Information Disclosure Vulnerability in D-Link DIR-601

D-Link DIR-601 is a wireless router product from AUO D-Link. A security vulnerability exists in the D-Link DIR-601 A1 version 1.02NA, which can be exploited to obtain information by intercepting the parameters passed to the user to change the password without the need for the current password and...

A week in security (April 30 – May 6)

Last week on Labs, we examined the Spartacus ransomware, reported about a new tactic used by the Necurs malspam campaign, informed you about the recommended Twitter password change, and discussed engaging students to start considering careers in cybersecurity. Other news NTML credentials can be...

Twitter security snafu: change your passwords

If you're logging into Twitter after having been AWOL for a day or two, you'll likely be seeing one of these pop-ups talking about account security: Click to enlarge Don't panic, it's nothing that can't be fixed. The message reads as follows: Keeping your account secure When you set a password fo...

Change Your Twitter Password Immediately, Bug Exposes Passwords in Plaintext

Twitter is urging all of its 330 million users to change their passwords after a software glitch unintentionally exposed its users' passwords by storing them in readable text on its internal computer system. The social media network disclosed the issue in an official blog post and a series of...

Change Your Twitter Password Immediately, Bug Exposes Passwords in Plaintext

Twitter is urging all of its 330 million users to change their passwords after a software glitch unintentionally exposed its users' passwords by storing them in readable text on its internal computer system. The social media network disclosed the issue in an official blog post and a series of...

CVE-2018-10641

D-Link DIR-601 A1 1.02NA devices do not require the old password for a password change, which occurs in cleartext...

CVE-2018-10641

D-Link DIR-601 A1 1.02NA devices do not require the old password for a password change, which occurs in cleartext...

Default credentials

D-Link DIR-601 A1 1.02NA devices do not require the old password for a password change, which occurs in cleartext...

CVE-2018-10641

CVE-2018-10641 affects the D-Link DIR-601 A1 (firmware version 1.02NA). The vulnerability allows password changes without presenting the current password, and the new credentials are transmitted in cleartext. This constitutes an authentication bypass enabling potential information exposure (param...

Hanbanggaoke IP Camera Arbitrary Password Change(CVE-2017-14335)

Vulnerability summary The following advisory describes an arbitrary password change vulnerability found in Hanbanggaoke webcams. Beijing Hanbang Technology, “one of the first enterprises entering into digital video surveillance industry, has been focusing on R&D of products and technology of...

Foscam C1 Indoor HD Camera Command Injection Vulnerability (CNVD-2018-10137)

Foscam C1 Indoor HD Camera is a wireless HD IP camera from Foscam China. A command injection vulnerability exists in the Foscam C1 Indoor HD Camera using application firmware version 2.52.2.37. The vulnerability can be exploited to inject arbitrary shell characters during a password change by...

CVE-2017-2832

An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during a password change resulting in...

Command injection

An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during a password change resulting in...

Cross site request forgery (csrf)

index.php?m=member&v=pwreset in WUZHI CMS 4.1.0 allows CSRF to change the password of a common member...

WUZHI CMS Cross-Site Request Forgery Vulnerability (CNVD-2018-08547)

WUZHI CMS is China's five fingers WUZHI Internet technology company based on PHP and MySQL open source content management system CMS. A cross-site request forgery vulnerability exists in index.php?m=member&v=pwreset in WUZHI CMS version 4.1.0. A remote attacker can exploit the vulnerability to...

Passit: Authentication Required When password change

Description of the issue :- I have found that when changing password in passit account there is no Authentication process by asking current password or any other confirmation If a user leaves their computer or account is still active in insecure place,or if account is hijacked or if CSRF is...

CVE-2018-2408

Improper Session Management in SAP Business Objects, 4.0, from 4.10, from 4.20, 4.30, CMC/BI Launchpad/Fiorified BI Launchpad. In case of password change for a user, all other active sessions created using older password continues to be active...

CVE-2018-2408

Improper Session Management in SAP Business Objects, 4.0, from 4.10, from 4.20, 4.30, CMC/BI Launchpad/Fiorified BI Launchpad. In case of password change for a user, all other active sessions created using older password continues to be active...

Design/Logic Flaw

Improper Session Management in SAP Business Objects, 4.0, from 4.10, from 4.20, 4.30, CMC/BI Launchpad/Fiorified BI Launchpad. In case of password change for a user, all other active sessions created using older password continues to be active...

CVE-2018-2408

Improper Session Management in SAP Business Objects, 4.0, from 4.10, from 4.20, 4.30, CMC/BI Launchpad/Fiorified BI Launchpad. In case of password change for a user, all other active sessions created using older password continues to be active...