Cisco Unified Intelligence Center Security Mechanism Bypass Vulnerability

Cisco Unified Intelligence Center is the management center for Cisco's Unified Communications system. A security mechanism bypass vulnerability exists in Cisco Unified Intelligence Center that could be exploited by a remote attacker to create user accounts by submitting a special request...

Twitter: Circumventing the Twitter account lockout process [ACCOUNT TAKEOVER]

Ullger found a method to bypass our security control requiring compromised accounts to verify their details such as an email address & phone number. An attacker could have used this vulnerability with a stolen username & password in order to gain access to a user's account. In my testing, I found...

Open redirect

The jspringsecurityswitchuser function in Cisco Unified Intelligence Center CUIC 8.5.4 through 9.11, as used in Unified Contact Center Express 10.01 through 11.01, allows remote attackers to create user accounts by visiting an unspecified web page, aka Bug IDs CSCuy75027 and CSCuy81653...

CVE-2016-6426

The jspringsecurityswitchuser function in Cisco Unified Intelligence Center CUIC 8.5.4 through 9.11, as used in Unified Contact Center Express 10.01 through 11.01, allows remote attackers to create user accounts by visiting an unspecified web page, aka Bug IDs CSCuy75027 and CSCuy81653...

NetMan 204 - Backdoor Account Vulnerability

Exploit for hardware platform in category remote exploits NetMan 204 - Backdoor Account Author: Saeed reza Zamanian penetrationtest @ Linkedin Product: NetMan 204 Vendor: http://www.riello-ups.com Product URL: http://www.riello-ups.com/products/4-software-connectivity/85-netman-204 Quick Referenc...

D-Link DWR-932B Backdoors / Default WPS PIN

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory Information Title: Multiple vulnerabilities found in the Dlink DWR-932B backdoor, backdoor accounts, weak WPS, RCE ... Advisory URL: https://pierrekim.github.io/advisories/2016-dlink-0x00.txt Blog URL:...

NetMan 204 Backdoor Account

NetMan 204 - Backdoor Account Author: Saeed reza Zamanian penetrationtest @ Linkedin Product: NetMan 204 Vendor: http://www.riello-ups.com Product URL: http://www.riello-ups.com/products/4-software-connectivity/85-netman-204 Quick Reference Installation Manual :...

Riello NetMan 204 Default Credentials (SSH)

The remote Riello NetMan 204 network card is using known default credentials for the SSH login. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

NetMan 204 - Backdoor Account

NetMan 204 - Backdoor Account NetMan 204 - Backdoor Account Author: Saeed reza Zamanian penetrationtest @ Linkedin Product: NetMan 204 Vendor: http://www.riello-ups.com Product URL: http://www.riello-ups.com/products/4-software-connectivity/85-netman-204 Quick Reference Installation Manual :...

Design/Logic Flaw

The Kerberos 5 aka krb5 PAM module in Apple OS X before 10.12 does not use constant-time operations for determining username validity, which makes it easier for remote attackers to enumerate user accounts via a timing side-channel attack...

Legal Robot: Near-duplicate accounts allowed with ignored email mutations

A security researcher discovered that near-duplicate accounts like [email protected], [email protected], and [email protected] were all treated as separate accounts, while some email services, like gmail and google apps, treat these as the same account. This issue could lead to excess ema...

Oxwall (build 9900) has multiple vulnerabilities

Oxwall is a free, open source, community software platform based on PHP and MySQL. A cross-site scripting and URL redirection vulnerability exists in Oxwall version 1.8.0 build 9900. An attacker can exploit this vulnerability to perform unauthorized operations and view other user account...

Yahoo Reportedly to Confirm Breach of Hundreds of Millions of Credentials

Yahoo is expected to confirm a data breach that exposed hundreds of millions of credentials dating back four years. A report published today by Recode intimates that the total number of exposed credentials will be higher than the 200 million initially reported in early August. A request for comme...

The vulnerability of the Windows operating system, which allows a hacker to crack the password

The vulnerability of the Windows operating system is related to incorrect checking of NTLM SSO requests for MSAs. Exploiting this vulnerability allows a malicious actor to select a password by using brute-force attacks on NTLM password hashes...

CVE-2016-6535

AVer Information EH6108H+ devices with firmware X9.03.24.00.07l have hardcoded accounts, which allows remote attackers to obtain root access by leveraging knowledge of the credentials and establishing a TELNET session...

Hardcoded credentials

AVer Information EH6108H+ devices with firmware X9.03.24.00.07l have hardcoded accounts, which allows remote attackers to obtain root access by leveraging knowledge of the credentials and establishing a TELNET session...

CVE-2016-6535

AVer Information EH6108H+ devices with firmware X9.03.24.00.07l have hardcoded accounts, which allows remote attackers to obtain root access by leveraging knowledge of the credentials and establishing a TELNET session...

CVE-2016-6535

CVE-2016-6535 affects AVer Information EH6108H+ hybrid DVR (firmware X9.03.24.00.07l). The vulnerability arises from hard-coded accounts with root privileges, enabling remote attackers to obtain root access via a default TELNET service. CERT/CC notes multiple issues in the device, including authe...

The vulnerability of Google Chrome browser allows a perpetrator to exploit it to access user accounts.

The vulnerability of the net/proxy/proxyservice.cc file for Google Chrome Proxy Auto-Config PAC extensions does not guarantee that the information is limited to a script, host, and port. Exploiting this vulnerability could allow a malicious actor to access user accounts by manipulating the server...

BINOM3 Electric Power Quality Meter Weak Password Vulnerability

The BINOM3 Electric Power Quality Meter is a universal multifunctional power quality monitor. The BINOM3 Electric Power Quality Meter is vulnerable to a weak password. The device is configured with four login accounts "admin / 1", "user / 1", "alg / 1", "telem / 1". To further make it easier for...