Space Coast Credit Union SCCU Mobile for Android and iPhone fails to properly validate SSL certificates

Overview Space Coast Credit Union SCCU Mobile for Android, version 2.1.0.1104 and earlier, and for iOS, version 2.2 and earlier, fails to properly validate SSL certificates provided by HTTPS connections, which may enable an attacker to conduct man-in-the-middle MITM attacks. Description CWE-295:...

Jenkins User Login Information Disclosure Vulnerability

CloudBees Jenkins formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed execution of the task . Jenkin...

CVE-2017-7456

Moxa MXView 2.8 allows remote attackers to cause a Denial of Service by sending overly long junk payload for the MXView client login credentials...

Moxa MXview 2.8 - Denial of Service

Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MOXA-MXVIEW-v2.8-DENIAL-OF-SERVICE.txt + ISR: ApparitionSec Vendor: ============ www.moxa.com Product: =========== MXView v2.8 Download:...

CVE-2017-7576

DragonWave Horizon 1.01.03 wireless radios have hardcoded login credentials such as the username of energetic and password of wireless meant to allow the vendor to access the devices. These credentials can be used in the web interface or by connecting to the device via TELNET. This is fixed in...

Error "License cannot be retrieved. Either the NetScaler..." When Adding NetScaler Instance to NetScaler MAS Inventory

When trying to add NetScaler instance to inventory it fails with the following error message: "Trying to connect to "IPoftheNetScaler" Error: License cannot be retrieved. Either the NetScaler is unresponsive or the login credentials are incorrect."...

CVE-2016-6110

IBM Tivoli Storage Manager discloses unencrypted login credentials to Vmware vCenter that could be obtained by a local user...

CVE-2016-6110

IBM Tivoli Storage Manager discloses unencrypted login credentials to Vmware vCenter that could be obtained by a local user...

FTC: D-Link Failed to Secure Routers, IP Cameras

The Federal Trade Commission acknowledged on Thursday that it takes the security of the so-called internet of things seriously when it leveraged a complaint against one of the more popular router manufacturers. The lawsuit, filed at the U.S. District Court for the Northern District of California,...

Secure Anti Forensic Anonymous Operating System: kodachi

Secure Anti Forensic Anonymous Operating System Linux Kodachi operating system is based on Debian 8.6 it will provide you with a secure, anti forensic, and anonymous operating system considering all features that a person who is concerned about privacy would need to have in order to be secure...

U.S. Dept Of Defense: Default credentials on a DoD website

A Department of Defense website was misconfigured in a manner that may have allowed a malicious user to reset, or steal login credentials. @korprit was able to demonstrate this vulnerability by testing the user account application of the website. Thanks @korprit!...

TP-LINK TDDP Information Disclosure Vulnerability

TP-LINK TDDP is a device commissioning protocol. An information disclosure vulnerability exists in TP-LINK TDDP, which can be exploited to obtain web interface configuration files, including web login credentials...

Sagem Fast 3304-V2 Credential Disclosure

Exploit title: FAST3304v2 Credentials Disclosure vulnerability Author: Nassim Asrir Author Company: HenceForth Author Email: [email protected] Discovered on: 13/11/2016 Tested on: Linux x8664 / Mozilla Firefox 49. Tested Version: Sagem Fast 3304-V2 other versions may also be affected Vendor:...

CVE-2016-3946

SAP Console (aka SAPConsole) 7.30 is affected by an information disclosure vulnerability where local users can read the Windows registry to obtain SAP Server login credentials. Root cause: insecure handling/storage of credentials in the Windows registry as described in SAP Security Note 2121461. ...

CVE-2016-3946

SAP Console aka SAPConsole 7.30 allows local users to discover SAP Server login credentials by reading the Windows registry, aka SAP Security Note 2121461...

Boozt Fashion AB: Android app does not use SSL for login

We tested the Android app, v2.0.2 To replicate: Install the app, and run it until you reach the login screen. Install PacketCapture: https://play.google.com/store/apps/details?id=app.greyshirts.sslcapture Go to PacketCapture, go through setup, SKIP the SSL certificate install process Activate...

Dell SonicWALL Scrutinizer 11.0.1 - setUserSkindeleteTab SQL Injection Remote Code Execution

Dell SonicWALL Scrutinizer 11.0.1 - setUserSkindeleteTab SQL Injection Remote Code Execution !/usr/local/bin/python """ Dell SonicWall Scrutinizer Summary: ======== This exploits an pre-auth SQL Injection in the login.php script within an update statement to steal session data. You could also ste...

Dell SonicWALL Scrutinizer 11.0.1 - setUserSkin/deleteTab SQL Injection Remote Code Execution

!/usr/local/bin/python """ Dell SonicWall Scrutinizer Summary: ======== This exploits an pre-auth SQL Injection in the login.php script within an update statement to steal session data. You could also steal login creds which require absolutely no hash cracking since the target uses symmetric...

SeaWell Networks Spectrum - Multiple Vulnerabilities

SeaWell Networks Spectrum - Multiple Vulnerabilities Exploit Title: SeaWell Networks Spectrum - Multiple Vulnerabilities Discovered by: Karn Ganeshen Vendor Homepage: http://www.seawellnetworks.com/spectrum/ Versions Reported: Spectrum SDC 02.05.00, Build 02.05.00.0016 CVE-ID: CVE-2015-8282...

Mr. Grey Hacker (Wanted by FBI) Steals 1.2 BILLION Login Passwords

That's a lot of Login credentials fetch by a single hacker. The FBI believes a single hacker who goes by the moniker Mr.Grey has stolen login credentials for over 1.2 Billion online accounts – apparently the biggest heist of log-in credentials the FBI has investigated thus far. Yeah, that's not...