GoDaddy Discloses Multi-Year Security Breach Causing Malware Installations and Source Code Theft

Web hosting services provider GoDaddy on Friday disclosed a multi-year security breach that enabled unknown threat actors to install malware and siphon source code related to some of its services. The company attributed the campaign to a "sophisticated and organized group targeting hosting...

Additional Supply Chain Vulnerabilities Uncovered in AMI MegaRAC BMC Software

Two more supply chain security flaws have been disclosed in AMI MegaRAC Baseboard Management Controller BMC software, nearly two months after three security vulnerabilities were brought to light in the same product. Firmware security firm Eclypsium said the two shortcomings were held back until n...

CVE-2022-47732

In Yeastar N412 and N824 Configuration Panel 42.x and 45.x, an unauthenticated attacker can create backup file and download it, revealing admin hash, allowing, once cracked, to login inside the Configuration Panel, otherwise, replacing the hash in the archive and restoring it on the device which...

Acronis: Any expired reset password link can still be used to reset the password

Hello Aronis team! When requesting a password reset link at https://alt.5nine.com/passwordrecovery.aspx and using it, after a short time the link becomes invalid. When I open the link I get the message: "Your validation request is invalid or expired" But it is still possible to use it to reset th...

Code injection

Inadequate encryption may allow the passwords for Emerson OpenEnterprise versions through 3.3.4 user accounts to be obtained...

Chrome on Android will alert, fix your compromised password

By Deeba Ahmed Whenever you need to check for stolen passwords on supported applications or websites, Google Assistant will enable a Change Password button. This is a post from HackRead.com Read the original post: Chrome on Android will alert, fix your compromised password...

CVE-2021-20992

In Fibaro Home Center 2 and Lite devices in all versions provide a web based management interface over unencrypted HTTP protocol. Communication between the user and the device can be eavesdropped to hijack sessions, tokens and passwords...

Bosch FSM-2500 and Bosch FSM-5000 password compromise vulnerability

Bosch FSM-2500 and Bosch FSM-5000 are both panel-ready fire control systems from Bosch of Germany. Bosch FSM-2500 and Bosch FSM-5000 are vulnerable to a password disclosure vulnerability that could be exploited by a remote attacker to submit a special request that could gain access to sensitive...

Pwned - Simple CLI Script To Check If You Have A Password That Has Been Compromised In A Data Breach

Pwned is a simple command-line python script to check if you have a password that has been compromised in a data breach. This script uses haveibeenpwned API to check whether your passwords were leaked during one of the many breaches of online services. This API uses k-Anonymity model that allows ...

CVE-2020-10104

An issue was discovered in Zammad 3.0 through 3.2. After authentication, it transmits sensitive information to the user that may be compromised and used by an attacker to gain unauthorized access. Hashed passwords are returned to the user when visiting a certain URL...

Design/Logic Flaw

CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.864 allows an attacker to get a victim's session file name from /home/USERNAME/tmp/session/sessxxxxxx, and the victim's token value from /usr/local/cwpsrv/logs/accesslog, then use them to gain access to the victim's password for the OS and...

CVE-2019-16674

An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. Authentication Information used in a cookie is predictable and can lead to admin password compromise when captured on the network...

CVE-2019-16674

An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. Authentication Information used in a cookie is predictable and can lead to admin password compromise when captured on the network...

CVE-2019-16674

CVE-2019-16674 affects Weidmueller IE-SW-VL05M/IE-SW-VL08MT/IE-SW-PL10M series. The root cause is that authentication information used in a cookie is predictable, enabling admin password compromise when captured over the network. The Red Hat and NVD entries describe a high-risk issue with the coo...

CVE-2019-7579

An issue was discovered on Linksys WRT1900ACS 1.0.3.187766 devices. An ability exists for an unauthenticated user to browse a confidential ui/1.0.99.187766/dynamic/js/setup.js.localized file on the router's webserver, allowing for an attacker to identify possible passwords that the system uses to...

Default credentials

Airsonic 10.2.1 uses Spring's default remember-me mechanism based on MD5, with a fixed key of airsonic in GlobalSecurityConfig.java. An attacker able to capture cookies might be able to trivially bruteforce offline the passwords of associated users...

Midpoint (European Commission - DIGIT): Attacker can read password from log data

Summary: Attacker can read plain text password from log data. Steps To Reproduce: 1. From application dashboard choose Users section, I simultaneously ran process hacker to see the process disk write and read behavior. 2. change the password of one of the users, and you see in process hacker wind...

pwnedOrNot v1.1.0 - Tool To Find Passwords For Compromised Email Accounts Using HaveIBeenPwned API

pwnedOrNot uses haveibeenpwned v2 api to test email accounts and tries to find the password in Pastebin Dumps. Features haveibeenpwned offers a lot of information about the compromised email, some useful information is displayed by this script: Name of Breach Domain Name Date of Breach Fabricatio...

CVE-2017-1411

IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 127399...

CVE-2016-8939

CVE-2016-8939 affects IBM Spectrum Protect (formerly Tivoli Storage Manager) Windows clients, where passwords are stored in the Windows Registry under HKLM\Software\IBM\ADSM\CurrentVersion\Nodes. The vulnerability enables a local attacker with sufficient privileges to disclose credentials stored ...