IBM Spectrum Protect Information Disclosure Vulnerability (CNVD-2017-29916)

IBM Spectrum Protect formerly known as Tivoli Storage Manager is a suite of data protection platforms from U.S.-based IBM that provides organizations with a single point of control and management, and support for backup and recovery of virtual, physical and cloud environments of all sizes. An...

How I discovered CVE-2017-13707

New Vulnerability Found Using Techniques Taught at Black Hat USA One of the topics I teach in Coalfires Adaptive Penetration Testing course, given most recently at Black Hat 2017, is manual privilege escalation on Linux- and Unix-based systems. I also talk about how common it is to gain an initia...

Design/Logic Flaw

IBM Spectrum Protect 7.1 and 8.1 formerly Tivoli Storage Manager disclosed unencrypted login credentials to Vmware vCenter in the application trace output which could be obtained by a local user. IBM X-Force ID: 126875...

CVE-2017-1378

IBM Spectrum Protect 7.1 and 8.1 formerly Tivoli Storage Manager disclosed unencrypted login credentials to Vmware vCenter in the application trace output which could be obtained by a local user. IBM X-Force ID: 126875...

Red Alert 2.0: New Android Banking Trojan for Sale on Hacking Forums

The Recent discoveries of dangerous variants of the Android banking Trojan families, including Faketoken, Svpeng, and BankBot, present a significant threat to online users who may have their login credentials and valuable personal data stolen. Security researchers from SfyLabs have now discovered...

Philips' DoseWise Portal Plaintext Storage Vulnerability

Philips' DoseWise Portal is a web-based reporting and tracking tool for radiation exposure. A plaintext storage vulnerability exists in Philips' DoseWise Portal. An attacker obtains text web application store login credentials in a back-end system file...

D-Link DIR Series Routers Remote Command Execution Vulnerability

The DIR series is a series of cloud router products from AUO D-Link. A remote command execution vulnerability exists in the D-Link DIR series routers. An attacker can obtain the router's backend login credentials and execute arbitrary code through the router's public web portal...

IRS Warns Tax Professionals of New Scam to Steal Passwords

The Internal Revenue Service IRS, acting in concert with state tax agencies and the tax industry, has issued an IRS Security Summit Alert for tax professionals to beware of a new phishing email scam. Scam operators often use fraudulent e-mails to entice their targets to reveal login credentials...

heinekingmedia StashCat for Android Information Disclosure Vulnerability

heinekingmedia StashCat for Android is an Android-based enterprise communication software from the German company heinekingmedia. A security vulnerability exists in heinekingmedia StashCat 1.7.5 and earlier versions for the Android platform. An attacker can exploit the vulnerability to read login...

CVE-2017-11134

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android. The login credentials are written into a log file on the device. Hence, an attacker with access to the logs can read them...

Design/Logic Flaw

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android. The login credentials are written into a log file on the device. Hence, an attacker with access to the logs can read them...

CVE-2017-11134

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android. The login credentials are written into a log file on the device. Hence, an attacker with access to the logs can read them...

Design/Logic Flaw

The Boozt Fashion application before 2.3.4 for Android allows remote attackers to read login credentials by sniffing the network and leveraging the lack of SSL. NOTE: the vendor response, before the application was changed to enable SSL logins, was "At the moment that is an accepted risk. We only...

CVE-2017-11706

The Boozt Fashion application before 2.3.4 for Android allows remote attackers to read login credentials by sniffing the network and leveraging the lack of SSL. NOTE: the vendor response, before the application was changed to enable SSL logins, was "At the moment that is an accepted risk. We only...

CVE-2017-11706

The Boozt Fashion application before 2.3.4 for Android allows remote attackers to read login credentials by sniffing the network and leveraging the lack of SSL. NOTE: the vendor response, before the application was changed to enable SSL logins, was "At the moment that is an accepted risk. We only...

CVE-2017-11706

The CVE concerns the Boozt Fashion Android app prior to version 2.3.4. A remote attacker could read login credentials by sniffing network traffic due to the absence of SSL on login, as described in multiple sources. The vulnerability is tied to insecure credential transmission rather than a clien...

Lenovo System x IMM2 Firmware Certificate Acquisition Vulnerability

Lenovo System x IMM2 is the firmware used in Lenovo servers in which it provides remote monitoring and control of the server. The Lenovo System x IMM2 has a security vulnerability that can be exploited by an attacker to obtain login credentials...

Design/Logic Flaw

An Insufficiently Protected Credentials issue was discovered in Schneider Electric Modicon PLCs Modicon M241, all firmware versions, and Modicon M251, all firmware versions. Log-in credentials are sent over the network with Base64 encoding leaving them susceptible to sniffing. Sniffed credentials...

Microsoft Office Outlook Spoofing Vulnerability - Mac OS X

This host is missing an important security update for Microsoft Office 2016 on Mac OS X according to Microsoft security update June 2017 SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

CVE-2017-3743

The CVE-2017-3743 issue affects Lenovo ToolsCenter components: Advanced Settings Utility (ASU), UpdateXpress System Pack Installer (UXSPI), and Dynamic System Analysis (DSA). When multiple users are concurrently logged into a system and one user issues a command to a second machine, other users m...