416 matches found
CVE-2018-1000412
An improper authorization vulnerability exists in Jenkins Jira Plugin 3.0.1 and earlier in JiraSite.java that allows attackers with Overall/Read access to have Jenkins connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing...
CVE-2017-1545
IBM Doors Web Access 9.5 and 9.6 could allow an attacker with physical access to the system to log into the application using previously stored credentials. IBM X-Force ID: 130914...
PT-2018-5833 · Ibm · Ibm Doors Web Access
Name of the Vulnerable Software and Affected Versions: IBM Doors Web Access versions 9.5 through 9.6 Description: The issue allows an attacker with physical access to the system to log into the application using previously stored credentials. Recommendations: For versions 9.5 and 9.6, consider...
iSmartAlarm CubeOne Arbitrary Command Execution Vulnerability
iSmartAlarm is a DIY smart home security system that allows for self-monitoring and self-control, and Cube One is the control center of this smart system. An arbitrary command execution vulnerability exists in iSmartAlarm CubeOne. An attacker can exploit this vulnerability to execute arbitrary...
CVE-2017-6696
A vulnerability in the file system of Cisco Elastic Services Controllers could allow an authenticated, local attacker to gain access to sensitive user credentials that are stored in an affected system. More Information: CSCvd73677. Known Affected Releases: 2.32...
Websense Triton Unified Security Center 7.7.3 information disclosure vulnerability
Overview Websense Triton Unified Security Center 7.7.3 and possibly earlier versions contains an information disclosure vulnerability which could allow an authenticated attacker to view stored credentials of a possibly higher privileged user. Description CWE-200: Information ExposureWhen logged...
POSH Multiple Vulnerabilities
POSH is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.804244...
OSX VPN Manager
This module lists VPN connections and tries to connect to them using stored credentials. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'OSX VPN Manager', 'Description' = %q This module lists V...
Document URI misrepresentation and masquerading — Mozilla
Mozilla security researcher mozbugra4 reported that through an interaction of frames and browser history it was possible to make the browser believe attacker-supplied content came from the location of a previous page in browser history. This allows for cross-site scripting XSS attacks by loading...
Google Active Directory Sync Tool weak encryption
It's possible to decypher stored credentials...
Google AD Sync Tool Vulnerability (GADS)
Exploit for multiple platform in category local exploits Due to a weakness in the way the Java encryption algorithm PBEwithMD5andDES has been implemented in the GADS tool all stored credentials can be decrypted into plain-text. This includes all of the encrypted passwords stored in any end-users...
Microsoft Windows Deployment Services Unattend Retrieval
This module retrieves the client unattend file from Windows Deployment Services RPC service and parses out the stored credentials. Tested against Windows 2008 R2 x64 and Windows 2003 x86. This module requires Metasploit: https://metasploit.com/download Current source:...
PT-2012-5155 · Tridium · Tridium Niagara Ax Framework
Name of the Vulnerable Software and Affected Versions: Tridium Niagara AX Framework affected versions not specified Description: The issue concerns the improper storage of credential data, allowing attackers to bypass access restrictions by using the stored information for authentication...
RealNetworks Helix Server 14.x < 14.3.x Multiple Vulnerabilities
According to its banner, the remote host is running version 14.x of RealNetworks Helix Server / Helix Mobile Server. Such versions are potentially affected by multiple vulnerabilities : - Administrative and user credentials are insecurely stored in a flat file database. This file may be accessed ...