CVE-2018-0092

A vulnerability in the network-operator user role implementation for Cisco NX-OS System Software could allow an authenticated, local attacker to improperly delete valid user accounts. The network-operator role should not be able to delete other configured users on the device. The vulnerability is...

January 18, 2018—KB4075200 (OS Build 10586.1358)

None None...

Fourth Fappening Hacker Admits to Stealing Celebrity Pics From iCloud Accounts

Almost three years after the massive leakage of high-profile celebrities' photos—well known as "The Fappening" or "Celebgate" scandal—a fourth hacker has been charged with hacking into over 250 Apple iCloud accounts belonged to Hollywood celebrities. A federal court has accused George Garofano, 2...

Microsoft Outlook 2007 Service Pack 3 Remote Code Execution Vulnerability (KB4011213)

This host is missing an important security update according to Microsoft KB4011213 SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

SonicWall SonicOS NSA - Multiple Web Vulnerabilities

Document Title: =============== SonicWall SonicOS NSA - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1725 Release Date: ============= 2018-01-06 Vulnerability Laboratory ID VL-ID: ==================================== 1725...

Deserialization of untrusted data

The DCPluginServelet servlet in ManageEngine Desktop Central and Desktop Central MSP before build 90109 allows remote attackers to create administrator accounts via an addPlugInUser action...

CVE-2014-7862

The DCPluginServelet servlet in ManageEngine Desktop Central and Desktop Central MSP before build 90109 allows remote attackers to create administrator accounts via an addPlugInUser action...

CVE-2014-7862

CVE-2014-7862 affects ManageEngine Desktop Central/Desktop Central MSP via the DCPluginServelet; unauthenticated remote attackers can create administrator accounts using addPlugInUser, with pre-90109 builds vulnerable. Public PoC/exploit references exist (Exploit-DB 43892; Rapid7 Metasploit modul...

CVE-2014-7862

The DCPluginServelet servlet in ManageEngine Desktop Central and Desktop Central MSP before build 90109 allows remote attackers to create administrator accounts via an addPlugInUser action...

samba -- multiple vulnerabilities

The samba project reports: Missing null pointer checks may crash the external print server process. On a Samba 4 AD DC any authenticated user can change other user's passwords over LDAP, including the passwords of administrative users and service accounts...

CVE-2017-1000457

Cross-site scripting XSS vulnerability in Help.aspx in mojoPortal version 2.5.0.0 allows remote attackers to inject arbitrary web script or HTML via the helpkey parameter. Exploitation requires authenticated reflected cross-site scripting for user accounts assigned either the "Administrators" or...

CVE-2017-1000457

Cross-site scripting XSS vulnerability in Help.aspx in mojoPortal version 2.5.0.0 allows remote attackers to inject arbitrary web script or HTML via the helpkey parameter. Exploitation requires authenticated reflected cross-site scripting for user accounts assigned either the "Administrators" or...

Cross site scripting

Cross-site scripting XSS vulnerability in Help.aspx in mojoPortal version 2.5.0.0 allows remote attackers to inject arbitrary web script or HTML via the helpkey parameter. Exploitation requires authenticated reflected cross-site scripting for user accounts assigned either the "Administrators" or...

Mavenlink: Account members can re-add themselve after has been deleted by administrator

Reproduction: ========= - As an administrator, invite an account members e.g: [email protected] via https://app.mavenlink.com/settings/account/members - An invitation link sent to [email protected], as user1, open email inbox and click on the link, notice the link redirects to page url:...

Ancestry.com’ RootsWeb breach: 300,000 plaintext accounts leaked

By Waqas Another day another data breach, this time it is Ancestry.com, the This is a post from HackRead.com Read the original post: Ancestry.com RootsWeb breach: 300,000 plaintext accounts leaked...

Nissan Canada cyber attack; millions of customer accounts stolen

By Carolina The automotive giant Nissan says its operations in Canada has been hit This is a post from HackRead.com Read the original post: Nissan Canada cyber attack; millions of customer accounts stolen...

With 1.4 Billion Stolen Log-Ins on the Dark Web, it’s Time to Take Password Management Seriously

Last week you may have seen some worrying news: researchers probing the darkest corners of the underground web found a secret trove containing 1.4 billion breached usernames and passwords. Yes, that’s right: 1.4 BILLION. Yours might very well be among them, and if you reuse the same password acro...

CVE-2017-16776

Security researchers discovered an authentication bypass vulnerability in version 2.0.2 of the Conserus Workflow Intelligence application by McKesson Medical Imaging Company, which is now a Change Healthcare company. The attacker must send a malicious HTTP GET request to exploit the vulnerability...

accounts.google.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-452581 Description| Value ---|--- Affected Website:| accounts.google.com Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N Remediation Guide:| OWASP Open Redirect Cheat Sheet...

CVE-2017-16687

The user self-service tools of SAP HANA extended application services, classic user self-service, a part of SAP HANA Database versions 1.00 and 2.00, can be misused to enumerate valid and invalid user accounts. An unauthenticated user could use the error messages to determine if a given username ...