Bachmann Visutec GmbH Atvise License registration information disclosure vulnerability

Summary An information disclosure vulnerability exists in the License registration functionality of Bachmann Visutec GmbH Atvise 3.5.4, 3.6 and 3.7. A plaintext HTTP request can lead to a disclosure of login credentials. An attacker can perform a man-in-the-middle attack to trigger this...

New Zimbra Email Vulnerability Could Let Attackers Steal Your Login Credentials

A new high-severity vulnerability has been disclosed in the Zimbra email suite that, if successfully exploited, enables an unauthenticated attacker to steal cleartext passwords of users sans any user interaction. "With the consequent access to the victims' mailboxes, attackers can potentially...

Scoop: Uganda Security Exchange Caught Leaking 32GB of Sensitive Data

By Waqas Apart from personal and financial records, the data also included plain-text login credentials including usernames and passwords of… This is a post from HackRead.com Read the original post: Scoop: Uganda Security Exchange Caught Leaking 32GB of Sensitive Data...

The vulnerability of the FortiOS operating system, related to the unencrypted storage of confidential information, allows attackers to obtain user credentials when a user logs into the system.

The vulnerability of the FortiOS operating system is related to the unencrypted storage of confidential information. Exploiting this vulnerability could allow a malicious actor, operating remotely, to obtain the login credentials of users who access the system...

US Sentence Ukrainian to 4 Years for Brute-forcing and Selling Login Credentials

By Deeba Ahmed The 28-year-old Ukrainian national Glib Oleksandr Ivanov-Tolpintsev was arrested in Poland and extradited to the USA in 2020.… This is a post from HackRead.com Read the original post: US Sentence Ukrainian to 4 Years for Brute-forcing and Selling Login Credentials...

Improper Input Validation in Jenkins

A unauthorized modification of configuration vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in User.java that allows attackers to provide crafted login credentials that cause Jenkins to move the config.xml file from the Jenkins home directory. If Jenkins is started without...

IBM InfoSphere Information Server Cross-Site Scripting Vulnerability (CNVD-2022-38558)

IBM InfoSphere Information Server is a data integration software platform. A cross-site scripting vulnerability exists in IBM InfoSphere Information Server, which can be exploited by attackers to execute malicious code, tamper with pages to perform phishing attacks, and trick users into logging i...

Limbas Cross-Site Scripting Vulnerability

Limbas is a web-based enterprise software factory. A cross-site scripting vulnerability exists in Limbas version 4.3.36.1319, which can be exploited to execute malicious code, tamper with pages to perform phishing attacks, and trick users into logging in again and then obtaining their login...

Crooks Spoofing Credit Unions to Steal Funds and Login Credentials

By Deeba Ahmed Email security provider Avanan revealed in a Thursday report that a new phishing campaign exploits local credit unions… This is a post from HackRead.com Read the original post: Crooks Spoofing Credit Unions to Steal Funds and Login Credentials...

MISP Cross-Site Scripting Vulnerability (CNVD-2022-64095)

MISP is an open source software solution. The product is used to collect, store, distribute, and share network security metrics, and has features such as threat network security event analysis and malware analysis. cross-site scripting vulnerabilities exist in versions of MISP prior to 2.4.158,...

MISP Cross-Site Scripting Vulnerability (CNVD-2022-64094)

MISP is an open source software solution. The product is used to collect, store, distribute, and share network security metrics, and has features such as threat network security event analysis and malware analysis. cross-site scripting vulnerabilities exist in versions of MISP prior to 2.4.158,...

Hardcoded credentials

Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has Use of Hard-coded Cryptographic Key vulnerability. An attacker can use hard coding to generate login credentials of any user and log in to the service background located at different IP address...

CVE-2022-24860 Databasir 1.01 has Use of Hard-coded Cryptographic Key vulnerability.

Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has Use of Hard-coded Cryptographic Key vulnerability. An attacker can use hard coding to generate login credentials of any user and log in to the service background located at different IP address...

CVE-2022-24860 Databasir 1.01 has Use of Hard-coded Cryptographic Key vulnerability.

Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has Use of Hard-coded Cryptographic Key vulnerability. An attacker can use hard coding to generate login credentials of any user and log in to the service background located at different IP address...

HTMLy cross-site scripting vulnerability (CNVD-2022-82256)

HTMLy is an open source database-free PHP blogging platform. A cross-site scripting vulnerability exists in HTMLy version 2.8.1, which originates from the "description" field in the admin/config and index.php pages. The vulnerability can be exploited to execute malicious code, manipulate pages to...

HTMLy cross-site scripting vulnerability (CNVD-2022-82257)

HTMLy is an open source database-free PHP blogging platform. A cross-site scripting vulnerability exists in HTMLy version 2.8.1, which originates from the presence of the "copyright" field in the /admin/config page. The vulnerability can be exploited to execute malicious code, manipulate pages to...

Fingerprint Attendance 1.0 Account Takeover

Title: Fingerprint Attendance 1.0 Account Takeover Author: Hejap Zairy Date: 29.07.2022 Vendor: https://www.vetbossel.in/fingerprint-attendance-project-php/ Software: https://app.box.com/s/xlyqalhvayq8oi25tqykcbouzrrjytqy Reference: https://github.com/Matrix07ksa Tested on: Windows, MySQL, Apache...

Authentication flaw

Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as rest resources did not check if users were beyond their max failed login limits and therefore required solving a CAPTCHA in addition to providing user credentials...

TeaBot Trojan Haunts Google Play Store, Again

The TeaBot banking trojan – also known as “Anatsa” – has been spotted on the Google Play store, researchers from Cleafy have discovered. The malware – designed to intercept SMS messages and login credentials from unwitting users – affected users of “more than 400 banking and financial apps,...

containers/image library Insufficiently Protects Credentials

The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launc...