Huawei Backup App Reset Session Vulnerability

Huawei Backup App is a cell phone file backup tool. A reset session vulnerability exists in Huawei Backup App, located in the application folder "HuaweiBackup-BackupFiles", which affects a file named info.xml, where encrypted passwords are stored, and can be bypassed and reset by modifying the...

CVE-2017-10935

All versions prior to ZSRV2 V3.00.40 of the ZTE ZXR10 1800-2S products allow remote authenticated users to bypass the original password authentication protection to change other user's password...

DEBIAN-CVE-2018-14345

An issue was discovered in SDDM through 0.17.0. If configured with ReuseSession=true, the password is not checked for users with an already existing session. Any user with access to the system D-Bus can therefore unlock any graphical session. This is related to daemon/Display.cpp and...

UBUNTU-CVE-2018-14345

An issue was discovered in SDDM through 0.17.0. If configured with ReuseSession=true, the password is not checked for users with an already existing session. Any user with access to the system D-Bus can therefore unlock any graphical session. This is related to daemon/Display.cpp and...

phpMyAdmin security bypass vulnerability (CNVD-2018-10169)

phpMyAdmin is a free, web-based MySQL database management tool developed by the phpMyAdmin team. The tool is capable of creating and deleting databases, creating, deleting, and modifying database tables, executing SQL script commands, and more. A security vulnerability exists in the...

CVE-2018-10578

An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices with firmware before 2.0.0.10. Incorrect validation of the "old password" field in the change password form allows an attacker to bypass validation of this field...

CVE-2018-4172

An issue was discovered in certain Apple products. iOS before 11.3 is affected. The issue involves the "Find My iPhone" component. It allows physically proximate attackers to bypass the iCloud password requirement for disabling the "Find My iPhone" feature via vectors involving a backup restore...

CVE-2018-4172

CVE-2018-4172 affects Apple iOS

FreeBSD : mybb -- multiple vulnerabilities (d50a50a2-2f3e-11e8-86f8-00e04c1ea73d)

mybb Team reports : Medium risk: Tasks Local File Inclusion Medium risk: Forum Password Check Bypass Low risk: Admin Permissions Group Title XSS Low risk: Attachment types file extension XSS Low risk: Moderator Tools XSS Low risk: Security Questions XSS Low risk: Settings Management XSS Low risk:...

Authentication flaw

A vulnerability in the RADIUS authentication module of Cisco Policy Suite could allow an unauthenticated, remote attacker to be authorized as a subscriber without providing a valid password; however, the attacker must provide a valid username. The vulnerability is due to incorrect RADIUS user...

Trend Micro Threat Discovery Appliance 2.6.1062r1 - 'dlp_policy_upload.cgi' Remote Code Execution

!/usr/local/bin/python """ Trend Micro Threat Discovery Appliance /opt/TrendMicro/MinorityReport/bin/ Then, all we do is create /engptnstores/prod/sensorSDK/data/si/dlpkill.sh with malicious code and get it executed... Notes: ====== - For this particular PoC, all I did was exec a bind shell using...

PYSEC-2018-48

pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password...

DEBIAN-CVE-2017-1000433

pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password...

CVE-2017-1000433

pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password...

UBUNTU-CVE-2017-1000433

pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password...

Apple MacOS High Sierra Authentication Bypass Vulnerability

Apple macOS High Sierra is a specialized operating system developed by Apple for Mac computers. An authentication bypass vulnerability exists in Apple macOS High Sierra. Due to a logic error in credential validation, an attacker can exploit this vulnerability to bypass administrator authenticatio...

UBUNTU-CVE-2017-8028

In Pivotal Spring-LDAP versions 1.3.0 - 2.3.1, when connected to some LDAP servers, when no additional attributes are bound, and when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the authentication strategy, and setting...

Password Bypass

symfony is vulnerable to password bypass. The library will take an empty password as valid, allowing attackers to bypass password checks by entering a blank password...

Song Song registration system has a universal password login vulnerability

Song Song enrollment system is an asp + access to develop the enrollment system source code. Song Song enrollment system background administrator login entry there is a universal password login vulnerability, attackers can use this vulnerability to bypass the background authentication, so as to...

Password Bypass Vulnerability in Yoosee APP for Android

Yoosee is a free APP customized for the new generation of smart home products by Shenzhen GW Times, which adopts the advanced Cloudlink P2P network transmission technology. There is a password bypass vulnerability in the Android version of Yoosee APP, which can be exploited by an attacker to...