CVE-2019-13349

In Knowage through 6.1.1, an authenticated user that accesses the users page will obtain all user password hashes...

CVE-2019-13349: Insufficiently Protected Credentials

In Knowage through 6.1.1, an authenticated user that accesses the users page will obtain all user password hashes...

PT-2019-13283

Name of the Vulnerable Software and Affected Versions Knowage versions prior to 6.1.2 Description The issue allows an authenticated user who accesses the users page to obtain all user password hashes. Recommendations For versions prior to 6.1.2, update to version 6.1.2 or later to resolve the iss...

PT-2019-3130

Name of the Vulnerable Software and Affected Versions Cisco Small Business RV160, RV260, and RV340 affected versions not specified Description The issue is related to the use of hardcoded password hashes for users root, debug-admin, cisco, admin, and guest. This could allow a remote attacker to...

XKCD Forum Hacked – Over 562,000 Users' Account Details Leaked

XKCD —one of the most popular webcomic platforms known for its geeky tech humor and other science-laden comic strips on romance, sarcasm, math, and language—has suffered a data breach exposing data of its forum users. The security breach occurred two months ago, according to security researcher...

mantis -- multiple vulnerabilities

The Mantis developers report: CVE-2019-15715: Admin Required - Post Authentication Command Execution / Injection Vulnerability CVE-2019-8331: In Bootstrap before 3.4.1, XSS is possible in the tooltip or popover data-template attribute Missing integrity hashes for CSS resources from CDNs...

CVE-2019-13421

Search Guard versions before 23.1 had an issue that an administrative user is able to retrieve bcrypt password hashes of other users configured in the internal user database...

CVE-2019-13421

The CVE-2019-13421 affects floragunn Search Guard (Elasticsearch/ELK plug‑ins). Versions before 23.1 expose an information-disclosure flaw whereby an administrative user can retrieve bcrypt password hashes of other users from the internal user database. The issue is confirmed across multiple sour...

CVE-2019-13421

Search Guard versions before 23.1 had an issue that an administrative user is able to retrieve bcrypt password hashes of other users configured in the internal user database...

CVE-2019-13421: Insufficiently Protected Credentials

Search Guard versions before 23.1 had an issue that an administrative user is able to retrieve bcrypt password hashes of other users configured in the internal user database...

PT-2019-13333

Name of the Vulnerable Software and Affected Versions Search Guard versions prior to 23.1 Description The issue allows an administrative user to retrieve bcrypt password hashes of other users configured in the internal user database. Recommendations For versions prior to 23.1, update to version...

Threat Roundup for August 9 to August 16

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Aug. 9 and Aug. 16. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics,...

Security Bulletin: IBM MQ Appliance is affected by a Network Security Services (NSS) vulnerability (CVE-2017-7805)

Summary IBM MQ Appliance has addressed a vulnerability in Network Security Services NSS. Vulnerability Details CVEID: CVE-2017-7805 DESCRIPTION: Network Security Services could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free in TLS 1.2 generating...

glpi -- Account takeover vulnerability

MITRE Corporation reports: GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. The lack of correct validation leads to recovery of the token generated via the password reset functionality, and thus an authenticated attacker can set an...

CVE-2016-10841

The bin/mkvhostspasswd script in cPanel before 11.54.0.4 discloses password hashes SEC-73...

CVE-2016-10841

The bin/mkvhostspasswd script in cPanel before 11.54.0.4 discloses password hashes SEC-73...

Default credentials

The bin/mkvhostspasswd script in cPanel before 11.54.0.4 discloses password hashes SEC-73...

CVE-2016-10841

The CVE-2016-10841 entry concerns cPanel prior to 11.54.0.4 where the bin/mkvhostspasswd script discloses password hashes (SEC-73). Public references (NVD, Red Hat, CNVD, CVE lists) corroborate that the issue is a leakage of password hashes, not a user password exposure directly, and exploitation...

CVE-2016-10841

The bin/mkvhostspasswd script in cPanel before 11.54.0.4 discloses password hashes SEC-73...

Threat Roundup for July 5 to July 12

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between July 5 and July 12. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics,...