foreman: Ovirt admin password exposed by foreman API

A flaw was found in foreman before 1.16.1. The issue allows users with limited permissions for powering oVirt/RHV hosts on and off to discover the username and password used to connect to the compute resource...

CVE-2018-18377

goform/setReset on Orange AirBox Y858FL01.1604 devices allows attackers to reset a router to factory settings, which can be used to login using the default admin:admin credentials...

Pivotal Application Service Pivotal Usage Service Elevation of Privilege Vulnerability

Pivotal Application Service is a suite of application management software from Pivotal Software, Inc. and Pivotal Usage Service is one of the service components. An elevation of privilege vulnerability exists in Pivotal Usage Service in Pivotal Application Service versions 2.0.21 prior to 2.0,...

Pivotal Application Service Pivotal Applications Manager Elevation of Privilege Vulnerability

Pivotal Application Service is a suite of application services that support continuous delivery from Pivotal Software, Inc. Pivotal Applications Manager is one of the application management components. An elevation of privilege vulnerability exists in Pivotal Application Service version 2.0 befor...

Dell Laser MFP 2335dn Printer Password Disclosure Vulnerability - Active Check

Dell Laser MFP 2335dn Printer is prone to a password disclosure vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPEPREFIX =...

CVE-2018-16669

An issue was discovered in CIRCONTROL Open Charge Point Protocol OCPP before 1.5.0, as used in CirCarLife, PowerStudio, and other products. Due to storage of credentials in XML files, an unprivileged user can look at /services/config/config.xml for the admin credentials of the ocpp and circarlife...

CVE-2018-16669

An issue was discovered in CIRCONTROL Open Charge Point Protocol OCPP before 1.5.0, as used in CirCarLife, PowerStudio, and other products. Due to storage of credentials in XML files, an unprivileged user can look at /services/config/config.xml for the admin credentials of the ocpp and circarlife...

Open redirect

An issue was discovered in CIRCONTROL Open Charge Point Protocol OCPP before 1.5.0, as used in CirCarLife, PowerStudio, and other products. Due to storage of credentials in XML files, an unprivileged user can look at /services/config/config.xml for the admin credentials of the ocpp and circarlife...

CVE-2018-16669

An issue was discovered in CIRCONTROL Open Charge Point Protocol OCPP before 1.5.0, as used in CirCarLife, PowerStudio, and other products. Due to storage of credentials in XML files, an unprivileged user can look at /services/config/config.xml for the admin credentials of the ocpp and circarlife...

CVE-2018-16669

The CVE-2018-16669 entry concerns CIRCONTROL’s Open Charge Point Protocol (OCPP) implementations used in CirCarLife, PowerStudio, and similar products. The issue arises from storing admin credentials in XML files, allowing an unprivileged user to read /services/config/config.xml and obtain OCPP/c...

CVE-2018-11086

Pivotal Usage Service in Pivotal Application Service, versions 2.0 prior to 2.0.21 and 2.1 prior to 2.1.13 and 2.2 prior to 2.2.5, contains a bug which may allow escalation of privileges. A space developer with access to the system org may be able to access an artifact which contains the CF admin...

OpenAFS has an unspecified vulnerability

OpenAFS is a distributed file system that allows sharing of archives and resources between systems over LANs and WANs. A security vulnerability exists in OpenAFS versions prior to 1.6.23 and 1.8.x prior to 1.8.2, which stems from the backup tape controller process not requiring authentication for...

CVE-2018-16947

OpenAFS has a concrete vulnerability set: CVE-2018-16947 affects OpenAFS before 1.6.23 and 1.8.x before 1.8.2, where the backup tape controller (butc) RPCs are not authenticated, enabling an unauthenticated attacker to perform volume operations with administrator credentials (e.g., dumping/restor...

CirCarLife SCADA 4.3.0 - Credential Disclosure

CirCarLife SCADA 4.3.0 - Credential Disclosure Exploit Title: CirCarLife SCADA 4.3.0 - Credential Disclosure Date: 2018-09-10 Exploit Author: David Castro Vendor Homepage: https://circontrol.com/ Shodan Dork: Server: CirCarLife Server: PsiOcppApp Version: CirCarLife Scada all versions under 4.3.0...

CirCarLife SCADA 4.3.0 - Credential Disclosure

Exploit Title: CirCarLife SCADA 4.3.0 - Credential Disclosure Date: 2018-09-10 Exploit Author: David Castro Vendor Homepage: https://circontrol.com/ Shodan Dork: Server: CirCarLife Server: PsiOcppApp Version: CirCarLife Scada all versions under 4.3.0 OCPP implementation all versions under 1.5.0 C...

CVE-2018-16604

An issue was discovered in Nibbleblog v4.0.5. With an admin's username and password, an attacker can execute arbitrary PHP code by changing the username because the username is surrounded by double quotes e.g., "$phpinfo"...

CVE-2017-16744

A path traversal vulnerability in Tridium Niagara AX Versions 3.8 and prior and Niagara 4 systems Versions 4.4 and prior installed on Microsoft Windows Systems can be exploited by leveraging valid platform administrator credentials...

Zoho ManageEngine Applications Manager SQL Injection Vulnerability (CNVD-2018-15179)

ZOHO ManageEngine Applications Manager is a set of IT operation and maintenance management solutions of the United States ZhuoHao ZOHO company. The product has application performance management, fault management, report generation and SLA management and other functions. A SQL injection...

Dicoogle PACS 2.5.0 Directory Traversal

Exploit Title: Dicoogle PACS 2.5.0 - Directory Traversal Date: 2018-05-25 Software Link: http://www.dicoogle.com/home Version: Dicoogle PACS 2.5.0-201712291522 Category: webapps Tested on: Windows 2012 R2 Exploit Author: Carlos Avila Contact: http://twitter.com/badboynt 1. Description Dicoogle is...

Timehop Breach Impacts Personal Data of 21 Million Users

The personal data of millions of Timehop customers has been compromised after a hacker gained access to its cloud-based backend computing environment. Timehop, a service that plugs into users’ social media platforms and shows them memories from the past, disclosed the data breach on Sunday. The...