property, which is then displayed unsanitized in the affiliate-preview.php tag generation screen, leading to a persistent cross-site scripting XSS vulnerability...
Are TikTok’s new settings enough to keep kids safe?
TikTok, the now widely popular social media platform that allows users to create, share, and discover, amateur short clips—usually something akin to music videos—has been enjoying explosive growth since it appeared in 2017. Since then, it hasn’t stopped growing—more so during the current pandemic...
The vulnerability of the TrueConf Server software, related to deficiencies in the token management mechanism for user accounts, allows a hacker to gain access to the user account.
The vulnerability of the TrueConf Server software is related to deficiencies in the mechanism for managing user tokens. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to the TrueConf Server under a user’s identity...
Using Zero Trust principles to protect against sophisticated attacks like Solorigate
The Solorigate supply chain attack has captured the focus of the world over the last month. This attack was simultaneously sophisticated and ordinary. The actor demonstrated sophistication in the breadth of tactics used to penetrate, expand across, and persist in affected infrastructure, but many...
PT-2023-12545 · Odoo +1 · Odoo Community +2
Name of the Vulnerable Software and Affected Versions: Odoo Community versions 13.0 and earlier Odoo Enterprise versions 13.0 and earlier Description: The issue is related to improper access control, allowing users with deactivated accounts to access the system using their deactivated account and...
CVE-2020-6776 CSRF in Bosch PRAESIDEO and Bosch PRAESENSA Management Interface
A vulnerability in the web-based management interface of Bosch PRAESIDEO until and including version 4.41 and Bosch PRAESENSA until and including version 1.10 allows an unauthenticated remote attacker to trigger actions on an affected system on behalf of another user Cross-Site Request Forgery...
Dell EMC PowerStore Access Control Error Vulnerability
The Dell EMC PowerStore is a storage device from Dell USA. A security vulnerability exists in Dell EMC PowerStore version 1.0.3.0.5.007 and earlier versions, which can be exploited by an attacker to gain access to compromised applications with privileges of the compromised account using publicly...
SolarWinds Hackers Also Accessed U.S. Justice Department's Email Server
The U.S. Department of Justice on Wednesday became the latest government agency in the country to admit its internal network was compromised as part of the SolarWinds supply chain attack. "On December 24, 2020, the Department of Justice's Office of the Chief Information Officer OCIO learned of...
Making browsing safe from phishing
Privacy, Security Making browsing safe from phishing Share January 7th, 2021 Mallory tries to create a phishing site to lure Alice into revealing her secrets. TL;DR: skip to the conclusions to see what Alice learned. The Privacy Problem In the previous episode, Mallory was thinking about...
