Vulnerability in Driver Distributor where passwords are stored in a recoverable format

Overview Driver Distributor provided by FUJIFILM Business Innovation Corp. contains a vulnerability where passwords are stored in a recoverable format CWE-257. Sato Ryo, Yokoi Hiroshi, and Shiga Takuma of BroadBand Security, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the...

FUJIFILM Driver Distributor 加密问题漏洞

FUJIFILM Driver Distributor is a driver from FUJIFILM. A security vulnerability exists in FUJIFILM Driver Distributor v2.2.3.1 and earlier versions, which originates from passwords being stored in a recoverable format, and encrypted administrator credentials can be decrypted if an attacker gains...

JVN#22830348: Vulnerability in Driver Distributor where passwords are stored in a recoverable format

Driver Distributor provided by FUJIFILM Business Innovation Corp. contains a vulnerability where passwords are stored in a recoverable format CWE-257. Impact If an attacker obtains a configuration file of Driver Distributor, the encrypted administrator's credentials may be decrypted. Solution...

CVE-2022-39848

Exposure of sensitive information in ATDistributor prior to SMR Oct-2022 Release 1 allows local attacker to access SerialNo via log...

CVE-2022-39848

Exposure of sensitive information in ATDistributor prior to SMR Oct-2022 Release 1 allows local attacker to access SerialNo via log...

SAMSUNG Mobile devices 信息泄露漏洞

SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc. from Samsung South Korea. A security vulnerability exists in SAMSUNG Mobile devices SMR Oct-2022 Release 1 version, which originates from exposing sensitive information in ATDistributor. A local...

Popular YouTube Channel Caught Distributing Malicious Tor Browser Installer

A popular Chinese-language YouTube channel has emerged as a means to distribute a trojanized version of a Windows installer for the Tor Browser. Kaspersky dubbed the campaign OnionPoison, with all of the victims located in China. The scale of the attack remains unclear, but the Russian...

Nigerian Tesla: 419 scammer gone malware distributor unmasked

Agent Tesla is a well-known data stealer written in .NET that has been active since 2014 and is perhaps one of the most popular payloads observed in malspam campaigns. While looking for threats targeting Ukraine, we identified a group we call "Nigerian Tesla" that has been dabbling into phishing...

WordPress Narnoo Distributor plugin path traversal vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress plugin is a WordPress open source application plugin . A path traversal vulnerability exists in WordPress Narnoo...

CVE-2022-0679

The Narnoo Distributor WordPress plugin through 2.5.1 fails to validate and sanitize the libpath parameter before it is passed into a call to require via the narnoodistributorlibrequest AJAX action available to both unauthenticated and authenticated users which results in the disclosure of...

CVE-2022-0679

The Narnoo Distributor WordPress plugin through 2.5.1 fails to validate and sanitize the libpath parameter before it is passed into a call to require via the narnoodistributorlibrequest AJAX action available to both unauthenticated and authenticated users which results in the disclosure of...

CVE-2022-0679

The Narnoo Distributor WordPress plugin through 2.5.1 fails to validate and sanitize the libpath parameter before it is passed into a call to require via the narnoodistributorlibrequest AJAX action available to both unauthenticated and authenticated users which results in the disclosure of...

Design/Logic Flaw

The Narnoo Distributor WordPress plugin through 2.5.1 fails to validate and sanitize the libpath parameter before it is passed into a call to require via the narnoodistributorlibrequest AJAX action available to both unauthenticated and authenticated users which results in the disclosure of...

CVE-2022-0679

CVE-2022-0679 affects the WordPress Narnoo Distributor plugin (versions = 2.5.2) or apply vendor-provided patches. If upgrading is not possible, mitigate where feasible by reviewing the handling of lib_path, access controls for the AJAX action, and server file permissions. This CVE description is...

Rapid7 Announces Partner of the Year Awards 2022 Winners

It’s with immense pleasure that we announce today the winners of the Rapid7 Partner of the Year Awards 2022. All our category winners have achieved exceptional growth, demonstrating dedication and collaboration to the Rapid7 Partner Program throughout the year. We’re very proud to share our...

PT-2022-13353

Name of the Vulnerable Software and Affected Versions Narnoo Distributor WordPress plugin versions 2.5.1 and earlier Description The issue arises from the failure to validate and sanitize the lib path parameter, which is then passed into a call to require via the "narnoo distributor lib request"...

WordPress plugin Narnoo Distributor 路径遍历漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress plugin is a WordPress open source application plugin . A path traversal vulnerability exists in WordPress Narnoo...

CVE-2022-0679: Improper Limitation of a Pathname to a Restricted Directory

The Narnoo Distributor WordPress plugin through 2.5.1 fails to validate and sanitize the libpath parameter before it is passed into a call to require via the narnoodistributorlibrequest AJAX action available to both unauthenticated and authenticated users which results in the disclosure of...

Narnoo Distributor <= 2.5.1 - Unauthenticated LFI to Arbitrary File Read / RCE

The plugin fails to validate and sanitize the libpath parameter before it is passed into a call to require via the narnoodistributorlibrequest AJAX action available to both unauthenticated and authenticated users which results in the disclosure of arbitrary files as the content of the file is the...

WordPress Narnoo Distributor plugin <= 2.5.1 - Unauthenticated Local File Inclusion (LFI) vulnerability leading to Arbitrary File Read / RCE

Unauthenticated Local File Inclusion LFI vulnerability leading to Arbitrary File Read / RCE discovered by cydave in WordPress Narnoo Distributor plugin versions = 2.5.1. Solution Deactivate and delete. This plugin has been closed as of February 18, 2022 and is not available for download. This...