Open Real Estate SQL Injection Vulnerability

Open Real Estate CMS is a PHP-based content management system. Open Real Estate suffers from a SQL injection vulnerability that allows unauthenticated users to download database content, including password hashes and client details...

File Replication Pro Information Disclosure Vulnerability

File Replication Pro is a file management solution for backing up, copying files from different network nodes. An information disclosure vulnerability exists in File Replication Pro version 7.2.0 and earlier. As File Replication Pro allows a malicious user to access arbitrary files on a remote...

Heuristics File System Secret Search: blueflower

blueflower is a command-line tool that looks for secrets such as private keys or passwords in a file structure. Interesting files are detected using heuristics on their names and on their content. Unlike some forensics tools, blueflower does not search in RAM, and does not attempt to identify...

CVE-2016-2289

Directory traversal vulnerability in ICONICS WebHMI 9 and earlier allows remote attackers to read configuration files, and consequently discover password hashes, via unspecified vectors...

CVE-2016-2289

Directory traversal vulnerability in ICONICS WebHMI 9 and earlier allows remote attackers to read configuration files, and consequently discover password hashes, via unspecified vectors...

Directory traversal

Directory traversal vulnerability in ICONICS WebHMI 9 and earlier allows remote attackers to read configuration files, and consequently discover password hashes, via unspecified vectors...

CVE-2016-2289

ICONICS WebHMI (versions 9 and earlier) suffers a directory traversal flaw (CWE-22) that enables remote attackers to read configuration files and obtain password hashes. Multiple sources (NVD CVE-2016-2289; CNVD-2016-01984; PRION/CVE-2016-2289; ICSA-16-091-01) describe the vulnerability as exploi...

CVE-2016-2289

Directory traversal vulnerability in ICONICS WebHMI 9 and earlier allows remote attackers to read configuration files, and consequently discover password hashes, via unspecified vectors...

CVE-2016-2289: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in ICONICS WebHMI 9 and earlier allows remote attackers to read configuration files, and consequently discover password hashes, via unspecified vectors...

PT-2016-5092

Name of the Vulnerable Software and Affected Versions ICONICS WebHMI versions 9 and earlier Description A directory traversal issue allows remote attackers to read configuration files, which can lead to the discovery of password hashes. Recommendations For ICONICS WebHMI versions 9 and earlier, a...

Uber: SQLi in love.uber.com

@iad found an SQL Injection vulnerability in one of our Wordpress blog's plugins the website being love.uber.com. This blog was hosted at WPEngine and did not contain any of our user's information. However due to our previously vague bug bounty rules we decided to reward the maximum of 3,000$ sin...

Machinae - Security Intelligence Collector

Machinae is a tool for collecting intelligence from public sites/feeds about various security-related pieces of data: IP addresses, domain names, URLs, email addresses, file hashes and SSL fingerprints. It was inspired by Automater , another excellent tool for collecting information. The Machinae...

Security Intelligence Collector: Machinae

Machinae is a tool for collecting intelligence from public sites/feeds about various security-related pieces of data: IP addresses, domain names, URLs, email addresses, file hashes and SSL fingerprints. It was inspired by Automater , another excellent tool for collecting information. The Machinae...

Cerberus Helpdesk User Hash Disclosure

This module extracts usernames and password hashes from the Cerberus Helpdesk through an unauthenticated access to a workers file. Verified on Version 4.2.3 Stable Build 925 and 5.4.4 Module Options msf use auxiliary/gather/cerberus/helpdeskhashdisclosure msf undefinedhelpdeskhashdisclosure show...

Fedora 23 : prosody-0.9.9-2.fc23 (2016-38e48069f8)

Prosody 0.9.9 ============= A summary of changes: Security fixes -------------- Fix path traversal vulnerability in modhttpfiles CVE-2016-1231 Fix use of weak PRNG in generation of dialback secrets CVE-2016-1232 Bugs ---- Improve handling of CNAME records in DNS Fix traceback when deleting a user...

Fedora 22 : prosody-0.9.9-2.fc22 (2016-e289f41b76)

Prosody 0.9.9 ============= A summary of changes: Security fixes -------------- Fix path traversal vulnerability in modhttpfiles CVE-2016-1231 Fix use of weak PRNG in generation of dialback secrets CVE-2016-1232 Bugs ---- Improve handling of CNAME records in DNS Fix traceback when deleting a user...

SAUTER moduWeb Vision Authentication Bypass

The vulnerability of the BACnet/IP network controller visualization web server from SAUTER moduWeb Vision is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to bypass authentication procedures by utilizing knowledge of password hashes without knowi...

Open Real Estate 1.15.1 XSS / SQL Injection / Weak Hashing

Introduction: Open Real Estate is an open source CMS for managing estate agent websites. It is written in PHP and uses the YII CMF. It supports multiple languages. It is supported by MonoRay.net The product has a number of commercial support offerings available and an internal market for...

Code injection

ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.kPE allow remote attackers to discover usernames and password hashes by reading the cgi-bin/webproc HTML source code, a different vulnerability than CVE-2015-8703...

CVE-2015-7248

CVE-2015-7248 affects ZTE ZXHN H108N R1A and ZXV10 W300 routers. The vulnerability enables information exposure by allowing remote attackers to read the cgi-bin/webproc HTML source and obtain usernames and password hashes. This is a separate issue from CVE-2015-8703. Public sources in the connect...