CVE-2017-8011

EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R for SAS Solution Packs EMC ViPR SRM prior to 4.1, EMC Storage M&R prior to 4.1, EMC VNX M&R all versions, EMC M&R Watch4Net for SAS Solution Packs all versions contain undocumented accounts with default passwords for Webservice Gateway and RMI J...

CVE-2017-8011

EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R for SAS Solution Packs EMC ViPR SRM prior to 4.1, EMC Storage M&R prior to 4.1, EMC VNX M&R all versions, EMC M&R Watch4Net for SAS Solution Packs all versions contain undocumented accounts with default passwords for Webservice Gateway and RMI J...

Keeping up with the Petyas: Demystifying the malware family

Last June 27, there was a huge outbreak of a Petya-esque malware with WannaCry-style infector in the Ukraine. Since there is still confusion about how exactly this malware is linked to the original Petya, we have prepared this small guide on the background of the Petya family. The origin of Petya...

Weak Password Vulnerability in DebugShell of Various ZTE OLT PON Devices

ZTE OLT C200, C220, C300, and C320 are key PON devices used in optical switching networks in the telecommunications industry. A weak password vulnerability exists in DebugShell of various ZTE OLT PON devices, which can be exploited by an attacker to add passwords for daily operation accounts,...

GLSA-201707-03 : phpMyAdmin: Security bypass

The remote host is affected by the vulnerability described in GLSA-201707-03 phpMyAdmin: Security bypass A vulnerability was discovered where the restrictions caused by $cfgServers$iAllowNoPassword = false are bypassed under certain PHP versions. This can lead compromised user accounts, who have ...

Self-Service Food Kiosk Vendor Avanti Hacked

Avanti Markets, a company whose self-service payment kiosks sit beside shelves of snacks and drinks in thousands of corporate breakrooms across America, has suffered of breach of its internal networks in which hackers were able to push malicious software out to those payment devices, the company...

Coinbase: Captcha Bypass in Coinbase SignUp Form

Vulnerability description: The g-recaptcha-response is not validated on the server-side when submitting a Signup form to the endpoint. Any or no value can be provided for this header Step to reproduce: 1. https://www.coinbase.com/signup 2. Fill the input field and Validate the captcha. 3. Trun on...

WakaTime: Running 2 accounts with a single email

Hi, While testing, I found a logic flaw which made me to make two accounts with a single email Reproduction Steps 1-Create one account with [email protected] 2-another with [email protected] or [email protected] etc 3-Emails of both accounts will come at [email protected] fix: Dont allow "+" in emails. Thank...

Microsoft Windows Search Multiple Vulnerabilities (KB4024402)

This host is missing a critical security update according to Microsoft KB4024402. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Largest Cryptocurrency Exchange Hacked! Over $1 Million Worth Bitcoin and Ether Stolen

One of the world's largest Bitcoin and Ether cryptocurrencies exchanges Bithumb has recently been hacked, resulting in loss of more than $1 Million in cryptocurrencies after a number of its user accounts compromised. Bithumb is South Korea's largest cryptocurrency exchange with 20% of global ethe...

WakaTime: Blocking users to sign up on the site

Dear sir, This may be a low priority issue,but has the importance to resolve at your priority.I request you to think over this report,because this vulnerability is not a spam on many other sites. URL:- https://wakatime.com/signup https://wakatime.com/login Vulnerability:- -Attacker can block user...

Weblate: Running 2 accounts with a single email #3

Following the fixes: 241608 & 224072. there's still another way round this. Reproduction Steps 1. Register 2 accounts Preferably using Gmail not third party - Login both accounts on separate browsers - In Browser1, navigate to https://demo.weblate.org/accounts/profile/auth - Add a new association...

CVE-2017-8613

Azure AD Connect Password writeback, if misconfigured during enablement, allows an attacker to reset passwords and gain unauthorized access to arbitrary on-premises AD privileged user accounts aka "Azure AD Connect Elevation of Privilege Vulnerability."...

CVE-2016-9738

IBM QRadar 7.2 and 7.3 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 119783...

Default credentials

IBM QRadar 7.2 and 7.3 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 119783...

CVE-2016-9738

CVE-2016-9738 affects IBM QRadar SIEM where default password requirements are weak, facilitating account compromise. IBM security bulletin confirms affected versions: QRadar SIEM 7.2.0–7.2.8 Patch 6 and 7.3.0–7.3.0 Patch 1. The root cause is that strong passwords were not required by default. Imp...

Eltek SmartPack - Backdoor Account Vulnerability

Exploit for hardware platform in category web applications Eltek SmartPack - Backdoor Account Author: Saeed reza Zamanian penetrationtest @ Linkedin Product: Eltek SmartPack Vendor: http://www.eltek.com/ Product Link : http://www.eltek.com/detailproducts.epl?k1=25507&id=1123846 About Product: The...

Eltek SmartPack - Backdoor Account

Eltek SmartPack - Backdoor Account Author: Saeed reza Zamanian penetrationtest @ Linkedin Product: Eltek SmartPack Vendor: http://www.eltek.com/ Product Link : http://www.eltek.com/detailproducts.epl?k1=25507&id=1123846 About Product: The Smartpack controller is a powerful and cost-effective...

accounts.ft.com XSS vulnerability

Vulnerable URL: https://accounts.ft.com/login/submitEmail Details: Description| Value ---|--- Patched:| Yes, at 12.09.2017 Latest check for patch:| 12.09.2017 11:06 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| Yes...

Weblate: Running 2 accounts with a single email [Part 2]

Following the fix on 224072, I decided to try this in another way and it worked! Reproduction Steps 1. Login with Github on Browser1 and set a password to it. - With another email, signup on Weblate on Browser2 - In the new account on Browser2, do the following: Confirm email and Set a Password A...