MyBB 1.8.6 Cross Site Request Forgery / Weak Hashing

Security Advisory - Curesec Research Team 1. Introduction Affected Product: MyBB 1.8.6 Fixed in: not fixed Fixed Version Link: n/a Vendor Website: http://www.mybb.com/ Vulnerability Type: CSRF, Weak Hashing, Plaintext Passwords Remote Exploitable: Yes Reported to vendor: 01/29/2016 Disclosed to...

PrivateTunnel Client 2.7.0 (x64) Local Credential Disclosure

PrivateTunnel Client v2.7.0 x64 Local Credentials Disclosure After Sign out Exploit Tested on Windows Windows 7 64bit, English Vendor Homepage @ https://www.privatetunnel.com Date 14/09/2016 Bug Discovery by: Yakir Wizman https://www.linkedin.com/in/yakirwizman http://www.black-rose.ml Viktor Min...

Massive Data Breach Exposes 6.6 Million Plaintext Passwords from Ad Company

Another Day, Another Data Breach! And this time, it's worse than any recent data breaches. Why? Because the data breach has exposed plaintext passwords, usernames, email addresses, and a large trove of other personal information of more than 6.6 Million ClixSense users. ClixSense, a website that...

PrivateTunnel Client 2.7.0 (x64) - Local Credentials Disclosure

PrivateTunnel Client v2.7.0 x64 Local Credentials Disclosure After Sign out Exploit Tested on Windows Windows 7 64bit, English Vendor Homepage @ https://www.privatetunnel.com Date 14/09/2016 Bug Discovery by: Yakir Wizman https://www.linkedin.com/in/yakirwizman http://www.black-rose.ml Viktor Min...

Microsoft Office Information Disclosure Vulnerability

An information disclosure vulnerability exists when Microsoft Outlook fails to enforce copy/paste permissions on DRM-protected emails. An attacker who successfully exploited the vulnerability could potentially extract plaintext content from DRM-protected draft emails. The attacker would have to u...

About the security content of iOS 10

About the security content of iOS 10 This document describes the security content of iOS 10. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent...

Apple iCloud Desktop Client 5.2.1.0 Credential Disclosure

Apple iCloud Desktop Client v5.2.1.0 Local Credentials Disclosure After Sign Out Exploit Tested on Windows Windows 7 64bit, English Vendor Homepage @ https://www.apple.com/ Product Homepage @ https://support.apple.com/en-us/HT204283 Date 07/09/2016 Bug Discovery by: Yakir Wizman...

Dropbox Desktop Client 9.4.49 (x64) - Local Credentials Disclosure

Dropbox Desktop Client v9.4.49 64bit Local Credentials Disclosure Tested on Windows Windows Server 2012 R2 64bit, English Vendor Homepage @ https://www.dropbox.com Date 06/09/2016 Bug Discovery by: Yakir Wizman https://www.linkedin.com/in/yakirwizman http://www.black-rose.ml Viktor Minin...

LogMeIn Client 1.3.2462 (x64) - Local Credentials Disclosure

LogMeIn Client v1.3.2462 64bit Local Credentials Disclosure Tested on Windows Windows Server 2012 R2 64bit, English Vendor Homepage @ https://secure.logmein.com/home/en Date 06/09/2016 Bug Discovery by: Alexander Korznikov https://www.linkedin.com/in/nopernik http://korznikov.com/ Viktor Minin...

HTTPS Information Disclosure Vulnerability

HTTPS Hypertext Transfer Protocol Secure is a network security transfer protocol that communicates over a computer network via the Hypertext Transfer Protocol HTTP, utilizing SSL/TLS to encrypt packets of data.HTTPS was developed with the primary purpose of providing authentication of web servers...

HTTP Information Disclosure Vulnerability

HTTP HyperText Transfer Protocol is one of the most widely used network protocols on the Internet. HTTP was designed to provide a means of publishing and receiving HTML pages, and the resources requested through the HTTP protocol are identified by Uniform Resource Identifiers URIs.HTTP/2 is one o...

Multiple Applications - Local Credentials Disclosure

Multiple Applications - Local Credentials Disclosure. Local exploit for Windows platform Dropbox Desktop Client v9.4.49 64bit Local Credentials Disclosure Tested on Windows Windows Server 2012 R2 64bit, English Vendor Homepage @ https://www.dropbox.com Date 06/09/2016 Bug Discovery by: Yakir Wizm...

Navicat Premium 11.2.11 (64bit) Local Database Password Disclosure Vulnerability

Navicat premium is a database management tool. Navicat Premium client v11.2.11 suffers from a local password disclosure vulnerability, where the password is stored in plaintext and can be exploited to obtain the database password...

WIN-911 7.17.00 - Multiple Vulnerabilities

WIN-911 7.17.00 - Multiple Vulnerabilities Title: WIN-911 - Insecure File Permissions EoP CWE Class: CWE-276: Incorrect Default Permissions Date: 05/09/2016 Vendor: Win911 Product: WIN-911 Type: Alarm Notification Software Version: V7.17.00 Download URL: through Rockwell Automation downloads:...

WIN-911 7.17.00 Insecure File Permissions / Plaintext Password Storage

Title: WIN-911 - Insecure File Permissions EoP CWE Class: CWE-276: Incorrect Default Permissions Date: 05/09/2016 Vendor: Win911 Product: WIN-911 Type: Alarm Notification Software Version: V7.17.00 Download URL: through Rockwell Automation downloads:...

Russia's Largest Portal HACKED; Nearly 100 Million Plaintext Passwords Leaked

Another data breach from 2012, and this time, it's Russia's biggest internet portal and email provider Rambler.ru. Rambler.ru, also known as Russia's Yahoo, suffered a massive data breach in 2012 in which an unknown hacker or a group of hackers managed to steal nearly 100 Million user accounts,...

MySQL 5.5.45 (x64) - Local Credentials Disclosure

MySQL 5.5.45 x64 - Local Credentials Disclosure MySQL 5.5.45 64bit Local Credentials Disclosure Tested on Windows Windows Server 2012 R2 64bit, English Vendor Homepage @ https://www.mysql.com Date 05/09/2016 Bug Discovered by Yakir Wizman https://www.linkedin.com/in/yakirwizman...

Navicat Premium 11.2.11 (x64) - Local Database Password Disclosure

Exploit for windows platform in category local exploits Navicat Premium 11.2.11 64bit Local Password Disclosure Tested on Windows Windows Server 2012 R2 64bit, English Vendor Homepage @ https://www.navicat.com/ Date 05/09/2016 Bug Discovered by Yakir Wizman https://www.linkedin.com/in/yakirwizman...

MySQL 5.5.45 (x64) - Local Credentials Disclosure

MySQL 5.5.45 64bit Local Credentials Disclosure Tested on Windows Windows Server 2012 R2 64bit, English Vendor Homepage @ https://www.mysql.com Date 05/09/2016 Bug Discovered by Yakir Wizman https://www.linkedin.com/in/yakirwizman http://www.black-rose.ml Special Thanks & Greetings to friend of...

DEBIAN-CVE-2016-6298

The Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before 0.3.2 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain cleartext data via a Million Message Attack MMA...