CVE-2013-1814

The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response...

Official Debian and Python Wiki Servers Compromised

Administration from Debian and Python project official websites confirmed that their WIKI servers were compromised by some unknown hackers recently. Hackers was able to hack because of several vulnerabilities in "moin" package. According to Brian Curtin at Python Project, Hacker user some unknown...

Official Debian and Python Wiki Servers Compromised

Administration from Debian and Python project official websites confirmed that their WIKI servers were compromised by some unknown hackers recently. Hackers was able to hack because of several vulnerabilities in "moin" package. According to Brian Curtin at Python Project, Hacker user some unknown...

Windows Gather Local and Domain Controller Account Password Hashes

This will dump local accounts from the SAM Database. If the target host is a Domain Controller, it will dump the Domain Account Database using the proper technique depending on privilege level, OS and role of the host. This module requires Metasploit: https://metasploit.com/download Current sourc...

WordPress W3 Total Cache Misconfiguration Leaves Some Blogs Vulnerable

An apparent misconfiguration exists in W3 Total Cache W3TC, a popular plugin for the WordPress blogging platform, that could allow an attacker to browse and download password hashes and other database information. W3 Total Cache W3TC is a framework for WordPress that helps speed up blogs by cachi...

WordPress plugin W3 Total Cache critical Vulnerability disclosed

One of the most popular Wordpress Plugin called "W3 Total Cache" which is used to Improve site performance and user experience via caching, having potential vulnerability. On Christmas day, someone disclose it on full-disclosure site that how a plugin misconfiguration leads to possible Wordpress...

WordPress W3 Total Cache Data Disclosure

!/bin/bash C Copyright 2012 Jason A. Donenfeld . All Rights Reserved. |---------------| | W3 Total Fail | | by zx2c4 | |---------------| For more info, see built-in help text. Most up to date version is available at: http://git.zx2c4.com/w3-total-fail/tree/w3-total-fail.sh This affects all curren...

CVE-2012-5552

Summary: The Password policy module for Drupal 6.x and 7.x contains a vulnerability where, when the module’s “previous passwords” feature is enabled, an attacker who can view HTTP traffic can obtain a user’s hashed password due to lack of encrypted transport. This affects: Drupal 6.x-1.x prior to...

CVE-2012-5552: Exposure of Sensitive Information to an Unauthorized Actor

The Password policy module 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to obtain password hashes by sniffing the network, related to "client-side password history checks."...

PT-2012-6022

Name of the Vulnerable Software and Affected Versions Password policy module versions 6.x-1.x before 6.x-1.5 Password policy module versions 7.x-1.x before 7.x-1.3 Description The issue allows remote attackers to obtain password hashes by sniffing the network, related to client-side password...

MyAuth3 - Blind SQL Injection

Exploit Title: MyAuth3 Blind SQL Injection / Root Shell Access 0day exploit Google Dork: allinurl:1881/?console=panel Date: 09/06/2011 Author: Marcio Almeida marcioatalligatorteamdot org | @marcioalm Version: 3.0 Tested on: Linux EDB-Note: apparently no true exploit is needed to dump system pwd...

Xxe

Mobile Accounts in Apple Mac OS X before 10.7.5 and 10.8.x before 10.8.2 saves password hashes for external-account use even if external accounts are not enabled, which might allow remote attackers to determine passwords via unspecified access to a mobile account...

CVE-2012-3720

CVE-2012-3720 (Apple macOS) affects the Mobile Accounts feature. In affected builds (OS X before 10.7.5 and 10.8.x before 10.8.2), a password hash was saved for external-account use even when external accounts were not enabled, potentially letting a remote attacker determine a user password via a...

CVE-2012-3720

Mobile Accounts in Apple Mac OS X before 10.7.5 and 10.8.x before 10.8.2 saves password hashes for external-account use even if external accounts are not enabled, which might allow remote attackers to determine passwords via unspecified access to a mobile account...

CVE-2012-3720: Undefined Security Weakness

Mobile Accounts in Apple Mac OS X before 10.7.5 and 10.8.x before 10.8.2 saves password hashes for external-account use even if external accounts are not enabled, which might allow remote attackers to determine passwords via unspecified access to a mobile account...

Design/Logic Flaw

McAfee Email and Web Security EWS 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway MEG 7.0 before Patch 1, does not properly encrypt system-backup data, which makes it easier for remote authenticated users to obtain sensitive information by reading a backup file, as...

CVE-2012-4584

McAfee Email and Web Security EWS 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway MEG 7.0 before Patch 1, does not properly encrypt system-backup data, which makes it easier for remote authenticated users to obtain sensitive information by reading a backup file, as...

PT-2012-5492

Name of the Vulnerable Software and Affected Versions McAfee Email and Web Security EWS versions 5.x through 5.5 before Patch 6 McAfee Email and Web Security EWS version 5.6 before Patch 3 McAfee Email Gateway MEG version 7.0 before Patch 1 Description The issue allows remote authenticated users ...

CVE-2012-2165

IBM Rational ClearQuest 7.1.x before 7.1.2.7 and 8.x before 8.0.0.3, when ClearQuest Authentication is enabled, allows remote authenticated users to read password hashes via a user query...

Authentication flaw

IBM Rational ClearQuest 7.1.x before 7.1.2.7 and 8.x before 8.0.0.3, when ClearQuest Authentication is enabled, allows remote authenticated users to read password hashes via a user query...