Photo Vault 1.2 Brute Forcing Issue

Document Title: =============== Photo Vault v1.2 iOS - Insecure Authentication Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2110 Release Date: ============= 2018-01-16 Vulnerability Laboratory ID VL-ID:...

Photo Vault 1.2 iOS - Insecure Authentication Vulnerability

Document Title: =============== Photo Vault 1.2 iOS - Insecure Authentication Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2110 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20371 CVE-ID: ======= CVE-2018-20371 Release Date:...

CVE-2017-16673

Datto Backup Agent 1.0.6.0 and earlier does not authenticate incoming connections. This allows an attacker to impersonate a Datto Backup Appliance to "pair" with the agent and issue requests to this agent, if the attacker can reach the agent on TCP port 25566 or 25568, and send unspecified...

CURL-CVE-2016-9594 uninitialized random

libcurl's new internal function that returns a good 32-bit random value was implemented poorly and overwrote the pointer instead of writing the value into the buffer the pointer pointed to. This random value is used to generate nonces for Digest and NTLM authentication, for generating boundary...

Multiple vulnerabilities in extension "Ajax mail subscription" (ods_ajaxmailsubscription)

It has been discovered that the extension "Ajax mail subscription" odsajaxmailsubscription is susceptible to Insecure Authentication and Session Handling. Release Date: March 24, 2016 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected...

Apache Subversion Insecure Authentication Weakness Vulnerability

Apache Subversion is prone to an authentication weakness vulnerability. Copyright C 2016 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

ESC 8832 Data Controller Multiple Vulnerabilities

Exploit for hardware platform in category web applications =begin Exploit Title: ESC 8832 Data Controller multiple vulnerabilities Date: 2014-05-29 Platform: SCADA / Web Application Exploit Author: Balazs Makany Vendor Homepage: www.envirosys.com Version: ESC 8832 Data Controller Hardware Tested...

candlepin: insecure authentication enabled by default

Candlepin in Red Hat Subscription Asset Manager 1.0 through 1.3 uses a weak authentication scheme when the configuration file does not specify a scheme, which has unspecified impact and attack vectors...

Apple iOS < 6.1 Multiple Vulnerabilities

Binary data 6679.prm...

Fedora 16 : moodle-2.0.9-1.fc16 (2012-8325)

CVE-2012-2353 MSA-12-0024: Hidden information access issue CVE-2012-2354 MSA-12-0025: Personal communication access issue CVE-2012-2355 MSA-12-0026: Quiz capability issue CVE-2012-2356 MSA-12-0027: Question bank capability issues CVE-2012-2357 MSA-12-0028: Insecure authentication issue...

Fedora 17 : moodle-2.2.3-1.fc17 (2012-8284)

CVE-2012-2353 MSA-12-0024: Hidden information access issue CVE-2012-2354 MSA-12-0025: Personal communication access issue CVE-2012-2355 MSA-12-0026: Quiz capability issue CVE-2012-2356 MSA-12-0027: Question bank capability issues CVE-2012-2357 MSA-12-0028: Insecure authentication issue...

Fedora 15 : moodle-1.9.18-1.fc15 (2012-8365)

CVE-2012-2353 MSA-12-0024: Hidden information access issue CVE-2012-2354 MSA-12-0025: Personal communication access issue CVE-2012-2355 MSA-12-0026: Quiz capability issue CVE-2012-2356 MSA-12-0027: Question bank capability issues CVE-2012-2357 MSA-12-0028: Insecure authentication issue...

HTTP Server Insecure Authentication (Basic)

Binary data 6479.prm...

Siemens Simatic HMI Authentication Vulnerabilities

Overview ICS-CERT is aware of a public report by independent security researchers Billy Rios and Terry McCorkle concerning authentication bypass vulnerabilities affecting Siemens SIMATIC HMI products which are supervisory control and data acquisition/human-machine interface SCADA/HMI products...

Multiple vulnerabilities in TYPO3 Core

It has been discovered that TYPO3 Core is vulnerable to Cross-Site Scripting, SQL-Injection, Remote Command Execution, Information Disclosure and insecure Install Tool authentication/session handling. Component Type: TYPO3 Core Affected Versions: TYPO3 versions 4.0.13 and below, 4.1.12 and below,...

Design/Logic Flaw

backup-database.php in TorrentTrader Classic 1.09 does not require administrative authentication, which allows remote attackers to create and download a backup database by making a direct request and then retrieving a .gz file from backups/...

CVE-2007-4926

The AXIS 207W camera uses a base64-encoded cleartext username and password for authentication, which allows remote attackers to obtain sensitive information by sniffing the wireless network or by leveraging unspecified other vectors...

[SA17307] ar-blog Script Insertion and Authentication Bypass Vulnerabilities

TITLE: ar-blog Script Insertion and Authentication Bypass Vulnerabilities SECUNIA ADVISORY ID: SA17307 VERIFY ADVISORY: http://secunia.com/advisories/17307/ CRITICAL: Moderately critical IMPACT: Security Bypass, Cross Site Scripting WHERE: From remote SOFTWARE: ar-blog 5.x...

KLA10377 WLF vulnerability in Veritas Backup Exec

An insecure auth was found in Veritas Backup Exec. By exploiting this vulnerability malicious users can read & write arbitrary code. This vulnerability can be exploited remotely at a point related to NDMP agent. Original advisories Symantec bulletin Related products VERITAS-Backup-Exec CVE list...

CVE-2000-0542

Technical details about CVE-2000-0542 are not provided in the connected documents. The available sources list the issue as improper Radius accounting after failed login but no public exploit, patch, or affected versions are detailed here. Monitor for updates.