CVE-2021-22853

The HR Portal of Soar Cloud System fails to manage access control. While obtaining user ID, remote attackers can access sensitive data via a specific data packet, such as user’s login information, further causing the login function not to work...

Soar Cloud System HR 安全漏洞

Soar Cloud System is a HR system solution system developed by Soar. Soar Cloud System HR Portal has an access control error that allows remote attackers to access sensitive data through specific packets e.g., user's login information while obtaining a user ID, thus preventing the login function...

Kyland KPS2204 Security Vulnerability

The Kyland KPS2204 is a programmable protocol converter developed for serial device networking applications by Kyland in Beijing, China. A security vulnerability exists in the Kyland KPS2204 6 Port Managed Din-Rail Programmable Device Servers Software Version:R0002.P05, which can be exploited by ...

Weak Password Vulnerability in Enterprise Portal Server Management System of Guangzhou Hotspot Software Technology Co.

The business scope of Guangzhou Hot Spot Software Technology Co., Ltd. includes: manufacturing of communication system equipment; information system integration services; and retailing of communication equipment. The enterprise-level Portal server management system of Guangzhou Hotspot Software...

Leaked database exposed login data of 100k hacked Facebook accounts

By Sudais Asif The leaked database was owned by cybercriminals who hacked Facebook accounts and used them for credit card and Bitcoin scams. This is a post from HackRead.com Read the original post: Leaked database exposed login data of 100k hacked Facebook accounts...

DEBIAN-CVE-2020-8189

A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html including local links when responding with invalid data on the login attempt...

Default credentials

The Infinite Design application 3.4.12 for Android sends a username and password via TCP without any encryption during login, as demonstrated by sniffing of a public Wi-Fi network...

iOS URL Scheme Could Let App-in-the-Middle Attackers Hijack Your Accounts

Security researchers have illustrated a new app-in-the-middle attack that could allow a malicious app installed on your iOS device to steal sensitive information from other apps by exploiting certain implementations of Custom URL Scheme. By default on Apple's iOS operating system, every app runs...

DEBIAN-CVE-2019-12469

MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed username or log in Special:EditTags are exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6...

Citrix UPM + WEM - Google Chrome does not remember user login data

Google Chrome does not remember user login data with any website. Every time users launch Google Chrome in a new Desktop session, they have to type their username even after have enabled the Remember Me option...

CVE-2018-15553

fileshare.cmd on Telus Actiontec T2200H T2200H-31.128L.03 devices allows OS Command Injection via shell metacharacters in the smbdUserid or smbdPasswd field...

ASUS DSL N10 Authentication Bypass Vulnerability

The ASUS DSL N10 is a wired and wireless modem router. ASUS DSL N10 C1 modem firmware version 1.1.2.217 has the loginauthorization parameter in the post data for authorization to access the admin panel, the data for this parameter is not completely random and an attacker could use old data or dat...

CVE-2018-5152

CVE-2018-5152 affects Firefox before 60. WebExtensions with appropriate permissions can inject content scripts into sites like accounts.firefox.com and monitor traffic via webRequest, enabling interception during login and exposure of username and encrypted password. The issue is limited to the l...

CVE-2018-5152

WebExtensions with the appropriate permissions can attach content scripts to Mozilla sites such as accounts.firefox.com and listen to network traffic to the site through the "webRequest" API. For example, this allows for the interception of username and an encrypted password during login to Firef...

Buddypress Xprofile Custom Fields Type 2.6.3 - Remote Code Execution

Exploit Title: Plugin Buddypress Xprofile Custom Fields Type 2.6.3 RCE – Unlink Date: 08/04/2018 Exploit Author: Lenon Leite Vendor Homepage: https://wordpress.org/plugins/buddypress-xprofile-custom-fields-type/ Software Link: https://wordpress.org/plugins/buddypress-xprofile-custom-fields-type/...

Ionic Team Cordova plugin iOS Keychain Information Disclosure Vulnerability

Ionic Team Cordova plugin iOS Keychain is an open source Cordova mobile application development platform plugin for iOS password manager. Ionic Team Cordova plugin iOS Keychain commit 18233ca25dfa92cca018b9c0935f43f78fd77fbf An information disclosure vulnerability exists in the CDVKeychain.m file...

Design/Logic Flaw

In the "NQ Contacts Backup & Restore" application 1.1 for Android, no HTTPS is used for transmitting login and synced user data. When logging in, the username is transmitted in cleartext along with an SHA-1 hash of the password. The attacker can either crack this hash or use it for further attack...

WordPress How-Interest plugin cross-site scripting vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress How-Interest plugin. An attacker can exploit this vulnerability ...

Avira Mobile Security for iOS Information Disclosure Vulnerability

Avira Mobile Security for iOS is a set of mobile security software based on the iOS platform from Avira Germany. An information disclosure vulnerability exists in iOS-based versions of Avira Mobile Security prior to 1.5.11, which originates when the program sends sensitive login information in...

Foxit Reader Information Disclosure Vulnerability (CNVD-2017-08513)

Foxit Reader is China's Foxit Foxit Software Corporation, a PDF document reader. An information disclosure vulnerability exists in Foxit Reader versions prior to 5.4. A man-in-the-middle attacker can exploit this vulnerability to intercept information sent during login API calls...