Design/Logic Flaw

The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant user’s credential...

The vulnerability of the CmtViewer application for controlling programmable panels arises from insufficient limits on authentication attempts, allowing a hacker to compromise the user’s credentials.

The vulnerability of the CmtViewer application for controlling programmable panels is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability allows a malicious actor to compromise user credentials remotely...

Design/Logic Flaw

This vulnerability allows remote attackers to disclose sensitive information on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of passwords. When...

Protecting your remote workforce from application-based attacks like consent phishing

The global pandemic has dramatically shifted how people work. As a result, organizations around the world have scaled up cloud services to support collaboration and productivity from home. We’re also seeing more apps leverage Microsoft’s identity platform to ensure seamless access and integrated...

The vulnerability of the software for configuring Schneider Electric Easergy Builder controllers and the micro-software for the modular controller used in automating transformer substations (Schneider Electric Easergy T300, HU250) lies in its weak password requirements. This allows a hacker to compromise the user’s credentials.

The vulnerability of the software for configuring Schneider Electric Easergy Builder controllers and the micro-software for the modular controller used in automating transformer substations—Schneider Electric Easergy T300 HU250—is related to weak password requirements. Exploiting this vulnerabili...

Ransomware at IT Services Provider Synoptek

Synoptek, a California business that provides cloud hosting and IT management services to more than a thousand customers nationwide, suffered a ransomware attack this week that has disrupted operations for many of its clients, according to sources. The company has reportedly paid a ransom demand ...

NetApp AFF A700s Baseboard Management Controller Trust Management Issues Vulnerability

The NetApp AFF A700s Baseboard Management Controller BMC is a baseboard management controller for the AFF A700s Compact AFF Storage Controllers from NetApp, USA. A trust management issue vulnerability exists in the NetApp AFF A700s BMC with firmware version 1.22 and later. The vulnerability stems...

PT-2019-3002

Name of the Vulnerable Software and Affected Versions FortiOS versions 6.0.0 through 6.0.4 FortiOS versions 5.6.3 through 5.6.7 FortiOS versions 5.4.6 through 5.4.12 FortiProxy version 2.0.0 FortiProxy versions 1.2.0 through 1.2.8 FortiProxy versions 1.1.0 through 1.1.6 FortiProxy versions 1.0.0...

Siemens LOGO!8 BM Trust Management Issue Vulnerability

The Siemens LOGO!8 BM is a programmable logic controller from Siemens, Germany. A vulnerability in Siemens LOGO!8 BM all versions exists due to a trust management issue. The vulnerability stems from the lack of an effective trust management mechanism in a networked system or product. An attacker...

ThreatList: Credential-Sniffing Phishing Attacks Erupted in 2018

Phishing attacks have continued to grow over the past year – but now, it appears that more bad actors are launching these tricky attacks in hopes of scooping up credentials, rather than a previously-popular goal of infecting victims’ devices with malware. The new trend was outlined by Proofpoint...

GHSA-Q3JG-4C82-J4XH Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Pivotal CredHub Service Broker

Pivotal CredHub Service Broker, versions prior to 1.1.0, uses a guessable form of random number generation in creating service broker's UAA client. A remote malicious user may guess the client secret and obtain or modify credentials for users of the CredHub Service...

GHSA-C2M4-W5HM-VQJW crossenv is malware

The crossenv package is a piece of malware that steals environment variables and sends them to attacker controlled locations. All versions have been unpublished from the npm registry. Recommendation As this package is malware, if you find it installed in your environment, the real security concer...

WordPress ajax-bootmodal-login plugin input validation vulnerability

WordPress is the WordPress Software Foundation of a set of blogging platform developed using the PHP language , the platform supports PHP and MySQL servers to set up a personal blog site . ajax-bootmodal-login plugin is used in one of the user login plugin . An input validation vulnerability exis...

Code injection

A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth part of the url. In module versions 0.9.1 the auth portion of the url is outputted as part of the grunt tasks logging function. If this output is publicly...

CVE-2018-8857

Philips Brilliance CT software Brilliance 64 version 2.6.2 and prior, Brilliance iCT versions 4.1.6 and prior, Brillance iCT SP versions 3.2.4 and prior, and Brilliance CT Big Bore 2.3.5 and prior contains fixed credentials, such as a password or cryptographic key, which it uses for its own inbou...

Cloud Credentials: New Attack Surface for Old Problem

SAN FRANCISCO – Credential theft and abuse have long been a nagging problem for local network administrators. The threat surface ranges from pretexting scams to insiders who abuse network privileges in order to grant themselves higher permissions than otherwise assigned. Here at RSA Conference,...

Securing Modern Web Applications: Threats and Types of Attacks

Web Application Firewalls are the most advanced firewall capabilities available to IT teams. Deploying the appropriate WAF is important, especially these days when the security threat landscape is changing so rapidly. In a previous post, we introduced Web Application Firewalls: Securing Modern We...

CVE-2017-3763

An attacker who obtains access to the location where the LXCA file system is stored may be able to access credentials of local LXCA accounts in LXCA versions earlier than 1.3.2...

IBM Rational Rhapsody Design Manager Cross-Site Scripting Vulnerability

IBM Rational Rhapsody Design Manager is a suite of collaborative design management software from IBM. The software supports the use of centralized system repositories with Web-based access to store, share, search, and manage design models as well as automated software design reviews. A cross-site...

Microsoft Passwords Research on Re-Use

Forget what you’ve been told about password re-use and weak credentials. If we’re to believe collaborating researchers from Microsoft and Carelton University, neither is such a bad idea. Flying in the face of conventional pleading from experts that “password” is a bad password, new research puts...