Microsoft Windows Kerberos Local Security Bypass Vulnerability (3105256)

This host is missing an important security update according to Microsoft Bulletin MS15-122. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CVE-2015-5019

IBM Sterling Integrator 5.1 before 50100048 and Sterling B2B Integrator 5.2 before 50205009 allow remote authenticated users to read or upload files by leveraging a password-change requirement...

CVE-2015-5005

CSPOC in IBM PowerHA SystemMirror on AIX 6.1 and 7.1 allows remote authenticated users to perform an "su root" action by leveraging presence on the cluster-wide password-change list...

Design/Logic Flaw

IBM Sterling Integrator 5.1 before 50100048 and Sterling B2B Integrator 5.2 before 50205009 allow remote authenticated users to read or upload files by leveraging a password-change requirement...

CVE-2015-5005

CSPOC in IBM PowerHA SystemMirror on AIX 6.1 and 7.1 allows remote authenticated users to perform an "su root" action by leveraging presence on the cluster-wide password-change list...

CVE-2015-5019

IBM Sterling Integrator 5.1 before 50100048 and Sterling B2B Integrator 5.2 before 50205009 allow remote authenticated users to read or upload files by leveraging a password-change requirement...

Design/Logic Flaw

CSPOC in IBM PowerHA SystemMirror on AIX 6.1 and 7.1 allows remote authenticated users to perform an "su root" action by leveraging presence on the cluster-wide password-change list...

CVE-2015-5005

CSPOC in IBM PowerHA SystemMirror on AIX 6.1 and 7.1 allows remote authenticated users to perform an "su root" action by leveraging presence on the cluster-wide password-change list...

CVE-2015-5019

CVE-2015-5019 affects IBM Sterling Integrator 5.1 (pre-5010004_8) and Sterling B2B Integrator 5.2 (pre-5020500_9). The issue allows remote authenticated users to read or upload files by exploiting a password-change requirement, enabling unauthorized file access within affected components. IBM’s a...

Cisco Content Security Management Appliance Default Credentials (HTTP)

The remote Cisco Content Security Management Appliance web interface is using known default credentials. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

[SECURITY] Fedora 22 Update: php-horde-passwd-5.0.4-1.fc22

An application to change any user passwords stored in various backends like SQL, LDAP, Kolab, passwd files etc...

CVE-2015-3270

Apache Ambari before 2.0.2 or 2.1.x before 2.1.1 allows remote authenticated users to gain administrative privileges via unspecified vectors, possibly related to changing passwords...

Sagem FAST3304-V2 - Authentication Bypass (2)

Sagem FAST3304-V2 - Authentication Bypass 2 ================================================================================ || | | || || || |/ | || |/ | | | | | | | | | | | \ | | | | \ ================================================================================ Exploit Title: Sagem javascrip...

Ignite Realtime Openfire user-password.jsp Cross-Site Request Forgery (CVE-2015-6973)

A cross-site request forgery vulnerability has been reported in Openfire user-password.jsp. The vulnerability is due to insufficient CSRF protections. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user with administrative privileges to visit a page which sends a...

Personal Info Stolen? Seven Response Steps

Yesterday on Bloomberg West, host Emily Chang reported on a breach that affected her personally identifiable information PII. She asked what she should do now that she is a victim of data theft. This is my answer. First, I recommend changing passwords for any accounts associated with the breached...

Data Breach Day — Patreon (2.3M), T-Mobile (15M) and Scottrade (4.6M) — HACKED!

This week, three high-profile data breaches took place, compromising personal and sensitive details of millions of people. Telecommunication giant T-Mobile Crowdfunding website Patreon US brokerage firm Scottrade In T-Mobile's case, its credit application processor Experian was hacked, potentiall...

CVE-2015-6927

vzctl before 4.9.4 determines the virtual environment VE layout based on the presence of root.hdd/DiskDescriptor.xml in the VE private directory, which allows local simfs container CT root users to change the root password for arbitrary ploop containers, as demonstrated by a symlink attack on the...

Resource Data Management Elevation of Privilege Vulnerability

Resource Data Management is a Web-based SCADA monitoring system. An elevation of privilege vulnerability exists in the implementation of Resource Data Management. An attacker can exploit this vulnerability to elevate privileges and change the password of any user...

Improper validation of certificates when using self-signed certificates - ownCloud

The ownCloud Desktop Client was vulnerable against MITM attacks until version 2.0.0 in combination with self-signed certificates. To be exploitable the following conditions have to be met: The connection to the remote ownCloud server must be secured using a self-signed certificate which the user...

Multiple Cross-Site Request Forgery Vulnerabilities in Ignite Realtime Openfire

Ignite Realtime Openfire formerly known as Wildfire is the IgniteRealtime community of a Java development and based on XMPP formerly known as Jabber, Instant Messaging Protocol cross-platform open-source real-time collaboration RTC server , it can build a high-efficiency instant messaging servers...