CVE-2015-7248

ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.kPE allow remote attackers to discover usernames and password hashes by reading the cgi-bin/webproc HTML source code, a different vulnerability than CVE-2015-8703...

CVE-2015-7248: Exposure of Sensitive Information to an Unauthorized Actor

ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.kPE allow remote attackers to discover usernames and password hashes by reading the cgi-bin/webproc HTML source code, a different vulnerability than CVE-2015-8703...

PT-2015-7491

Name of the Vulnerable Software and Affected Versions ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k PE Description The issue allows remote attackers to discover usernames and password hashes by reading the cgi-bin/webproc HTML source code. Recommendations For ZTE ZXHN H108N R1A devices...

L-Switch and L-IP router systems Backup File Access

The vulnerability of L-Switch and L-IP router microprogramming systems is related to insufficient protection of registration data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to backup files containing hashed passwords...

LOYTEC LIP-3ECTB-100 LVIS-3E100LIP-ME201 devices Information Disclosure Vulnerability

LOYTEC LIP devices are IP network router devices from LOYTEC Germany. An information disclosure vulnerability exists in the LOYTEC LIP-3ECTB 6.0.1, LINX-100, LVIS-3E100,LIP-ME201 devices. Allows a remote attacker to read a backup file of password hashes via an unspecified vector...

PT-2015-2902

Name of the Vulnerable Software and Affected Versions LOYTEC LIP-3ECTB version 6.0.1 LINX-100 LVIS-3E100 LIP-ME201 Description The issue is related to insufficient protection of registration data in the firmware of certain devices. This could allow a remote attacker to gain access to a backup fil...

13 Million MacKeeper Users Hacked — 21 GB of Data Exposed

MacKeeper anti-virus company is making headlines today for its lax security that exposed the database of 13 Million Mac users' records including names, email addresses, usernames, password hashes, IP addresses, phone numbers, and system information. MacKeeper is a suite of software that claims to...

oclHashcat v2.01 - Worlds Fastest Password Cracker

oclHashcat is the world's fastest and most advanced GPGPU-based password recovery utility, supporting five unique modes of attack for over 170 highly-optimized hashing algorithms. oclHashcat currently supports AMD OpenCL and Nvidia CUDA graphics processors on GNU/Linux and Windows 7/8/10, and has...

Brocade Fabric OS 6.3.1b Weak System Configuration

Title: Brocade Fabric OS v6.3.1b - Multiple vulnerabilities Discovered by: Karn Ganeshen Vendor Homepage: www.brocade.com Versions Reported: Kernel 2.6.14.2 + FabOS v6.3.1b + BootProm 1.0.9 version Kernel: 2.6.14.2 Fabric OS: v6.3.1b BootProm: 1.0.9 1 Default diagnostic accounts root and factory...

WordPress W3 Total Cache Security Credentials Hash Extract

A hash extract vulnerability has been reported in WordPress W3 Total Cache Plugin. Successful exploitation of this vulnerability would allow a remote attacker to obtain username and password hashes from affected WordPress servers...

CVE-2013-4577

A certain Debian patch for GNU GRUB uses world-readable permissions for grub.cfg, which allows local users to obtain password hashes, as demonstrated by reading the passwordpbkdf2 directive in the file...

SSH Port Knocking

In computer networking, port knocking is a method of externally opening ports on a firewall by generating a connection attempt on a set of pre-specified closed ports. Once a correct sequence of connection attempts is received, the firewall rules are dynamically modified to allow the host which se...

Joomla com_contenthistory Error-Based SQL Injection

This module exploits a SQL injection vulnerability in Joomla versions 3.2 through 3.4.4 in order to either enumerate usernames and password hashes. Module Options msf use auxiliary/gather/joomla/contenthistorysqli msf undefinedcontenthistorysqli show actions ...actions... msf...

Joomla Real Estate Manager Component Error-Based SQL Injection

This module exploits a SQL injection vulnerability in Joomla Plugin comrealestatemanager versions 3.7 in order to either enumerate usernames and password hashes. Module Options msf use auxiliary/gather/joomla/comrealestatemanagersqli msf undefinedcomrealestatemanagersqli show actions ...actions...

CVE-2015-2864

Retrospect and Retrospect Client before 10.0.2.119 on Windows, before 12.0.2.116 on OS X, and before 10.0.2.104 on Linux improperly generate password hashes, which makes it easier for remote attackers to bypass authentication and obtain access to backup files by leveraging a collision...

Authentication flaw

Retrospect and Retrospect Client before 10.0.2.119 on Windows, before 12.0.2.116 on OS X, and before 10.0.2.104 on Linux improperly generate password hashes, which makes it easier for remote attackers to bypass authentication and obtain access to backup files by leveraging a collision...

CVE-2015-2864

Retrospect and Retrospect Client suffer from weak password hashing (CVE-2015-2864). Prior to updates, password hashes could collide, enabling a remote attacker with network access to bypass authentication and access backup files. Affected versions include Windows clients before 10.0.2.119, macOS ...

CVE-2015-2864

Retrospect and Retrospect Client before 10.0.2.119 on Windows, before 12.0.2.116 on OS X, and before 10.0.2.104 on Linux improperly generate password hashes, which makes it easier for remote attackers to bypass authentication and obtain access to backup files by leveraging a collision...

LOYTEC Router Information Exposure Vulnerability

OVERVIEW Independent researcher Maxim Rupp has identified a password file vulnerability in LOYTEC’s LIP-3ECTB routers. LOYTEC has produced a firmware update to mitigate this vulnerability. This vulnerability could be exploited remotely. AFFECTED PRODUCTS The following LOYTEC routers are affected:...

Raritan PowerIQ Default Accounts

Hello list, Raritan PowerIQ ships with a few default accounts and passwords/hashes. For the web interface, there are technically 3 default users. webapi:sl33p30F00dumass! epiqapi:raritan admin:raritan You can technically authenticate with the epiqapi user on the web interface and the PowerIQ API,...