IniNet Solutions embeddedWebServer Plain Text Save Vulnerability

IniNet Solutions GmbH is a Swiss company whose product, eWebServer, is third-party Web-based server software. IniNet Solutions embeddedWebServer suffers from a plain text save vulnerability that can be exploited by an attacker to elevate privileges...

IBC Solar ServeMaster Plain Text Password Vulnerability

ServeMaster TLP+ and Danfoss TLX Pro+ are web-based SCADA systems. A plain text password vulnerability exists in ServeMaster TLP+ and Danfoss TLX Pro+. An attacker can exploit this vulnerability to obtain a plain text password by viewing the web page source code...

Schneider Electric StruxureWare Building Expert Plain Text Credentials Vulnerability

StruxureWare Building Expert is the building automation system. A plain text transmission vulnerability exists in Schneider Electric StruxureWare Building Expert products prior to version 2.15, which can be exploited by an attacker to obtain user login credentials...

Smart Traffic Sniffing: NetRipper

Smart Traffic Sniffing NetRipper is a post exploitation tool targeting Windows systems which uses API hooking in order to intercept network traffic and encryption related functions from a low privileged user, being able to capture both plain-text traffic and encrypted traffic before...

FreeBSD : froxlor -- database password information leak (9ee72858-4159-11e5-93ad-002590263bf5)

[email protected] reports : An unauthenticated remote attacker is able to get the database password via webaccess due to wrong file permissions of the /logs/ folder in froxlor version 0.9.33.1 and earlier. The plain SQL password and username may be stored in the /logs/sql-error.log file...

Froxlor 0.9.33.1 MySQL Login Disclosure Vulnerability

Froxlor server management panel versions 0.9.33.1 and below suffer from a MySQL login information disclosure vulnerability. ------------------------------------------------------------------------------------------ Exploit Title: Froxlor Server Management Panel - MySQL Login Information Disclosur...

Schneider Electric InduSoft Password Storage Vulnerability

InduSoft Web Studio is a SCADA system and embedded instrumentation solution for developing HMIs, supervisory control and data acquisition. Schneider Electric InduSoft Web Studio before 7.1.3.5 Patch 5 and Wonderware InTouch Machine Edition through 7.1 SP3 Patch 4 stores the passwords for the...

froxlor -- database password information leak

[email protected] reports: An unauthenticated remote attacker is able to get the database password via webaccess due to wrong file permissions of the /logs/ folder in froxlor version 0.9.33.1 and earlier. The plain SQL password and username may be stored in the /logs/sql-error.log file...

iBall 150M Wireless-N ADSL2+ Router Authentication Bypass Vulnerability

The CGI script used in the iBall 150M Wireless-N ADSL2+ router does not validate credentials. Hence any page in the router can be directly accessed by replacing page extension with .cgi. Exploit Title: iBall 150M Wireless-N ADSL2+ Router Authentication Bypass and Vulnerability Date: 23\04\2015...

iBall 150M Wireless-N ADSL2+ Router Authentication Bypass

Exploit Title: iBall 150M Wireless-N ADSL2+ Router Authentication Bypass and Vulnerability Date: 23\04\2015 Submitter: Gem George Vendor: iBall Tested product:iBall 150M Wireless-N ADSL2+ Router, firmware version 1.00 Tested Product URL:...

Cisco Nexus 9000 Series Software Password Exposure Vulnerability

A vulnerability in Cisco Nexus 9000 Series Software could allow an authenticated, remote attacker to expose passwords in plain text format. The vulnerability is due to older versions of the affected software retaining the ability to decrypt passwords. An attacker could exploit this vulnerability ...

Cisco Unified MeetingPlace Plain Text Password Information Disclosure Vulnerability

A vulnerability in Cisco Unified MeetingPlace could allow an authenticated, remote attacker to view passwords in plain text. The vulnerability is due to the inclusion of sensitive information in the web page source code of the affected software. An attacker could exploit this vulnerability to vie...

RLE Nova-Wind Turbine HMI Insecure Credentials Vulnerability

The Nova-Wind Turbine HMI is the human-machine interface for wind turbines. The Nova-Wind Turbine HMI stores credentials in plain document files, which can allow a malicious user to access the equipment, obtain sensitive information, and change the configuration...

Marktplaats: Content Spoofing - http://aanbieding.marktplaats.nl/wp-admin/admin-ajax.php

Hello, Content spoofing, also referred to as content injection or virtual defacement, is an attack targeting a user made possible by injection vulnerability in a web application. When an application does not properly handle user supplied data, an attacker can supply content to a web application,...

Grindr v2.1.1 iOS & Account System - Breach Attack

Document Title: =============== Grindr v2.1.1 iOS & Account System - Breach Attack References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1420 Release Date: ============= 2015-05-02 Vulnerability Laboratory ID VL-ID: ==================================== 1420...

Hospira MedNet Hardcoded Password Vulnerability (CNVD-2015-02160)

MedNet manages drug libraries, firmware updates, and configurations for Hospira IV pumps for use in the healthcare and public health sectors. MedNet uses plain text stored passwords for the SQL database, which allows an attacker to compromise the MedNet SQL server and gain administrator access to...

[SECURITY] Fedora 22 Update: dokuwiki-0-0.24.20140929c.fc22

DokuWiki is a standards compliant, simple to use Wiki, mainly aimed at crea ting documentation of any kind. It has a simple but powerful syntax which makes sure the datafiles remain readable outside the Wiki and eases the creation of structured texts. All data is stored in plain text files no...

[SECURITY] Fedora 21 Update: dokuwiki-0-0.24.20140929c.fc21

DokuWiki is a standards compliant, simple to use Wiki, mainly aimed at crea ting documentation of any kind. It has a simple but powerful syntax which makes sure the datafiles remain readable outside the Wiki and eases the creation of structured texts. All data is stored in plain text files no...

[SECURITY] Fedora 20 Update: dokuwiki-0-0.24.20140929c.fc20

DokuWiki is a standards compliant, simple to use Wiki, mainly aimed at crea ting documentation of any kind. It has a simple but powerful syntax which makes sure the datafiles remain readable outside the Wiki and eases the creation of structured texts. All data is stored in plain text files no...

MGASA-2015-0108 Updated 389-ds-base packages fix security vulnerabilities

An information disclosure flaw was found in the way the 389 Directory Server stored information in the Changelog that is exposed via the 'cn=changelog' LDAP sub-tree. An unauthenticated user could in certain cases use this flaw to read data from the Changelog, which could include sensitive...