Windows 11 pulls ahead of Windows 10 in anti-phishing stakes

Some new security additions and changes have been announced for users of Windows, but youll have to be using Windows 11 to get the most out of them. Windows 10 users may find that this is going to be a case of falling behind the herd ever so slightly. Anti-phishing tools Enhanced phishing...

Security Bulletin: Security Vulnerabilities fixed in IBM WebSphere Application Server 6.1.0.43

Abstract Cross reference list for security vulnerabilities fixed in WebSphere Application Server Fix Pack 6.1.0.43 Content VULNERABILITY DETAILS: CVE ID:CVE-2011-1376 PM49712 DESCRIPTION: IBM Websphere Application Server, when running on IBM i operating systems, applies insecure permissions to...

PT-2022-14472 · Grandstream · Grandstream Gsd3710

Name of the Vulnerable Software and Affected Versions: Grandstream GSD3710 version 1.0.11.13 Description: The issue allows an attacker with knowledge of user and password to overflow the stack, as it does not check the parameter length before using the strcopy instruction. This could lead to an...

Security Bulletin: Default Password Requirements are weak on new installations of IBM Maximo Asset Management (CVE-2015-1934)

Summary On new installations of Maximo Asset Management, default password requirements are weak. The vulnerability has been fixed for new installations of Maximo Asset Management. Customers are advised to protect existing installations by strengthening password requirements via instructions in th...

Threat Source newsletter (Sept. 8, 2022) — Why there is no one-stop-shop solution for protecting passwords

By Jon Munshaw. Welcome to this week’s edition of the Threat Source newsletter. It seems like there’s at least one major password breach every month — if not more. Most recently, there was an incident at Plex where all users had to reset their passwords. Many users pay for a password management...

Blink1Control2 uses weak password encryption

The Blink1Control2 application = 2.2.7 uses weak password encryption and an insecure method of storage. Version 2.2.9 fixes the issue...

CVE-2022-0852

CVE-2022-0852 concerns the convert2rhel utility, where a Red Hat account password is passed to subscription-manager via the command line. Connectors note that local attackers on a system with the affected convert2rhel can view the password in process command lines (e.g., via htop/ps), risking con...

CVE-2022-0852

There is a flaw in convert2rhel. convert2rhel passes the Red Hat account password to subscription-manager via the command line, which could allow unauthorized users locally on the machine to view the password via the process command line via e.g. htop or ps. The specific impact varies upon the...

CVE-2022-32282

An improper password check exists in the login functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. An attacker that owns a users' password hash will be able to use it to directly login into the account, leading to increased privileges...

CVE-2022-2927 Weak Password Requirements in notrinos/notrinoserp

Weak Password Requirements in GitHub repository notrinos/notrinoserp prior to 0.7...

Cybersecurity Has Never Been More Unstable Than It Is Now

By Owais Sultan The world of cybersecurity is nearing a point of no return, with the number of data breaches, password… This is a post from HackRead.com Read the original post: Cybersecurity Has Never Been More Unstable Than It Is Now...

What the Zola Hack Can Teach Us About Password Security

Password security is only as strong as the password itself. Unfortunately, we are often reminded of the danger of weak, reused, and compromised passwords with major cybersecurity breaches that start with stolen credentials. For example, in May 2022, the popular wedding planning site, Zola, was th...

No password brute-force protection on login page

Description The login page doesn't have any protection against a brute-force password attack, which allows an attacker to try every possible password combination without any restriction. Proof of Concept 1. 1- Send a login request of the target user POST http://localhost:5000/api/account/login...

CVE-2022-35928 AES Crypt for Linux Password Security Vulnerability

AES Crypt is a file encryption software for multiple platforms. AES Crypt for Linux built using the source on GitHub and having the version number 3.11 has a vulnerability with respect to reading user-provided passwords and confirmations via command-line prompts. Passwords lengths were not checke...

CVE-2022-35928 AES Crypt for Linux Password Security Vulnerability

AES Crypt is a file encryption software for multiple platforms. AES Crypt for Linux built using the source on GitHub and having the version number 3.11 has a vulnerability with respect to reading user-provided passwords and confirmations via command-line prompts. Passwords lengths were not checke...

CVE-2022-36301

CVE-2022-36301 affects BF-OS versions 3.x up to 3.83. The vulnerability arises from not enforcing strong passwords, enabling a remote attacker to brute-force the device password. Documented impact is high for confidentiality and availability, with the base CVSS indicating network access, low comp...

CVE-2022-1662

In convert2rhel, there's an ansible playbook named ansible/run-convert2rhel.yml which passes the Red Hat Subscription Manager user password via the CLI to convert2rhel. This could allow unauthorized local users to view the password via the process list while convert2rhel is running. However, this...

A Simple Formula for Getting Your IT Security Budget Approved

Although there is a greater awareness of cybersecurity threats than ever before, it is becoming increasingly difficult for IT departments to get their security budgets approved. Security budgets seem to shrink each year and IT pros are constantly being asked to do more with less. Even so, the...

CVE-2022-1794

CVE-2022-1794 affects the CODESYS OPC DA Server prior to v3.5.18.20, where PLC passwords are stored in plaintext in the configuration file and are visible to all authorized Windows users on the system. The vulnerability exposes credentials via local access to the host, as indicated by the CVSS ve...

CVE-2022-34807

Jenkins Elasticsearch Query Plugin 1.2 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system...