CVE-2015-7248

ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.kPE allow remote attackers to discover usernames and password hashes by reading the cgi-bin/webproc HTML source code, a different vulnerability than CVE-2015-8703...

The vulnerability of L-Switch and L-IP router microprogramming systems allows attackers to gain access to backup files containing password hashes.

The vulnerability of L-Switch and L-IP router microprogramming systems is related to insufficient protection of registration data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to backup files containing hashed passwords...

LOYTEC LIP-3ECTB-100 LVIS-3E100LIP-ME201 devices Information Disclosure Vulnerability

LOYTEC LIP devices are IP network router devices from LOYTEC Germany. An information disclosure vulnerability exists in the LOYTEC LIP-3ECTB 6.0.1, LINX-100, LVIS-3E100,LIP-ME201 devices. Allows a remote attacker to read a backup file of password hashes via an unspecified vector...

Brocade Fabric OS 6.3.1b Weak System Configuration

Title: Brocade Fabric OS v6.3.1b - Multiple vulnerabilities Discovered by: Karn Ganeshen Vendor Homepage: www.brocade.com Versions Reported: Kernel 2.6.14.2 + FabOS v6.3.1b + BootProm 1.0.9 version Kernel: 2.6.14.2 Fabric OS: v6.3.1b BootProm: 1.0.9 1 Default diagnostic accounts root and factory...

WordPress W3 Total Cache Security Credentials Hash Extract

A hash extract vulnerability has been reported in WordPress W3 Total Cache Plugin. Successful exploitation of this vulnerability would allow a remote attacker to obtain username and password hashes from affected WordPress servers...

CVE-2013-4577

A certain Debian patch for GNU GRUB uses world-readable permissions for grub.cfg, which allows local users to obtain password hashes, as demonstrated by reading the passwordpbkdf2 directive in the file...

Joomla com_contenthistory Error-Based SQL Injection

This module exploits a SQL injection vulnerability in Joomla versions 3.2 through 3.4.4 in order to either enumerate usernames and password hashes. Module Options msf use auxiliary/gather/joomla/contenthistorysqli msf undefinedcontenthistorysqli show actions ...actions... msf...

Joomla Real Estate Manager Component Error-Based SQL Injection

This module exploits a SQL injection vulnerability in Joomla Plugin comrealestatemanager versions 3.7 in order to either enumerate usernames and password hashes. Module Options msf use auxiliary/gather/joomla/comrealestatemanagersqli msf undefinedcomrealestatemanagersqli show actions ...actions...

Authentication flaw

Retrospect and Retrospect Client before 10.0.2.119 on Windows, before 12.0.2.116 on OS X, and before 10.0.2.104 on Linux improperly generate password hashes, which makes it easier for remote attackers to bypass authentication and obtain access to backup files by leveraging a collision...

CVE-2015-2864

Retrospect and Retrospect Client suffer from weak password hashing (CVE-2015-2864). Prior to updates, password hashes could collide, enabling a remote attacker with network access to bypass authentication and access backup files. Affected versions include Windows clients before 10.0.2.119, macOS ...

CVE-2015-2864

Retrospect and Retrospect Client before 10.0.2.119 on Windows, before 12.0.2.116 on OS X, and before 10.0.2.104 on Linux improperly generate password hashes, which makes it easier for remote attackers to bypass authentication and obtain access to backup files by leveraging a collision...

Cisco TelePresence Video Communication Server Expressway Information Disclosure Vulnerability (Cisco-SA-20150812-CVE-2015-4314)

A vulnerability in the System Snapshot of Cisco TelePresence Video Communication Server VCS Expressway could allow an authenticated, remote attacker to view sensitive data. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are...

Netop Remote Control 11.52 / 12.11 Credential Issue

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2015-025 Product: Netop Remote Control Vendor: Netop Affected Versions: 11.52, 12.11 Tested Versions: 11.52, 12.11 Vulnerability Type: Use of Hard-coded Cryptographic Key CWE-321 Insufficiently Protected Credentials CWE-522 Risk...

WordPress WP Symposium Plugin 15.1 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Wordpress Plugin wp-symposium Unauthenticated SQL Injection Vulnerability Date: 2015-07-30 Exploit Author: PizzaHatHacker Vendor Homepage: http://www.wpsymposium.com/ Version: ? = version = 15.5.1 Tested on: Apache / WordPress...

Cisco TelePresence Video Communication Server Expressway Password Hash Acquisition Vulnerability

Cisco TelePresence Video Communication Server is a video conferencing solution that integrates h.323 and SIP. A security vulnerability exists in Cisco TelePresence Video Communication Server Expressway that allows an authenticated user to download a snapshot of the system and obtain password hash...

Multiple Huawei ME906 Products Information Disclosure Vulnerability

Huawei ME906 is a mobile internet module with M.2 which supports LTE, WCDMA, EVDO and GSM. Several Huawei ME906 products contain hashes of root accounts and passwords, allowing attackers to exploit vulnerabilities that can be cracked to obtain ROOT account password information...

WordPress Plugin WP Symposium 15.1 - 'get_album_item.php' SQL Injection

Exploit Title: Wordpress Plugin wp-symposium Unauthenticated SQL Injection Vulnerability Date: 2015-07-30 Exploit Author: PizzaHatHacker Vendor Homepage: http://www.wpsymposium.com/ Version: ? = version = 15.5.1 Contact: PizzaHatHackeragmail.com Tested on: Apache / WordPress 4.2.3 / wp-symposium...

WordPress Plugin WP Symposium 15.1 - Blind SQL Injection

Details ================ Software: WP Symposium Version: 15.1 Homepage: https://wordpress.org/plugins/wp-symposium Advisory report: https://security.dxw.com/advisories/blind-sql-injection-in-wp-symposium-allows-unauthenticated-attackers-to-access-sensitive-data/ CVE: Awaiting assignment CVSS: 6.4...

Cisco TelePresence Video Communication Server Expressway Information Disclosure Vulnerability

A vulnerability in the System Snapshot of Cisco TelePresence Video Communication Server VCS Expressway could allow an authenticated, remote attacker to view sensitive data. The vulnerability is due to insufficient protection of data at rest. An attacker could exploit this vulnerability by...

Burning Board 2.3.1 - SQL Injection

Burning Board 2.3.1 - SQL Injection Burning Board SQL Injection Vendor: Woltlab GmbH Product: Burning Board Version: = 2.3.1 Website: http://www.woltlab.de/ BID: 13643 CVE: CVE-2005-1642 OSVDB: 16575 SECUNIA: 15395 PACKETSTORM: 39262 Description: Burning Board is a popular, multi purpose forum /...