Password Disclosure

github.com/mattermost/mattermost-server is vulnerable to Password Disclosure. The vulnerability exists because the user passwords and user hashes were revealed in audit logs if the experimental audit logging configuration was enabled ExperimentalAuditSettings section in config...

ShadowSpray - A Tool To Spray Shadow Credentials Across An Entire Domain In Hopes Of Abusing Long Forgotten GenericWrite/GenericAll DACLs Over Other Objects In The Domain

A tool to spray Shadow Credentials across an entire domain in hopes of abusing long forgotten GenericWrite/GenericAll DACLs over other objects in the domain. Why this tool In a lot of engagements I see in BloodHound that the group "Everyone" / "Authenticated Users" / "Domain Users" or some other...

Threat Roundup for May 5 to May 12

Today, Talos is publishing a glimpse into the most prevalent threats weve observed between May 5 and May 12. As with previous roundups, this post isnt meant to be an in-depth analysis. Instead, this post will summarize the threats weve observed by highlighting key behavioral characteristics,...

vscode -- Visual Studio Code Information Disclosure Vulnerability

[email protected] reports: Visual Studio Code Information Disclosure Vulnerability A information disclosure vulnerability exists in VS Code 1.78.0 and earlier versions on Windows when file system operations are performed on malicious UNC paths. Examples include reading or resolving metadata of...

Exploit for Improper Input Validation in Microsoft

PoC exploit for CVE-2023-23397, a vulnerability in the Apache HT...

Ubuntu: Security Advisory (USN-6053-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-6053-1: PHP vulnerability

It was discovered that PHP incorrectly handled certain invalid Blowfish password hashes. An invalid password hash could possibly allow applications to accept any password as valid, contrary to expectations...

Ubuntu 16.04 ESM : PHP vulnerability (USN-6053-1)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-6053-1 advisory. It was discovered that PHP incorrectly handled certain invalid Blowfish password hashes. An invalid password hash could possibly allow applications to accept any...

USN-6042-1 cloud-init vulnerability

James Golovich discovered that sensitive data could be exposed in logs. An attacker could use this information to find hashed passwords and possibly escalate their privilege...

PT-2023-17244

Name of the Vulnerable Software and Affected Versions cloud-init versions prior to 23.1.2 Description The issue allows sensitive data to be exposed in logs, which an attacker could use to find hashed passwords and possibly escalate their privilege. Recommendations For versions prior to 23.1.2,...

cloud-init 日志信息泄露漏洞

cloud-init is an industry-standard multi-distribution method for cross-platform cloud instance initialization open-sourced by Canonical. A security vulnerability exists in cloud-init versions prior to 23.1.2, which stems from the possibility of exposing sensitive data in logs. An attacker exploit...

CVE-2023-22577

Within White Rabbit Switch it's possible as an unauthenticated user to retrieve sensitive information such as password hashes and the SNMP community strings...

CVE-2023-22577

Within White Rabbit Switch it's possible as an unauthenticated user to retrieve sensitive information such as password hashes and the SNMP community strings...

Information disclosure

Within White Rabbit Switch it's possible as an unauthenticated user to retrieve sensitive information such as password hashes and the SNMP community strings...

CVE-2023-22577

The CVE-2023-22577 issue affects White Rabbit Switch, where an unauthenticated user can retrieve sensitive information (password hashes and SNMP community strings). Connected sources consistently describe information disclosure as the impact. Root cause details are not explicitly provided in the ...

CVE-2023-22577 White Rabbit Switch - Password Disclosure Vulnerability

Within White Rabbit Switch it's possible as an unauthenticated user to retrieve sensitive information such as password hashes and the SNMP community strings...

White Rabbit Switch 安全漏洞

The White Rabbit Switch WRS is an open hardware design from the OPEN HARDWARE organization. A security vulnerability exists in White Rabbit Switch. An attacker exploiting this vulnerability could retrieve sensitive information such as password hashes and SNMP community strings...

PT-2023-18561 · Unknown · White Rabbit Switch

Name of the Vulnerable Software and Affected Versions: White Rabbit Switch affected versions not specified Description: The issue allows an unauthenticated user to retrieve sensitive information, including password hashes and SNMP community strings. Recommendations: At the moment, there is no...

CVE-2023-22577: Exposure of Sensitive Information to an Unauthorized Actor

Within White Rabbit Switch it's possible as an unauthenticated user to retrieve sensitive information such as password hashes and the SNMP community strings...

Threat Roundup for April 14 to April 21

Today, Talos is publishing a glimpse into the most prevalent threats weve observed between April 14 and April 21. As with previous roundups, this post isnt meant to be an in-depth analysis. Instead, this post will summarize the threats weve observed by highlighting key behavioral characteristics,...