Posnic 1.03 Unauthorized Password Recovery Vulnerability

Exploit for php platform in category web applications ------------------------------------------------------------------------- + Posnic 1.03 forgetpass.php Unauthorized Password Recovery ------------------------------------------------------------------------ Discovered by Juri Gianni -...

USN-3193-1 nettle vulnerability

It was discovered that Nettle incorrectly mitigated certain timing side-channel attacks. A remote attacker could possibly use this flaw to recover private keys...

Multiple NETGEAR routers are vulnerable to administrator password information leaks

The NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 are wireless router products from Netgear, Inc. Information disclosure vulnerabilities exist in several NETGEAR products. For example, the models in question have an open Intern...

Facebook Unveils 'Delegated Recovery' to Replace Traditional Password Recovery Methods

How do you reset the password for your Facebook account if your primary email account also gets hacked? Using SMS-based security code or maybe answering the security questions? Well, it's 2017, and we are still forced to depend on insecure and unreliable password reset schemes like email-based or...

Netman 204 Backdoor / Password Reset

Exploit Title: Netman 204 Backdoor and weak password recovery function Google Dork: intitle:"Netman 204 login" Date: 31st Jan 2017 Exploit Author: Simon Gurney Vendor Homepage: blog.synack.co.uk Software Link: http://www.riello-ups.co.uk/uploads/file/319/1319/FW058-0105FWB0225NetMan204.zip Versio...

Facebook Tackles Account Recovery with Delegated Recovery Protocol

Account recovery, the second fiddle to authentication, still largely hinges on insecure schemes such as security questions or email-based verification for password resets and the like. Facebook today at the Enigma Conference in Oakland, Calif., offered a more modern solution called Delegated...

CVE-2016-10175

The NETGEAR WNR2000v5 router leaks its serial number when performing a request to the /BRSnetgearsuccess.html URI. This serial number allows a user to obtain the administrator username and password, when used in combination with the CVE-2016-10176 vulnerability that allows resetting the answers t...

Design/Logic Flaw

The NETGEAR WNR2000v5 router leaks its serial number when performing a request to the /BRSnetgearsuccess.html URI. This serial number allows a user to obtain the administrator username and password, when used in combination with the CVE-2016-10176 vulnerability that allows resetting the answers t...

CVE-2016-10175

The NETGEAR WNR2000v5 router leaks its serial number when performing a request to the /BRSnetgearsuccess.html URI. This serial number allows a user to obtain the administrator username and password, when used in combination with the CVE-2016-10176 vulnerability that allows resetting the answers t...

Netgear Routers - Password Disclosure

Trustwave SpiderLabs Security Advisory TWSL2017-003: Multiple Vulnerabilities in NETGEAR Routers Published: 01/30/2017 Version: 1.0 Vendor: NETGEAR http://www.netgear.com/ Product: Multiple products Finding 1: Remote and Local Password Disclosure Credit: Simon Kenin of Trustwave SpiderLabs CVE:...

MGASA-2017-0030 Updated mbedtls packages fix security vulnerability

The mbedtls package has been updated to version 1.3.18, which removes a non-default configuration option that could lead to session key recovery in very long TLS sessions and fixes a potential stack corruption that cannot be triggered remotely. It also fixes several bugs. See the upstream release...

Padding Oracle Attack

OpenSSL is vulnerable to padding oracle attacks. The library does not check if there is enough data in both the MAC hash and padding bytes, allowing an attacker to recover the plain text by using the server as a padding oracle. Note: This vulnerability exists because of an incorrect fix for...

FLR Fails When VMDK Is Encrypted With HyTrust

Challenge Attempting to restore guest files using Windows File Level Restore fails when the machine's VMDKs were encrypted using HyTrust. Cause As the VMDKs are encrypted, they can not be mounted to be browsed using the File Level Restore browser. Solution To work around this issue, review KB1459...

CVE-2017-5521

An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices. They are prone to password disclosure via simple crafted requests to the web management server. The bug is exploitable remotely if the remote...

Default credentials

An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices. They are prone to password disclosure via simple crafted requests to the web management server. The bug is exploitable remotely if the remote...

Update Rollup 11 for System Center 2012 R2 Data Protection Manager

Update Rollup 11 for System Center 2012 R2 Data Protection Manager Introduction This article describes the issues that are fixed in Update Rollup 11 for Microsoft System Center 2012 R2 Data Protection Manager. It also contains the installation instructions for this update. Note We recommend that...

SUSE-SU-2017:0164-1 Security update for libxml2

This update for libxml2 fixes the following issues: CVE-2016-9318: libxml2 did not offer a flag directly indicating that the current document may be read but other files may not be opened, which made it easier for remote attackers to conduct XML External Entity XXE attacks via a crafted document...

MS14-017: Description of the Microsoft Office for Mac 2011 14.4.1 Update: April 8, 2014

Resolves vulnerabilities in Microsoft Office that could allow remote code execution if a specially crafted file is opened in an affected version of Microsoft Office.IntroductionThis update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a specially crafted...

Update Rollup 4 for System Center 2012 R2 Virtual Machine Manager

Update Rollup 4 for System Center 2012 R2 Virtual Machine Manager Introduction This article describes the issues that are fixed in Update Rollup 4 for Microsoft System Center 2012 R2 Virtual Machine Manager VMM. There are two updates available for System Center 2012 R2 Virtual Machine Manager. On...

Update Rollup 10 for System Center 2012 R2 Data Protection Manager

Update Rollup 10 for System Center 2012 R2 Data Protection Manager Introduction This article describes the issues that are fixed in Update Rollup 10 for Microsoft System Center 2012 R2 Data Protection Manager. Additionally, this article contains the installation instructions for this update. Note...