Digsby Credential Gatherer

This module searches for Digsby credentials on a Windows host. Module Options msf use post/windows/gather/credentials/digsby msf postdigsby show actions ...actions... msf postdigsby set ACTION msf postdigsby show options ...show and set options... msf postdigsby run This module requires Metasploi...

NCH Quorum 访问控制错误漏洞

NCH Quorum is a teleconference server software. It can turn any computer into a conference call server. An information disclosure vulnerability exists in NCH Quorum, which stems from the fact that the product does not add valid permissions for access to the local .dat file, which could be exploit...

CVE-2021-22310

There is an information leakage vulnerability in some huawei products. Due to the properly storage of specific information in the log file, the attacker can obtain the information when a user logs in to the device. Successful exploit may cause an information leak. Affected product versions includ...

CVE-2021-22853

The HR Portal of Soar Cloud System fails to manage access control. While obtaining user ID, remote attackers can access sensitive data via a specific data packet, such as user’s login information, further causing the login function not to work...

Soar Cloud System HR 安全漏洞

Soar Cloud System is a HR system solution system developed by Soar. Soar Cloud System HR Portal has an access control error that allows remote attackers to access sensitive data through specific packets e.g., user's login information while obtaining a user ID, thus preventing the login function...

Kyland KPS2204 Security Vulnerability

The Kyland KPS2204 is a programmable protocol converter developed for serial device networking applications by Kyland in Beijing, China. A security vulnerability exists in the Kyland KPS2204 6 Port Managed Din-Rail Programmable Device Servers Software Version:R0002.P05, which can be exploited by ...

Weak Password Vulnerability in Enterprise Portal Server Management System of Guangzhou Hotspot Software Technology Co.

The business scope of Guangzhou Hot Spot Software Technology Co., Ltd. includes: manufacturing of communication system equipment; information system integration services; and retailing of communication equipment. The enterprise-level Portal server management system of Guangzhou Hotspot Software...

Leaked database exposed login data of 100k hacked Facebook accounts

By Sudais Asif The leaked database was owned by cybercriminals who hacked Facebook accounts and used them for credit card and Bitcoin scams. This is a post from HackRead.com Read the original post: Leaked database exposed login data of 100k hacked Facebook accounts...

DEBIAN-CVE-2020-8189

A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html including local links when responding with invalid data on the login attempt...

Default credentials

The Infinite Design application 3.4.12 for Android sends a username and password via TCP without any encryption during login, as demonstrated by sniffing of a public Wi-Fi network...

iOS URL Scheme Could Let App-in-the-Middle Attackers Hijack Your Accounts

Security researchers have illustrated a new app-in-the-middle attack that could allow a malicious app installed on your iOS device to steal sensitive information from other apps by exploiting certain implementations of Custom URL Scheme. By default on Apple's iOS operating system, every app runs...

DEBIAN-CVE-2019-12469

MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed username or log in Special:EditTags are exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6...

Citrix UPM + WEM - Google Chrome does not remember user login data

Google Chrome does not remember user login data with any website. Every time users launch Google Chrome in a new Desktop session, they have to type their username even after have enabled the Remember Me option...

CVE-2018-15553

fileshare.cmd on Telus Actiontec T2200H T2200H-31.128L.03 devices allows OS Command Injection via shell metacharacters in the smbdUserid or smbdPasswd field...

ASUS DSL N10 Authentication Bypass Vulnerability

The ASUS DSL N10 is a wired and wireless modem router. ASUS DSL N10 C1 modem firmware version 1.1.2.217 has the loginauthorization parameter in the post data for authorization to access the admin panel, the data for this parameter is not completely random and an attacker could use old data or dat...

CVE-2018-5152

CVE-2018-5152 affects Firefox before 60. WebExtensions with appropriate permissions can inject content scripts into sites like accounts.firefox.com and monitor traffic via webRequest, enabling interception during login and exposure of username and encrypted password. The issue is limited to the l...

CVE-2018-5152

WebExtensions with the appropriate permissions can attach content scripts to Mozilla sites such as accounts.firefox.com and listen to network traffic to the site through the "webRequest" API. For example, this allows for the interception of username and an encrypted password during login to Firef...

Buddypress Xprofile Custom Fields Type 2.6.3 - Remote Code Execution

Exploit Title: Plugin Buddypress Xprofile Custom Fields Type 2.6.3 RCE – Unlink Date: 08/04/2018 Exploit Author: Lenon Leite Vendor Homepage: https://wordpress.org/plugins/buddypress-xprofile-custom-fields-type/ Software Link: https://wordpress.org/plugins/buddypress-xprofile-custom-fields-type/...

Ionic Team Cordova plugin iOS Keychain Information Disclosure Vulnerability

Ionic Team Cordova plugin iOS Keychain is an open source Cordova mobile application development platform plugin for iOS password manager. Ionic Team Cordova plugin iOS Keychain commit 18233ca25dfa92cca018b9c0935f43f78fd77fbf An information disclosure vulnerability exists in the CDVKeychain.m file...

Design/Logic Flaw

In the "NQ Contacts Backup & Restore" application 1.1 for Android, no HTTPS is used for transmitting login and synced user data. When logging in, the username is transmitted in cleartext along with an SHA-1 hash of the password. The attacker can either crack this hash or use it for further attack...