1136 matches found
CVE-2022-0852
There is a flaw in convert2rhel. convert2rhel passes the Red Hat account password to subscription-manager via the command line, which could allow unauthorized users locally on the machine to view the password via the process command line via e.g. htop or ps. The specific impact varies upon the...
CVE-2022-0852
CVE-2022-0852 concerns the convert2rhel utility, where a Red Hat account password is passed to subscription-manager via the command line. Connectors note that local attackers on a system with the affected convert2rhel can view the password in process command lines (e.g., via htop/ps), risking con...
CVE-2022-32282
An improper password check exists in the login functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. An attacker that owns a users' password hash will be able to use it to directly login into the account, leading to increased privileges...
CVE-2022-2927 Weak Password Requirements in notrinos/notrinoserp
Weak Password Requirements in GitHub repository notrinos/notrinoserp prior to 0.7...
Cybersecurity Has Never Been More Unstable Than It Is Now
By Owais Sultan The world of cybersecurity is nearing a point of no return, with the number of data breaches, password… This is a post from HackRead.com Read the original post: Cybersecurity Has Never Been More Unstable Than It Is Now...
What the Zola Hack Can Teach Us About Password Security
Password security is only as strong as the password itself. Unfortunately, we are often reminded of the danger of weak, reused, and compromised passwords with major cybersecurity breaches that start with stolen credentials. For example, in May 2022, the popular wedding planning site, Zola, was th...
No password brute-force protection on login page
Description The login page doesn't have any protection against a brute-force password attack, which allows an attacker to try every possible password combination without any restriction. Proof of Concept 1. 1- Send a login request of the target user POST http://localhost:5000/api/account/login...
CVE-2022-35928 AES Crypt for Linux Password Security Vulnerability
AES Crypt is a file encryption software for multiple platforms. AES Crypt for Linux built using the source on GitHub and having the version number 3.11 has a vulnerability with respect to reading user-provided passwords and confirmations via command-line prompts. Passwords lengths were not checke...
CVE-2022-35928 AES Crypt for Linux Password Security Vulnerability
AES Crypt is a file encryption software for multiple platforms. AES Crypt for Linux built using the source on GitHub and having the version number 3.11 has a vulnerability with respect to reading user-provided passwords and confirmations via command-line prompts. Passwords lengths were not checke...
CVE-2022-36301
CVE-2022-36301 affects BF-OS versions 3.x up to 3.83. The vulnerability arises from not enforcing strong passwords, enabling a remote attacker to brute-force the device password. Documented impact is high for confidentiality and availability, with the base CVSS indicating network access, low comp...
CVE-2022-1662
In convert2rhel, there's an ansible playbook named ansible/run-convert2rhel.yml which passes the Red Hat Subscription Manager user password via the CLI to convert2rhel. This could allow unauthorized local users to view the password via the process list while convert2rhel is running. However, this...
A Simple Formula for Getting Your IT Security Budget Approved
Although there is a greater awareness of cybersecurity threats than ever before, it is becoming increasingly difficult for IT departments to get their security budgets approved. Security budgets seem to shrink each year and IT pros are constantly being asked to do more with less. Even so, the...
CVE-2022-1794
CVE-2022-1794 affects the CODESYS OPC DA Server prior to v3.5.18.20, where PLC passwords are stored in plaintext in the configuration file and are visible to all authorized Windows users on the system. The vulnerability exposes credentials via local access to the host, as indicated by the CVSS ve...
CVE-2022-34807
Jenkins Elasticsearch Query Plugin 1.2 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system...
CVE-2022-34807
CVE-2022-34807 affects Jenkins Elasticsearch Query Plugin 1.2 and earlier. The flaw exposes a password stored unencrypted in the plugin’s global configuration file on the Jenkins controller, enabling access to the password by anyone with Jenkins controller filesystem access. Practically, this is ...
CVE-2022-34806
The provided connected sources confirm a concrete vulnerability in Jenkins Jigomerge Plugin 0.9 and earlier: passwords are stored unencrypted in job config.xml on the Jenkins controller, enabling access by users with Extended Read permission or anyone with filesystem access. Root cause is plainte...
CVE-2021-40597
The firmware of EDIMAX IC-3140W Version 3.11 is hardcoded with Administrator username and password...
You’ve Been Warned: Overlook Security Basics at Your Peril
Hackers are increasingly capitalizing on our volatile world—there was an increase in coronavirus-related phishing attacks in the pandemic’s early days as well as threats associated with the uptick in telecommuting and remote learning. Russia’s invasion of Ukraine is the latest example, with...
Reimagine Hybrid Work: Same CyberSec in Office and at Home
It was first the pandemic that changed the usual state of work - before, it was commuting, working in the office & coming home for most corporate employees. Then, when we had to adapt to the self-isolation rules, the work moved to home offices, which completely changed the workflow for many...