1146 matches found
CVE-2016-7060
CVE-2016-7060 describes a information-disclosure risk in Red Hat QuickStart Cloud Installer (QCI) 1.0 where the web interface does not mask password fields, enabling a physically proximate attacker to read passwords from the display. The CVSSv2/2.0 base score is 2.1 (LOW) with LOCAL attack vector...
CVE-2016-7060
The web interface in Red Hat QuickStart Cloud Installer QCI 1.0 does not mask passwords fields, which allows physically proximate attackers to obtain sensitive password information by reading the display...
Default credentials
Gynoii has a password of guest for the backdoor guest account and a password of 12345 for the backdoor admin account...
CVE-2016-5070
Sierra Wireless GX440 (GX 440) devices running ALEOS firmware 4.3.2 are affected by a vulnerability where passwords are stored in cleartext. This is documented in CVE-2016-5070 and corroborated by multiple sources (CNVD-2017-10185, NVD entry, CVE list). Impact is exposure of passwords; the exact ...
openSUSE Security Update : MozillaFirefox / mozilla-nss (openSUSE-2017-344)
This update for MozillaFirefox and mozilla-nss fixes the following issues : MozillaFirefox was updated to Firefox 52.0 boo1028391 - requires NSS = 3.28.3 - Pages containing insecure password fields now display a warning directly within username and password fields. - Send and open a tab from one...
Fedora 24 : gnome-boxes (2017-42df4eeb59)
gnome-boxes 3.20.4 release, fixing a possible security issue with storing the express installation password in clear text. - Store the user password in the keyring during an express installation. - Fix typo in debug string. - Fix printf format strings. Note that Tenable Network Security has...
Code injection
An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions prior to 3.11, NPort 5600 Series versions prior to 3.7, NPort 5100A Series & NPort P5150A versions prior to 1.3, NPor...
CVE-2016-5918
IBM Tivoli Storage Manager HSM for Windows displays the encrypted Tivoli Storage Manager password in application trace output if the password access option is prompt and the password is changed...
Design/Logic Flaw
hitek.jar in Hitek Software's Automize uses weak encryption when encrypting SSH/SFTP and Encryption profile passwords. This allows an attacker to retrieve the encrypted passwords from sshProfiles.jsd and encryptionProfiles.jsd and decrypt them to recover cleartext passwords. All 10.x up to and...
[SECURITY] Fedora 24 Update: cracklib-2.9.6-4.fc24
CrackLib tests passwords to determine whether they match certain security-oriented characteristics, with the purpose of stopping users from choosing passwords that are easy to guess. CrackLib performs several tests on passwords: it tries to generate words from a username and gecos entry and check...
[SECURITY] Fedora 25 Update: cracklib-2.9.6-4.fc25
CrackLib tests passwords to determine whether they match certain security-oriented characteristics, with the purpose of stopping users from choosing passwords that are easy to guess. CrackLib performs several tests on passwords: it tries to generate words from a username and gecos entry and check...
DailyMotion Hacked — 85 Million User Accounts Stolen
Another day, another data breach. This time a popular video sharing platform DailyMotion has allegedly been hacked and tens of millions of users information have been stolen. Breach notification service LeakedSource announced the data breach on Monday after the company obtained 85.2 Million recor...
US-CERT Alerts Users to Holiday Phishing Scams and Malware Campaigns
US-CERT reminds users to remain vigilant when browsing or shopping online this holiday season. Ecards from unknown senders may contain malicious links. Fake advertisements or shipping notifications may deliver infected attachments. Spoofed email messages and fraudulent posts on social networking...
Lepton 2.2.2 Stable CSRF / Open Redirect / Password Handling Vulnerabilities
Lepton version 2.2.2 Stable suffers from password handling, insecure bruteforce protection, cross site request forgery, and open redirection vulnerabilities. 1. Introduction Affected Product: LEPTON 2.2.2 stable Fixed in: 2.3.0 Fixed Version http://www.lepton-cms.org/posts/ Link:...
Questions Mount Around Yahoo Breach
As Yahoo continues to investigate the biggest data breach in history, pressure is mounting on the company to admit when it knew about the attack, whether there was a delay in reporting it, and also about how it implements cryptography to secure data it’s responsible for. Security company Venafi...
CVE-2016-6340
CVE-2016-6340 affects Red Hat QuickStart Cloud Installer (QCI): the kickstart file forces MD5 passwords on deployed systems, enabling brute-force recovery of cleartext passwords. This is described by NVD as high-impact (CVSS3 base 8.4) with local attacker access and strong confidentiality/integri...
Jobberbase 2.0 - Multiple Vulnerabilities
Jobberbase 2.0 - Multiple Vulnerabilities Jobberbase: http://www.jobberbase.com/ Version: 2.0 By Ross Marks: http://www.rossmarks.co.uk 1 Local path disclosure - change any variable to an array and in most cases it will tell you the local path where the application is installed eg...
CVE-2016-3640
The SAP HANA DB vulnerability CVE-2016-3640 affects Extended Application Services (XS/XS Engine) in SAP HANA DB version 1.00.091.00.1418659308. The issue allows local users to disclose sensitive password information via vectors related to passwords in Web Dispatcher trace files (as described in S...
CVE-2016-5260
Mozilla Firefox before 48.0 mishandles changes from 'INPUT type="password"' to 'INPUT type="text"' within a single Session Manager session, which might allow attackers to discover cleartext passwords by reading a session restoration file...
