Fedora 28 : icecast (2018-d4349a7ba3)

This release fixes buffer overflows in URL authentication code CVE-2018-18820, a crash in htpasswd authentication if no filename is set, a crash on xsltApplyStylesheet error, and a crash on malformed Opus streams. It also corrects global listener counter. It stops displaying hashed user passwords...

Here is a list of top 25 worst passwords of 2018

By Waqas SplashData, Inc. a leading password management application developer including SplashID has released a list of the 100 worst passwords of 2018. The company established the ranking after evaluating more than 5 million keywords leaked on the Internet this year. Their findings highlight the...

Step 2. Manage authentication and safeguard access: top 10 actions to secure your environment

This series outlines the most fundamental steps you can take with your investment in Microsoft 365 security solutions. We will provide advice on activities such as setting up identity management through active directory, malware protection, and more. In this post, we explain how to enable single...

CVE-2018-16095

CVE-2018-16095 affects Lenovo System Management Module (SMM) firmware prior to 1.06. When authentication fails, the SMM records hashed passwords to a debug log, potentially exposing credentials. Impact is credential exposure within the SMM environment as described by Lenovo’s vulnerability notes....

CVE-2018-13309

Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's password...

CVE-2018-13309

Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's password...

CVE-2008-7320

GNOME Seahorse through 3.30 allows physically proximate attackers to read plaintext passwords by using the quickAllow dialog at an unattended workstation, if the keyring is unlocked. NOTE: this is disputed by a software maintainer because the behavior represents a design decision...

SMWYG-Show-Me-What-You-Got - Tool To Search 1.4 Billion Clear Text Credentials Which Was Dumped As Part Of BreachCompilation Leak

This tool allows you to perform OSINT and reconnaissance on an organisation or an individual. It allows one to search 1.4 Billion clear text credentials which was dumped as part of BreachCompilation leak. This database makes finding passwords faster and easier than ever before. Screenshot Above...

Passwords: Here to Stay, Despite Smart Alternatives?

The lowly password is much-maligned as being the weakest link in any company’s security defenses. That’s for good reason: It’s a fact that password reuse, a lack of strong passwords, a failure to change them on a regular basis and other human errors plague the efficacy of this de facto standard f...

Sextortion emails: They’re probably not watching you

Back in July, Krebs on Security reported on a rather novel scam, where the threat actor would use credentials from old data dumps to suggest that they had directly hacked the victim and obtained the victim's presumably sensitive browser history. Stolen credentials aside, sex-based extortion scams...

Chaturbate: Leaking Username and Password in the URLs via Virustotal, can leads to account takeover

Hi Dear @chaturbate team Vulnerability Type Critical Information Leakage in URLs via Virustotal. Vulnerability Severity High. Description During my regular testing, went to https://www.virustotal.com/%2Fdomain%2Fchaturbate.com After reviewing all URLs more and more, I got 2 Interesting and Critic...

CVE-2017-3912

Bypassing password security vulnerability in McAfee Application and Change Control MACC 7.0.1 and 6.2.0 allows authenticated users to perform arbitrary command execution via a command-line utility...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Firefox regressions (USN-3761-3)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3761-3 advisory. USN-3761-1 fixed vulnerabilities in Firefox. The update caused several regressions affecting spellchecker dictionaries and search engines,...

Wind River VxWorks Vulnerabilities

Overview A security researcher has identified two vulnerabilities affecting the Wind River Systems’ VxWorks platform. The vulnerabilities are a debug service enabled by default VU362332 and a weak hashing algorithm used in authentication VU840249. ICS-CERT has been coordinating with CERT/CC in...

Timing Attack Through Insecure Password Comparison

hapi is vulnerable to timing attacks through constant time password comparison. The vulnerability exists due to the usage of !== to compare two password strings, allowing timing attacks to occur...

From today, Google Chrome starts marking all non-HTTPS sites 'Not Secure'

Starting today with the release of Chrome 68, Google Chrome prominently marks all non-HTTPS websites as 'Not Secure' in its years-long effort to make the web a more secure place for Internet users. So if you are still running an insecure HTTP Hypertext Transfer Protocol website, many of your...

Code injection

The iTrack Easy mobile application stores the account password used to authenticate to the cloud API in base64-encoding in the cache.db file. The base64 encoding format is considered equivalent to cleartext...

CVE-2016-6545

CVE-2016-6545 relates to iTrack Easy where session cookies are not used to maintain valid sessions and the user password is sent as a base64-encoded POST parameter on every request. The underlying issue is insufficient session expiration/management, requiring a password change to terminate sessio...

Popular Flight Tracker Flightradar24 Suffers Data Breach

One of the world's most popular flight tracking services Flightradar24, which shows real-time aircraft flight information on a map, has suffered a massive data breach that may have compromised email addresses and hashed passwords for more than 230,000 customers. Without revealing any information...

Security Bulletin: Cross-Site Request Forgery (CSRF) vulnerability identified with Jazz for Service Management (JazzSM) v1.1.3 (CVE-2017-1631)

Summary Change password functionality is not protected against cross-site request forgery, also JazzSM does not require user to know current password. Vulnerability Details CVEID: CVE-2017-1631 DESCRIPTION: IBM Jazz for Service Management is vulnerable to cross-site request forgery which could...