CVE-2016-5797

CVE-2016-5797 affects Tollgrade LightHouse SMS Software prior to Version 5.1 Patch 3. The issue is information exposure through error messages that reveal whether a username exists, enabling remote account-name enumeration. Affected component is the web-based LightHouse SMS software; the root cau...

Shopify: Stealing livechat token and using it to chat as the user - user information disclosure

Hi , I have found an issue through which an attacker can steal users' livechat access token and use it to login and chat with the support agents as them , he also will be able to get access to sensitive user information such as his email and his first name and last name. Details: When you go to...

Red Hat libvirt Design Vulnerability

Red Hat libvirt is a Linux API for implementing Linux virtualization features from Red Hat, Inc. It supports a variety of Hypervisors, including Xen and KVM, as well as QEMU and a number of virtual products for other operating systems. A design vulnerability exists in Red Hat libvirt that stems...

CVE-2016-4985

An authentication vulnerability was found in openstack-ironic. A client with network access to the ironic-api service could bypass OpenStack Identity authentication, and retrieve all information about any node registered with OpenStack Bare Metal. If an unprivileged attacker knew or was able to...

CVE-2010-5326

The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a "Detour" attack...

Deep Impact AD Reporting System Override Access Vulnerability

SINFOR AD is the latest application delivery series equipment launched by SINFOR, and its outstanding feature is the intelligent analysis function of SINFOR AD. SINFOR AD reporting system has an overstepping access vulnerability, which allows attackers to exploit the vulnerability to realize...

Bumble: [CRITICAL] Full account takeover using CSRF

Hi , I have found a CSRF issue that allows an attacker to link his gmail , facebook ... or any social account to the victim's account and hijack the whole account. Details: When a user tries to link a gmail account with his account , after he authorizes badoo to use his gmail account he will be...

rubygem-actionpack: Timing attack vulnerability in basic authentication in Action Controller

A flaw was found in the way the Action Controller component compared user names and passwords when performing HTTP basic authentication. Time taken to compare strings could differ depending on input, possibly allowing a remote attacker to determine valid user names and passwords using a timing...

Portal Apache Jetspeed 2.3.0 and earlier versions: a remote code execution vulnerability analysis-vulnerability warning-the black bar safety net

! As my personal“friendship detect open source software security”one of the projects I'm ready to play play the Apache Jetspeed 2, which v2. 3 0 one. Jetspeed this stuff, used those words, that is: “An open portal platform and enterprise information portal, completely based on open standards,...

SUSE-SU-2016:0623-1 Security update for rubygem-activesupport-3_2

This update for rubygem-activesupport-32 fixes the following issues: - CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller bsc963329...

CVE-2015-7576

The httpbasicauthenticatewith method in actionpack/lib/actioncontroller/metal/httpauthentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not use a...

KMC Controls Conquest BACnet Router Vulnerabilities

OVERVIEW This advisory was originally posted to the US-CERT secure Portal library on May 5, 2016, and is being released to the NCCIC/ICS-CERT web site. Independent researcher Maxim Rupp has identified authentication and cross-site request forgery CSRF vulnerabilities in KMC Controls’ Conquest...

CVE-2016-1232

The moddialback module in Prosody before 0.9.9 does not properly generate random values for the secret token for server-to-server dialback authentication, which makes it easier for attackers to spoof servers via a brute force attack...

CVE-2015-8361: Services exposed without authentication Vulnerability

Bamboo exposed services without first performing authentication checks. Attackers can use this vulnerability to extract confidential information from Bamboo, modify certain settings and manage build agents. To exploit this issue, attackers need to be able to access the Bamboo JMS port. Affected...

Authentication Weakness

Overview Versions of keystone prior to 0.3.16 are affected by a partial authentication bypass vulnerability. In the default sign in functionality, if an attacker provides a full and correct password, yet only provides part of the associated email address, authentication will be granted...

D-Link DIR-815 Buffer Overflow / Command Injection Vulnerabilities

D-Link DIR-815 suffers from buffer overflow and command injection vulnerabilities. Title: DIR-815 Buffer overflows and Command injection in authentication and HNAP functionalities Vendors contacted: William Brown , Patrick Cline email protected CVE: None Note: All these security issues have been...

CVE-2015-6029

HP ArcSight Logger before 6.0 P2 does not limit attempts to authenticate to the SOAP interface, which makes it easier for remote attackers to obtain access via a brute-force approach...

CVE-2015-6843

Reviewer in EMC SourceOne Email Supervisor before 7.2 does not properly limit attempts to authenticate, which makes it easier for remote attackers to obtain access via a brute-force approach...

Hardcoded credentials

ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser account, which allows remote authenticated users to obtain administrator access by leveraging knowledge of this password...

Apple OS X Kerberos Authentication Credential Replay Vulnerability

Apple OS X is an operating system developed by Apple Inc. An authentication vulnerability exists in Apple OS X Kerberos credentials, which allows remote attackers to exploit the vulnerability to replay Kerberos to an SMB server...