CVE-2014-6412

WordPress before 4.4 makes it easier for remote attackers to predict password-recovery tokens via a brute-force approach...

CVE-2018-9233

Sophos Endpoint Protection 10.7 uses an unsalted SHA-1 hash for password storage in %PROGRAMDATA%\Sophos\Sophos Anti-Virus\Config\machine.xml, which makes it easier for attackers to determine a cleartext password, and subsequently choose unsafe malware settings, via rainbow tables or other...

CVE-2018-1447

The GSKit IBM Spectrum Protect 7.1 and 7.2 and IBM Spectrum Protect Snapshot 4.1.3, 4.1.4, and 4.1.6 CMS KDB logic fails to salt the hash function resulting in weaker than expected protection of passwords. A weak password may be recovered. Note: After update the customer should change password to...

Hikvision IP Camera versions 5.2.0 - 5.3.9 (Builds 140721 < 170109) - Access Control Bypass Explo

Exploit for hardware platform in category web applications Exploit Title: Hikvision IP Camera versions 5.2.0 - 5.3.9 Builds: 140721 - 170109 Backdoor Date: 15-03-2018 Vendor Homepage: http://www.hikvision.com/en/ Exploit Author: Matamorphosis Category: Web Apps Description: Exploits a backdoor in...

CloudBees Jenkins Credentials Binding Plugin Information Disclosure Vulnerability

CloudBees Jenkins formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software release/testing projects and some of the timed execution of the task.Credentials Binding...

Center for Internet Security CIS-CAT Pro Dashboard Privilege Gain Vulnerability

Center for Internet Security CIS-CAT Pro Dashboard is a set of panels used to display system compliance on a dashboard. An access control error vulnerability exists in versions of Center for Internet Security CIS-CAT Pro Dashboard prior to 1.0.4. An attacker can exploit this vulnerability to gain...

The software vulnerabilities of Cloud Foundry Runtime cf-release, UAA Standalone, and Pivotal Cloud Foundry Elastic Runtime – a software platform existing due to a flaw in the forgotten password recovery mechanism – allow attackers to exploit old links to reset passwords.

The vulnerabilities of the Cloud Foundry Runtime cf-release, UAA Standalone, and Pivotal Cloud Foundry Elastic Runtime software platforms exist due to a flaw in the mechanism for recovering forgotten passwords. Exploiting these vulnerabilities allows an attacker operating remotely to use outdated...

LaZagne v2.3 - Credentials Recovery Project

The LaZagne project is an open source application used to retrieve lots of passwords stored on a local computer. Each software stores its passwords using different techniques plaintext, APIs, custom algorithms, databases, etc.. This tool has been developed for the purpose of finding these passwor...

GPWeb Password Recovery SQL Injection Vulnerability

GPWeb is a suite of public administration software for the Brazilian government sector, and Password Recovery is one of its password recovery tools. A SQL injection vulnerability exists in GPWeb version 8.4.61 of Password Recovery. The vulnerability can be exploited by a remote attacker to execut...

CVE-2017-15875

SQL injection vulnerability in Password Recovery in GPWeb 8.4.61 allows remote attackers to execute arbitrary SQL commands via the "checkemail" parameter...

CVE-2017-15875

SQL injection vulnerability in Password Recovery in GPWeb 8.4.61 allows remote attackers to execute arbitrary SQL commands via the "checkemail" parameter...

Sql injection

SQL injection vulnerability in Password Recovery in GPWeb 8.4.61 allows remote attackers to execute arbitrary SQL commands via the "checkemail" parameter...

CYBERNET SYSTEMS Maplesoft Maple Cross-Site Scripting Vulnerability

CYBERNET SYSTEMS Maplesoft Maple T.A. is a general-purpose software tool for mathematics, data analysis, visualization, and programming from CYBERNET SYSTEMS, Japan. A cross-site scripting vulnerability exists in the password recovery page in CYBERNET SYSTEMS Maplesoft Maple T.A. version 2016.0.6...

CVE-2017-15875

CVE-2017-15875 documents a SQL injection vulnerability in GPWeb Password Recovery, version 8.4.61. The vulnerability allows remote attackers to execute arbitrary SQL commands via the checkemail parameter. Connected sources confirm the affected product/version and the injection vector, but do not ...

CVE-2017-15875

SQL injection vulnerability in Password Recovery in GPWeb 8.4.61 allows remote attackers to execute arbitrary SQL commands via the "checkemail" parameter...

Hangzhou Chengyu Asset Management Co. Smart Money APP has logic design flaws

Smart Money APP is an online smart investment management app developed by Hangzhou Chengyu Asset Management Co. There is a logical design flaw in the "password retrieval" section of the Smart Money APP of Hangzhou Chengyu Asset Management Co. Attackers through unlimited verification code...

Free, Open-Source Remote Administration Tool for Windows: QuasarRAT

Quasar is a fast and light-weight remote administration tool coded in C. Providing high stability and an easy-to-use user interface, Quasar is the perfect remote administration solution for you. Features TCP network stream IPv4 & IPv6 support Fast network serialization NetSerializer Compressed...

Zhuhai Light Point Culture Communication Co., Ltd Light Point APP has information leakage vulnerability

Light Dot APP is a reading APP focusing on comics, which integrates comics, stories and knowledge to provide users with a light reading comics platform. There is an information leakage vulnerability when registering and retrieving password to get verification code in Light APP, attackers can...

Hashcat v4.0 - World's Fastest and Most Advanced Password Recovery Utility

hashcat is the world's fastest and most advanced password recovery utility, supporting five unique modes of attack for over 200 highly-optimized hashing algorithms. hashcat currently supports CPUs, GPUs, and other hardware accelerators on Linux, Windows, and OSX, and has facilities to help enable...

Google Login Security for High-Risk Users

Google has a new login service for high-risk users. It's good, but unforgiving. Logging in from a desktop will require a special USB key, while accessing your data from a mobile device will similarly require a Bluetooth dongle. All non-Google services and apps will be exiled from reaching into yo...