The vulnerability of Safari browser and iOS operating system allows attackers to obtain confidential information.

The vulnerability of the “Clear History and Website Data” function in the Safari browser and the iOS operating system is related to the lack of protection for service data. Exploiting this vulnerability can allow a local attacker to obtain confidential information...

Unspecified vulnerability in ntpd (CNVD-2016-03822)

ntpd Network Time Protocol daemon is an operating system daemon that uses the Network Time Protocol NTP to keep synchronized with the system time of a time server. An unspecified vulnerability exists in NTP.org ntpd versions prior to 4.2.8p8. An attacker can exploit this vulnerability by sending...

Apple iOS Safari Information Disclosure Vulnerability (CNVD-2016-03485)

Apple iOS is an operating system on Apple phones. The Safari 'Clear History and Website Data' feature in Apple iOS fails to clear history, allowing attackers to exploit a vulnerability to build malicious web pages to trick users into parsing them, which can crash applications or execute arbitrary...

CVE-2016-1849

The "Clear History and Website Data" feature in Apple Safari before 9.1.1, as used in iOS before 9.3.2 and other products, mishandles the deletion of browsing history, which might allow local users to obtain sensitive information by leveraging read access to a Safari directory...

CVE-2016-1849

The "Clear History and Website Data" feature in Apple Safari before 9.1.1, as used in iOS before 9.3.2 and other products, mishandles the deletion of browsing history, which might allow local users to obtain sensitive information by leveraging read access to a Safari directory...

Meteocontrol WEB'log Information Disclosure Vulnerability (CNVD-2016-03190)

Meteocontrol WEB'log is a web-based SCADA system that provides energy and power configuration management functions using different connected devices. Several Meteocontrol WEB'log products store information in clear text, allowing remote attackers to exploit vulnerabilities to obtain sensitive...

Internet Bug Bounty: Divide-and-conquer session key recovery in SSLv2 (CVE-2016-0703)

This is a retroactive submission of CVE-2016-0703, a.k.a. the "Extra Clear" bug, which can lead to the Special DROWN variant of the DROWN attack. After some discussion with the other DROWN authors, I'm submitting on behalf of myself David Adrian and J. Alex Halderman the vulnerability...

Meteocontrol WEB'log Vulnerabilities (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-16-133-01 Meteocontrol WEB'log Vulnerabilities that was published May 12, 2016, on the NCCIC/ICS‑CERT web site. Independent researcher Karn Ganeshen has identified one authentication and two information exposure...

Moxa MiiNePort Information Disclosure Vulnerability

Moxa MiiNePort is an embedded device networking module designed for manufacturers to connect serial devices to a network connection. Moxa MiiNePort stores information in clear text and does not provide a protection mechanism, allowing an attacker to view sensitive or configuration information...

samba: Man-in-the-middle attacks possible with NTLMSSP authentication

Several flaws were found in Samba's implementation of NTLMSSP authentication. An unauthenticated, man-in-the-middle attacker could use this flaw to clear the encryption and integrity flags of a connection, causing data to be transmitted in plain text. The attacker could also force the client or...

CVE-2016-1866

Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle attackers to execute arbitrary code by inserting packets into the minion-master data stream...

PYSEC-2016-23

Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle attackers to execute arbitrary code by inserting packets into the minion-master data stream...

New Relic: Password disclosure during signup process

New relic provides user's the option to register new accounts. It was observed that during creation of new account process, user's password is displayed in clear text in response. This leads to disclosure of passwords. There may be another issue here that user's passwords are not stored in hashed...

Clear Vision 3 -Sniper Shooter - Dangerous filesystem permissions, Insecure KeyStore vulnerabilities

HackApp vulnerability scanner discovered that application Clear Vision 3 -Sniper Shooter published at the 'play' market has multiple vulnerabilities...

Clear Glass Transparent Style - Customized SSL, Dangerous filesystem permissions, WebView SSL handling enabled vulnerabilities

HackApp vulnerability scanner discovered that application Clear Glass Transparent Style published at the 'play' market has multiple vulnerabilities...

HackerOne: HackerOne Important Emails Notification are sent in clear-text

Our e-mail provider at the time had problems where some e-mails would not be sent out over TLS. Based on data from Google Postmaster Tools, we were seeing as high as 12% of our e-mail from our provider to Google mail servers not encrypted. We opened a case with them on March 31st, 2016, about thi...

USN-2931-1 linux-lts-utopic vulnerabilities

Ben Hawkes discovered that the Linux netfilter implementation did not correctly perform validation when handling IPTSOSETREPLACE events. A local unprivileged attacker could use this to cause a denial of service system crash or possibly execute arbitrary code with administrative privileges...

DEBIAN-CVE-2016-0703

The getclientmasterkey function in s2srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a accepts a nonzero CLIENT-MASTER-KEY CLEAR-KEY-LENGTH value for an arbitrary cipher, which allows man-in-the-middle attackers to...

D-Link DVG-N5402SP Information Disclosure Vulnerability

The D-Link DVG-N5402SP is a wireless router product from AUO D-Link for voice, fax and shared wireless Internet over IP networks. A security vulnerability exists in the D-Link DVG-N5402SP that originates from the program storing data in clear text. An attacker could exploit the vulnerability to...

GE SNMP/Web Interface adapter information disclosure vulnerability

The GE SNMP/Web Interface adapter is a web server from General Electric that displays current information about an uninterruptible power supply. The GE SNMP/Web Interface adapter file contains information stored in clear text, allowing remote attackers to exploit this vulnerability to obtain...