108 matches found
CVE-2018-20881
cPanel before 74.0.8 allows self stored XSS on the Security Questions login page SEC-446...
The DeepSeek controversy: Authorities ask where does the data come from and how safe is it?
The sudden rise of DeepSeek has raised concerns and questions, especially about the origin and destination of the training data, as well as the security of the data. For those returning from a short holiday away from the news, DeepSeek is a new player on the Artificial Intelligence AI field. The...
What NIST’s latest password standards mean, and why the old ones weren’t working
Say goodbye to the days of using the "@" symbol to mean "a" in your password or replacing an "S" with a "$." The U.S. National Institute of Standards and Technology NIST recently announced new guidelines for the ways website and organizations should handle password creation and management that wi...
U.S. Dept Of Defense: CSRF Attack on changing security questions leads to full Account TakeOver
The CSRF vulnerability in the security questions and password reset functionality of the website allowed an attacker to change a victim's security questions and answers, and then leverage this to reset the victim's password and gain full control of the account...
CVE-2024-23579
HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of security questions. This could allow an attacker with access to the database to recover some or all encrypted values...
CVE-2024-23579 HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of security questions
HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of security questions. This could allow an attacker with access to the database to recover some or all encrypted values...
CVE-2024-23579 HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of security questions
HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of security questions. This could allow an attacker with access to the database to recover some or all encrypted values...
PT-2024-19945 · Hcl · Hcl Dryice Optibot Reset Station
Name of the Vulnerable Software and Affected Versions: HCL DRYiCE Optibot Reset Station affected versions not specified Description: The issue concerns insecure encryption of security questions in the HCL DRYiCE Optibot Reset Station. This could potentially allow an attacker with access to the...
CVE-2021-34774
A vulnerability in the web-based management interface of Cisco Common Services Platform Collector CSPC could allow an authenticated, remote attacker to access sensitive data on an affected system. This vulnerability exists because the application does not sufficiently protect sensitive data when...
CVE-2021-34774
A vulnerability in the web-based management interface of Cisco Common Services Platform Collector CSPC could allow an authenticated, remote attacker to access sensitive data on an affected system. This vulnerability exists because the application does not sufficiently protect sensitive data when...
It’s Cybersecurity Awareness Month and there is still a lot to do
October is National Cyber Security Awareness Month NCSAM. And there is still a lot to do! For the last 17 years, the National Cybersecurity Awareness Month NCSAM campaign, driven by the Department of Homeland Security, has raised awareness about the importance of cyber security across the Nation...
Exploit for Missing Authentication for Critical Function in Clickstudios Passwordstate
CVE-2020-26061 ClickStudios Passwordstate Password Reset Por...
CVE-2020-26061
ClickStudios Passwordstate Password Reset Portal prior to build 8501 is affected by an authentication bypass vulnerability. The ResetPassword function does not validate whether the user has successfully authenticated using security questions. An unauthenticated, remote attacker can send a crafted...
Authentication flaw
ClickStudios Passwordstate Password Reset Portal prior to build 8501 is affected by an authentication bypass vulnerability. The ResetPassword function does not validate whether the user has successfully authenticated using security questions. An unauthenticated, remote attacker can send a crafted...
Nihilistic Password Security Questions
Posted three years ago, but definitely appropriate for the times...
BofA Phish Gets Around DMARC, Other Email Protections
A credential-phishing attempt that relies on impersonating Bank of America has emerged in the U.S. this month, with emails that get around secure gateway protections and heavy-hitting protections like DMARC. The campaign involves emails that ask recipients to update their email addresses, warning...
CVE-2018-20875
cPanel before 74.0.8 allows self XSS in the WHM Security Questions interface SEC-433...
CVE-2018-20881
cPanel before 74.0.8 allows self stored XSS on the Security Questions login page SEC-446...