UBUNTU-CVE-2015-8213

The getformat function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRETKEY...

HackerOne: Pre-generation of 2FA secret/backup codes seems like an unnecessary risk

If you manage to get a malicious script running in HackerOne, requesting https://hackerone.com/settings/authentication/edit and parsing out the two factor authentication form will yield either… - the 2FA secret key and backup codes that will be used if 2FA is enabled for the first time this sessi...

From django SECRET_KEY to code execution-vulnerability warning-the black bar safety net

A recent review of the code found in some products in the logon of JS code in the leaked SECRETKEY,the value as the password to encrypt the salt, thus exposing the encryption salt is not good., more important is the django security caused great threat. 0x01 SECRETKEY role SECTETKEY in djanog used...

itBit Exchange: Unsecure data in "device" response - OTP

After open https://beta.itbit.com/api/user/devices url we got response:...

McAfee ePolicy Orchestrator Multiple Vulnerabilities (Jan 2015)

McAfee ePolicy Orchestrator is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2015-0922

McAfee ePolicy Orchestrator ePO before 4.6.9 and 5.x before 5.1.2 uses the same secret key across different customers' installations, which allows attackers to obtain the administrator password by leveraging knowledge of the encrypted password...

CVE-2015-0922

McAfee ePolicy Orchestrator ePO before 4.6.9 and 5.x before 5.1.2 uses the same secret key across different customers' installations, which allows attackers to obtain the administrator password by leveraging knowledge of the encrypted password...

CVE-2015-0922

CVE-2015-0922 affects McAfee ePolicy Orchestrator (ePO) versions before 4.6.9 and 5.x before 5.1.2. The issue is an information disclosure: the product uses the same secret key to encrypt password data across different customer installations, allowing an attacker with knowledge of the encrypted p...

PT-2015-4972

Name of the Vulnerable Software and Affected Versions McAfee ePolicy Orchestrator ePO versions prior to 4.6.9 McAfee ePolicy Orchestrator ePO versions 5.x prior to 5.1.2 Description The issue allows attackers to obtain the administrator password by leveraging knowledge of the encrypted password, ...

CVE-2015-0922: Exposure of Sensitive Information to an Unauthorized Actor

McAfee ePolicy Orchestrator ePO before 4.6.9 and 5.x before 5.1.2 uses the same secret key across different customers' installations, which allows attackers to obtain the administrator password by leveraging knowledge of the encrypted password...

[SECURITY] Fedora 20 Update: oath-toolkit-2.4.1-6.fc20

The OATH Toolkit provide components for building one-time password authentication systems. It contains shared libraries, command line tools an d a PAM module. Supported technologies include the event-based HOTP algorithm RFC4226 and the time-based TOTP algorithm RFC6238. OATH stands for Open...

Disqus 2.7.5 Cross Site Request Forgery / Cross Site Scripting

Exploit for php platform in category web applications disqus csrf reset -- -- alert1;' / 0day.today 2018-03-09...

blogVault 1.08 - Missing Account Empty Secret Key Generation

The Backup & Staging – BlogVault Backups WordPress plugin was affected by a Missing Account Empty Secret Key Generation security vulnerability...

NXP Semiconductors MIFARE Classic Smartcard - Multiple Security Weaknesses

No description provided by source. source: http://www.securityfocus.com/bid/31853/info MIFARE Classic is prone to multiple security weaknesses: 1. A security weakness may allow attackers to recover the internal state of the linear feedback shift register. 2. A security weakness may allow attacker...

CVE-2013-7134

Juvia uses the same secret key for all installations, which allows remote attackers to have unspecified impact by leveraging the secret key in app/config/initializers/secrettoken.rb, related to cookies...

Design/Logic Flaw

Juvia uses the same secret key for all installations, which allows remote attackers to have unspecified impact by leveraging the secret key in app/config/initializers/secrettoken.rb, related to cookies...

CVE-2013-7134

Juvia uses the same secret key for all installations, which allows remote attackers to have unspecified impact by leveraging the secret key in app/config/initializers/secrettoken.rb, related to cookies...

CVE-2013-7134

CVE-2013-7134 affects Juvia; vulnerability arises from using the same secret key across installations, allowing remote attackers to leverage the secret_token.rb in cookies with unspecified impact. The provided documents state the issue and linked references but do not supply concrete exploit deta...

CVE-2013-7134: Undefined Security Weakness

Juvia uses the same secret key for all installations, which allows remote attackers to have unspecified impact by leveraging the secret key in app/config/initializers/secrettoken.rb, related to cookies...

Parallels Plesk Panel 12.x Key Disclosure

While auditing the source code for Parallels Plesk Panel 12.x on Linux I noticed the following feature that leads to leakage of the '/etc/psa/private/secretkey'-file in md5 format to non-authenticated users. Parallels responded that the 16byte 'secretkey' should provide sufficient entropy for thi...