Default credentials

An issue was discovered in Grafana 5.4.0. Passwords for data sources used by Grafana e.g., MySQL are not encrypted. An admin user can reveal passwords for any data source by pressing the "Save and test" button within a data source's settings menu. When watching the transaction with Burp Proxy, th...

Foxit Reader 9.0 < 9.6.0.25114 Security Bypass Vulnerability

According to its version, the Foxit Reader application installed on the remote Windows host is prior to 9.6.0.25114. It is, therefore affected by a security bypass vulnerability. Safe reading mode may be disabled when users update an existing installation of Foxit Reader from within the...

Design/Logic Flaw

TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. A DHCP Request is sent to the router with a certain Transaction ID field. Following the DHCP protocol, the router responds wi...

Design/Logic Flaw

D-link DIR-825AC G1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. A DHCP Request is sent to the router with a certain Transaction ID field. Following the DHCP protocol, the router responds with an ACK or NAK...

CVE-2019-13266

TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. A DHCP Request is sent to the router with a certain Transaction ID field. Following the DHCP protocol, the router responds wi...

Design/Logic Flaw

Creative Cloud Desktop Application 4.6.1 and earlier versions have an insecure transmission of sensitive data vulnerability. Successful exploitation could lead to information leakage...

CVE-2019-8063

Creative Cloud Desktop Application 4.6.1 and earlier versions have an insecure transmission of sensitive data vulnerability. Successful exploitation could lead to information leakage...

Adobe Creative Cloud Security Update (APSB19-39) - Windows

Adobe Creative cloud is prone to multiple vulnerabilities SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:adobe:creativecloud";...

Adobe Creative Cloud Security Update (APSB19-39) - Mac OS X

Adobe Creative cloud is prone to multiple vulnerabilities SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:adobe:creativecloud";...

Job to the Linux Repository Fails with "No connection could be made because the target machine actively refused it xx.xx.xx.xx:2500"

Challenge When multiple tasks are attempting to use the same Linux repository simultaneously, some connections may fail with the error: No connection could be made because the target machine actively refused it xx.xx.xx.xx:2500. The port shown in the error is a data transmission port, and may be...

CVE-2019-13991

Embedded systems based on Arduino before Rev3 allow remote attackers to send data to LEDs directly connected to GPIO pins via a laser, because of LED photosensitivity...

Malicious Package

leaflet-gpx contains malicious code. The code when executed in the browser would capture password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl=...

Multiple Sierra Wireless AirLink Routers Open to Remote Code Execution

Sierra Wireless is warning that additional AirLink router models, which are targeted toward IoT applications, are vulnerable to previously-disclosed critical flaws. The vulnerabilities are part of the 11 critical bugs disclosed on Sierra Wireless’ AirLink ES450 LTE router last week – only now,...

Researchers go hunting for Netflix’s Bandersnatch

A new research paper from the Indian Institute of Technology Madras explains how popular Netflix interactive show Bandersnatch could fall victim to a side-channel attack. In 2016, Netflix began adding TLS Transport Layer Security to their video content to ensure strangers couldn’t eavesdrop on...

Ring Doorbell Flaw Opens Door to Spying

UPDATE A serious flaw in the popular Ring smart doorbell could allow an attacker on a shared WiFi network to spy on families’ video and audio footage, according to researchers. Ring Doorbell is a popular home security device acquired by Amazon. Researchers with BullGuard discovered a way to launc...

Researchers Allege 'Systemic' Privacy, Security Flaws in Popular IoT Devices

Researchers are highlighting the insecure nature of Internet of Things devices in a report released Tuesday alleging a bevy of popular consumer connected devices sold at major retailers such as Walmart and Best Buy are riddled with security holes and privacy issues. In analyzing 12 different IoT...

The vulnerability of the management tool for virtual infrastructure, VMware vCenter Server, related to the unencrypted data transmission process, allows attackers to access confidential information.

The vulnerability of the VMware vCenter Server virtualization infrastructure relates to the unencrypted data transfer between storage repositories. Exploiting this vulnerability can allow an attacker to gain access to confidential information during the movement of a virtual machine between stora...

The Advantages of a More Secure and Safer Blockchain

By Waqas Blockchain technology has many uses and advantages over other types of ledger-based technology. One aspect of blockchain technology that is especially valuable today is the ability to securely and safely transmit data to and from two or more parties. This is particularly important when t...

Code injection

Philips e-Alert Unit non-medical device, Version R2.1 and prior. The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. The Philips e-Alert communication channel is not encrypted which could therefore lead to...

Zabbix Threat Control - Zabbix Vulnerability Assessment Plugin

This plugin transforms your Zabbix monitoring system into vulnerability, risk and security managment system for your infrastructure. What the plugin does It provides Zabbix with information about vulnerabilities existing in your entire infrastructure and suggests easily applicable remediation...