Authentication flaw

In Lenovo XClarity Administrator LXCA before 1.3.0, if service data is downloaded from LXCA, a non-administrative user may have access to password information for users that have previously authenticated to the LXCA's internal LDAP server, including administrative accounts and service accounts wi...

Invision Power Board 4.1.19.2 XSS / CSRF / File Upload / Information Disclosure

Description: Invision Power Board version 4.1.19.2 current version as of this release and below, is vulnerable to pre-auth reflected XSS in the IPS UTF8 Converter v1.1.18 and stored XSS in the Announcements. The vulnerability in the IPS UTF8 Converter can easily be used to make a malicious...

Personify360 e-Business Information Disclosure Vulnerability (CNVD-2017-13143)

Personify360 e-Business is a Web-based member management system from Personify, Inc. A security vulnerability exists in Personify360 e-Business versions 7.5.2 through 7.6.1. The vulnerability can be exploited by an attacker to add vendor accounts or read vendor account data including: user names...

Microsoft Windows Multiple Vulnerabilities (KB4022722)

This host is missing a critical security update according to Microsoft KB4022722 SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

AtMail Cross-Site Request Forgery Vulnerability (CNVD-2017-09348)

AtMail is an open source WebMail client from the Australian company Atmail , which provides a Webmail interface , address book management , calendars and other features , and supports IMAP, video mail and so on. A cross-site request forgery vulnerability exists in versions of AtMail prior to...

Tongfang Mybody Smart Scale Android App Has Design Flaw Vulnerability

Tongfang Mybody Smart Scale Android app is a full-featured health management device. A design flaw vulnerability exists in the cell phone number verification login function of Tongfang Mybody Smart Scale Android app. An attacker can exploit the vulnerability to log into any user's account...

Design/Logic Flaw

IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts...

CVE-2016-6093

IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts...

CVE-2017-1196

IBM BigFix Compliance TEMA SUAv1 SCA SCM 1.9.70 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 123671...

Default credentials

IBM BigFix Compliance TEMA SUAv1 SCA SCM 1.9.70 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 123671...

CVE-2017-1196

IBM BigFix Compliance TEMA SUAv1 SCA SCM 1.9.70 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 123671...

CVE-2017-7312

An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, anyone can add a vendor account or read existing vendor account data including usernames and passwords...

SQL Injection Vulnerability in Multiple Peplink Balance Products

Peplink Balance 305 and others are multi-exit load balancing routers for medium-sized businesses. An SQL injection vulnerability exists in several Peplink Balance products using firmware versions prior to fw-b305hw2380hw6580hw2710hw31350hw22500-7.0.1-build2093. A remote attacker could exploit the...

V2.1 CSRF vulnerability in Aisooki website builder system

Aisok universal enterprise building system cicms is based on PHP + Mysql development of an enterprise website management system. There is a V2.1 CSRF vulnerability in Aisooki website builder system. An attacker can exploit this vulnerability to forge form links, tricking administrators into...

Jaff Malware Probe Uncovers Link to Cybercrime Marketplace

An investigation into a new strain of Jaff ransomware uncovered a shared backend infrastructure between the malware and a black market bazaar selling stolen bank and credit card account information. Researchers at Heimdal Security said the cybercrime marketplace they found appeared mature, offeri...

steam-accounts.com XSS vulnerability

Vulnerable URL: https://steam-accounts.com/?s=';prompt'OPENBUGBOUNTY'//"";prompt/OPENBUGBOUNTY/...

CVE-2017-7505

Foreman since version 1.5 is vulnerable to an incorrect authorization check due to which users with user management permission who are assigned to some organizations can do all operations granted by these permissions on all administrator user object outside of their scope, such as editing global...

CVE-2017-7505

Foreman since version 1.5 is vulnerable to an incorrect authorization check due to which users with user management permission who are assigned to some organizations can do all operations granted by these permissions on all administrator user object outside of their scope, such as editing global...

Information Disclosure

Moodle is vulnerable to information disclosure. It's possible for remote attackers to view the profiles images of users' accounts...

CVE-2017-7505

Foreman since version 1.5 is vulnerable to an incorrect authorization check due to which users with user management permission who are assigned to some organizations can do all operations granted by these permissions on all administrator user object outside of their scope, such as editing global...