9105 matches found
CVE-2018-13032
ECESSA ShieldLink SL175EHQ devices running in 10.7.4 are affected by a CSRF vulnerability in the cgi-bin/pl_web.cgi/util_configlogin_act endpoint, enabling an attacker to add a superuser account. The issue is documented across multiple sources (NVD/NVDC CNVD) with explicit version 10.7.4 and the ...
CVE-2018-13032
ECESSA ShieldLink SL175EHQ 10.7.4 devices have CSRF to add superuser accounts via the cgi-bin/plweb.cgi/utilconfigloginact URI...
CVE-2018-13002
An XSS issue was discovered in Inhaltsprojekte in Weblication CMS Core & Grid v12.6.24. The vulnerability is located in the wFilemanager.php and index.php files of the /grid5/scripts/ modules. The injection point is located in the Project Title and the execution point occurs in the Inhaltsprojekt...
Design/Logic Flaw
An XSS issue was discovered in Inhaltsprojekte in Weblication CMS Core & Grid v12.6.24. The vulnerability is located in the wFilemanager.php and index.php files of the /grid5/scripts/ modules. The injection point is located in the Project Title and the execution point occurs in the Inhaltsprojekt...
The Rogue Toolkit - An Extensible Toolkit Aimed At Providing Penetration Testers An Easy-To-Use Platform To Deploy Access Points
The Rogue Toolkit is an extensible toolkit aimed at providing penetration testers an easy-to-use platform to deploy software-defined Access Points AP for the purpose of conducting penetration testing and red team engagements. By using Rogue, penetration testers can easily perform targeted evil tw...
Plant Your Flag, Mark Your Territory
Many people, particularly older folks, proudly declare they avoid using the Web to manage various accounts tied to their personal and financial data -- including everything from utilities and mobile phones to retirement benefits and online banking services. The reasoning behind this strategy is a...
Rewards Points Targeted by Teens in Hack of 500K Accounts
A pair of Russian teens have been arrested for infiltrating more than a half-million online accounts, in particular targeting services that offer rewards points. Russian authorities at the Ministry of Internal Affairs said in an announcement Wednesday that the duo came to their attention in late...
Mozilla Announces Firefox Monitor Tool Testing, Firefox 61
Mozilla has made some sweeping security announcements this week: On Monday, the company announced it is testing a new security tool called Firefox Monitor, which the firm said securely checks to see if users’ accounts have been hacked. That news came just as the browser giant released Firefox 61...
CVE-2018-12884
In Octopus Deploy 3.0 onwards before 2018.6.7, an authenticated user with incorrect permissions may be able to create Accounts under the Infrastructure menu...
CVE-2018-12884
In Octopus Deploy 3.0 onwards before 2018.6.7, an authenticated user with incorrect permissions may be able to create Accounts under the Infrastructure menu...
Microsoft Windows: Enumerate administrator accounts on elevation
This test checks the setting for policy OpenVAS Vulnerability Test $Id: winenumadminelevation.nasl 11363 2018-09-12 13:46:05Z emoss $ Check value for Enumerate administrator accounts on elevation Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net...
Flight tracking service Flightradar24 hacked; 230,000 accounts affected
By Waqas One of the largest flight tracking services, Flightradar24, which shows This is a post from HackRead.com Read the original post: Flight tracking service Flightradar24 hacked; 230,000 accounts affected...
Design/Logic Flaw
A vulnerability in the write-erase feature of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to configure an unauthorized administrator account for an affected device. The vulnerability exists because the affected software does not properly delete...
CVE-2018-1073
The web console login form in ovirt-engine before version 4.2.3 returned different errors for non-existent users and invalid passwords, allowing an attacker to discover the names of valid user accounts...
Security Bulletin: Encrypted passwords field available in result set of User record type (CVE-2012-2165)
Summary The encrypted password field for a user is available to IBM Rational ClearQuest queries and can be displayed in a result set. This is an information disclosure that may assist an attacker in attempts to construct passwords that match that encrypted value. Vulnerability Details | Subscribe...
Security Bulletin: IBM QRadar SIEM has weak password requirements. (CVE-2016-9738)
Summary The product does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. Vulnerability Details CVEID: CVE-2016-9738 DESCRIPTION: IBM QRadar does not require that users should have strong passwords by default, which...
Security Bulletin: IBM Security Key Lifecycle Manager is affected by weak password policy (CVE-2016-6093)
Summary IBM Security Key Lifecycle Manager addresses this issue where the product does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. Vulnerability Details CVEID: CVE-2016-6093 DESCRIPTION: IBM Tivoli Key Lifecycle...
Security Bulletin: Vulnerabilities in libuser affect IBM Security Network Protection (CVE-2015-3245, CVE-2015-3246)
Summary The libuser library implements a standardized interface for manipulating and administering user and group accounts used by multiple programs on the system. Security vulnerabilities have been discovered in libuser used with IBM Security Network Protection. Vulnerability Details CVE ID:...