Looking to Bolster Security, Dropbox Adds Two-Factor Authentication

Several weeks after announcing that some of its users’ log-ins and passwords had been stolen, file storage company Dropbox announced it has added a two-step authentication process over the weekend to help reinforce the security of its users’ accounts. The added layer of security is currently...

CVE-2010-5093

MemberProfileForm in security/Member.php in SilverStripe 2.3.x before 2.3.7 allows remote attackers to hijack user accounts by saving data using the email address ID of another user...

Code injection

MemberProfileForm in security/Member.php in SilverStripe 2.3.x before 2.3.7 allows remote attackers to hijack user accounts by saving data using the email address ID of another user...

PostgreSQL Default Credentials (PostgreSQL Protocol)

It was possible to login into the remote PostgreSQL as user postgres using weak credentials. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CP...

Apache Tomcat Manager/Host Manager/Server Status Default/Hardcoded Credentials (HTTP)

The Apache Tomcat Manager/Host Manager/Server Status is using default or known hardcoded credentials. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

SMSZombie Malware Infecting Android Devices, Stealing Money

A nasty new piece of malware that has the ability to steal money from users’ via fraudulent SMS payments has shown up in a Chinese Android market and researchers say it’s infected more than 500,000 victims. The SMSZombie malware is being hidden inside apps on the app market and once it’s on a...

Scrutinizer Default Credentials Check

The Scrutinizer install on the remote host is using default credentials for the 'admin' user. Using these credentials, it is possible to login and gain access to the back end administrative interface. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

NeoBill CMS v0.8 Alpha - Multiple Web Vulnerabilities

Document Title: =============== NeoBill CMS v0.8 Alpha - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=685 Release Date: ============= 2012-08-18 Vulnerability Laboratory ID VL-ID: ==================================== 685...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Web Gateway component in IBM WebSphere MQ File Transfer Edition 7.0.4 and earlier, and WebSphere MQ - Managed File Transfer 7.5, allow remote attackers to hijack the authentication of arbitrary users for requests that 1 add user...

ShopperPress WordPress Theme 2.7 SQL Injection

Title: ====== ShopperPress v2.7 Wordpress - SQL Injection Vulnerability Date: ===== 2012-08-01 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=669 VL-ID: ===== 669 Common Vulnerability Scoring System: ==================================== 6.1 Introduction: =============...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in upload/users.php in Utopia News Pro UNP 1.4.0 and earlier allows remote attackers to hijack the authentication of administrators for requests that add administrator accounts...

Default credentials

Bytemark Symbiosis before Revision 1322 does not properly validate passwords, which allows remote attackers to gain access to email accounts via an arbitrary password...

CVE-2012-2368

Bytemark Symbiosis before Revision 1322 does not properly validate passwords, which allows remote attackers to gain access to email accounts via an arbitrary password...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in SolarWinds Orion Network Performance Monitor NPM before 10.3.1 allow remote attackers to hijack the authentication of administrators for requests that 1 create user accounts via CreateUserStepContainer actions to...

CVE-2012-2602

Multiple cross-site request forgery CSRF vulnerabilities in SolarWinds Orion Network Performance Monitor NPM before 10.3.1 allow remote attackers to hijack the authentication of administrators for requests that 1 create user accounts via CreateUserStepContainer actions to...

CVE-2012-4035

The newpassword page in PBBoard 2.1.4 allows remote attackers to change the password of arbitrary user accounts via the memberid and newpassword parameters to index.php...

Default credentials

The newpassword page in PBBoard 2.1.4 allows remote attackers to change the password of arbitrary user accounts via the memberid and newpassword parameters to index.php...

CVE-2010-5142

chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users to manage user accounts via requests to the /users URI...

Design/Logic Flaw

chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users to manage user accounts via requests to the /users URI...

CVE-2010-5142

chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users to manage user accounts via requests to the /users URI...