CVE-2021-30948

CVE-2021-30948 affects Apple iOS and iPadOS; an inconsistent UI state management bug potentially allows a person with physical access to an iOS device to access stored passwords without authentication. The issue is fixed in iOS 15.2 / iPadOS 15.2. Vulnerable component details are not fully specif...

CVE-2021-30915

CVE-2021-30915 is a logic issue in iOS/iPadOS security text entry that could allow a person with physical access to determine characteristics of a user’s password in a secure text entry field. Root cause: flawed state management. Impact: potential partial disclosure of password characteristics. A...

CVE-2021-30915

A logic issue was addressed with improved state management. This issue is fixed in iOS 15.1 and iPadOS 15.1, macOS Monterey 12.0.1, tvOS 15.1, watchOS 8.1, Security Update 2021-007 Catalina, macOS Big Sur 11.6.1. A person with physical access to an iOS device may be able to determine...

Managing Privileged Access for a Post-COVID Perimeter

For many, 2021 signifies a year of recovery, reflection and reimagining. After the whirlwind year of 2020, we witnessed all aspects and facets of our lives and businesses turn upside down as our communities and economies adapted to the disruptions of the COVID-19 pandemic. As we all know, the...

Five Critical Password Security Rules Your Employees Are Ignoring

According to Keeper Security's Workplace Password Malpractice Report, many remote workers aren't following best practices for password security. Password security was a problem even before the advent of widespread remote work. So, what happened post-pandemic? Keeper Security's Workplace Password...

CVE-2020-12732

DEPSTECH WiFi Digital Microscope 3 has a default SSID of Jetionxxxxxxxx with a password of 12345678...

5 Critical Steps to Recover From a Ransomware Attack

Hackers are increasingly using ransomware as an effective tool to disrupt businesses and fund malicious activities. A recent analysis by cybersecurity company Group-IB revealed ransomware attacks doubled in 2020, while Cybersecurity Ventures predicts that a ransomware attack will occur every 11...

DarkSide Pwned Colonial With Old VPN Password

It took only one dusty, no-longer-used password for the DarkSide cybercriminals to breach the network of Colonial Pipeline Co. last month, resulting in a ransomware attack that caused significant disruption and remains under investigation by the U.S. government and cybersecurity experts. Attacker...

CVE-2021-33190

CVE-2021-33190 – APISIX Dashboard 2.6 : The issue arises from using a risky IP acquisition function in the IP Allowed List, enabling bypass of network access restrictions when listen_host defaults to 0.0.0.0. This is fixed in APISIX Dashboard 2.6.1. Some sources also note an authentication bypass...

PT-2021-17183 · Bird · Bird

Name of the Vulnerable Software and Affected Versions: BIRD versions 2.0.7 and earlier Description: The issue is related to the lack of password authentication functionality for BGP peers in BIRD, which may make products that use BIRD susceptible to route redirection, potentially leading to Denia...

CVE-2020-10729

A flaw was found in the use of insufficiently random values in Ansible. Two random password lookups of the same length generate the equal value as the template caching action for the same file since no re-evaluation happens. The highest threat from this vulnerability would be that all passwords a...

Rockwell Automation Micro 1400 安全漏洞

The Rockwell Automation MicroLogix 1400 is a programmable logic controller from Rockwell Automation, USA. A security vulnerability exists in the Rockwell Automation Micro800 and MicroLogix 1400. An attacker could use this vulnerability to intercept a password change request message containing a...

RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be

Impact A security-sensitive bug was discovered by Open Source Developer Erik Sundell of Sundell Open Source Consulting AB. The functions RandomAlphaNumericint and CryptoRandomAlphaNumericint are not as random as they should be. Small values of int in the functions above will return a smaller subs...

Why Password Hygiene Needs a Reboot

In today's digital world, password security is more important than ever. While biometrics, one-time passwords OTP, and other emerging forms of authentication are often touted as replacements to the traditional password, today, this concept is more marketing hype than anything else. But just becau...

CVE-2020-27150

CVE-2020-27150 affects multiple versions of Moxa NPort IA5000A Series industrial device servers. The vulnerability arises when exporting a device’s configuration, which can reveal passwords for all users and other sensitive data in their original form if a Pre-shared key has not been set. The con...

Five Critical Password Security Rules Your Employees Are Ignoring

Password security was a problem even before the advent of widespread remote work. So, what happened post-pandemic? Keeper Security’s Workplace Password Malpractice Report sought to find out. In February 2021, Keeper surveyed 1,000 employees in the U.S. about their work-related password habits — a...

CVE-2021-28128

Strapi up to version 3.6.0 contains an auth weakness in the admin panel: a user can change their own password without entering the current one. If an attacker gains any valid session, they can take over the account by changing the password. This aligns with the CVSS3.1/8.1 (HIGH) impact noted in ...

GateManager communication server Password Disclosure

The vulnerability of the GateManager communication server is related to insufficient calculation of the password hash. Exploiting this vulnerability allows a malicious actor to remotely view user passwords...

CVE-2021-3154

An issue was discovered in SolarWinds Serv-U before 15.2.2. Unauthenticated attackers can retrieve cleartext passwords via macro Injection. NOTE: this had a distinct fix relative to CVE-2020-35481...

CVE-2021-31539

CVE-2021-31539 affects Wowza Streaming Engine prior to 4.8.8.01. In default installations, cleartext passwords are stored in conf/admin.password, allowing a local user to read usernames and passwords. Multiple connected sources confirm the issue and reference the 4.8.8.01 release as the fix. Reme...