Impero Education Pro Incorrect Authentication Vulnerability

Impero Education Pro is an education management solution from Impero, Inc. that integrates classroom management, desktop management, and computer monitoring software into one package. A security vulnerability exists in Impero Education Pro versions prior to 5105. As the program performs...

httpd, mod_ldap, mod_proxy_html, mod_session, mod_ssl security update

CentOS Errata and Security Advisory CESA-2015:1667 Updated httpd packages that fix two security issues are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which...

Google Pulls App Exploiting Certifi-Gate Vulnerability

A mobile application exploiting the so-called Certifi-gate vulnerability disclosed at Black Hat has been removed from the Google Play store. Though the number of downloads of Recordable Activator, a screen recorder app for Android devices, hovers between 100,000 and a half-million, researchers at...

Security Advisory 0012

Security Advisory 0012 PDF Date: August 20th 2015 Revision | Date | Changes ---|---|--- 1.0 | August 20th, 2015 | Initial release 1.1 | August 24th, 2015 | Updated with patch details. 1.2 | November 22nd, 2017 | Updated with the fixed updated EOS releases Arista 7000 Series Products and Arista EO...

CVE-2015-3164

The authentication setup in XWayland 1.16.x and 1.17.x before 1.17.2 starts the server in non-authenticating mode, which allows local users to read from or send information to arbitrary X11 clients via vectors involving a UNIX socket...

The vulnerability of the microprogramming software of the Cisco TelePresence Conductor conference call control device allows a intruder to gain access to the device.

The vulnerability of the control interface for microprogramming-based conference communication devices like Cisco TelePresence Conductor is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to gain access to the device using a...

Zhejiang Dahua camera has authentication vulnerability

Zhejiang Dahua Technology Co., Ltd. is a leading supplier of surveillance products and solution service providers, providing leading video storage, front-end, display control and intelligent transportation series of products for the world. A man-in-the-middle attack-based authentication...

CVE-2015-0175

CVE-2015-0175 affects IBM WebSphere Application Server Liberty Profile before 8.5.5.5. Root cause: incorrect handling of authData elements, allowing remote authenticated users to gain privileges via unspecified vectors. Impact and remediation are documented: apply Fix Pack/Interim Fix for WAS Lib...

CVE-2015-2571

Disclaimer: This data contains information about vulnerable...

Beijing, Shanghai, including hundreds of hotel chains InnGate wireless router there are serious security vulnerabilities-vulnerability warning-the black bar safety net

Latest survey report shows that Beijing, Shanghai, including hundreds of Inn of the InnGate wireless router there are serious security vulnerabilities, an attacker would be able to get the hotel to monitor and document data, to the hotel customers spread computer viruses, and even can access the...

Authentication flaw

Apereo Central Authentication Service CAS Server before 3.5.3 allows remote attackers to conduct LDAP injection attacks via a crafted username, as demonstrated by using a wildcard and a valid password to bypass LDAP authentication...

ntp: automatic generation of weak default key in config_auth()

It was found that ntpd automatically generated weak keys for its internal use if no ntpdc request authentication key was specified in the ntp.conf configuration file. A remote attacker able to match the configured IP restrictions could guess the generated key, and possibly use it to send ntpdc...

CVE-2014-6253

Multiple cross-site request forgery CSRF vulnerabilities in Zenoss Core through 5 Beta 3 allow remote attackers to hijack the authentication of arbitrary users, aka ZEN-12653...

CVE-2014-9278

The OpenSSH server, as used in Fedora and Red Hat Enterprise Linux 7 and when running in a Kerberos environment, allows remote authenticated users to log in as another user when they are listed in the .k5users file of that user, which might bypass intended authentication requirements that would...

Authentication flaw

The 1 ZendLdap class in Zend before 1.12.9 and 2 Zend\Ldap component in Zend 2.x before 2.2.8 and 2.3.x before 2.3.3 allows remote attackers to bypass authentication via a password starting with a null byte, which triggers an unauthenticated bind...

DotDefender <= 3.8-5 No Authentication Remote Code Execution Through XSS

No description provided by source. / DotDefender = 3.8-5 No Authentication Remote Code Execution Through XSS Tested on DotDefender 3.8-5 On Ubuntu Server 9.10 64-bit with Firefox 3.6.3 Paul Hand aka rAWjAW AT offsec.com Original Post-Authentication Remote Command Execution Vulnerability:...

D-Link authentication.cgi Buffer Overflow

No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit::Remote::HttpClient include...

ProductCart 1.5/1.6/2.0 Login.ASP SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/8105/info ProductCart has been reported prone to an SQL injection vulnerability that may be exploited to bypass the ProductCart authentication system and access the ProductCart administration panel; other attacks may also...

Firebird 1.0 - Remote Pre-Authentication Database Name Buffer Overrun Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/10446/info Firebird is reported prone to a remote buffer-overrun vulnerability. The issue occurs because the application fails to perform sufficient boundary checks when the database server is handling database names. A...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Web Platform 5.2.0 security update

An update for Red Hat JBoss Enterprise Web Platform 5.2.0 that fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which giv...