U.S. Dept Of Defense: Information Disclosure(PHPINFO/Credentials) on DoD Asset

Summary: A DoD leaks credentials on a phpinfo page. Description: https://███ publicly displays a phpinfo page that leaks system information and credentials. Impact The impact is medium not only due to information leakage of numerous different details such as system information but also the leakag...

Unauthorized Access Vulnerability in YouCloud Full Stack Ops Platform

YouCloud Full Stack O&M Platform provides full-stack agile O&M products such as large-scale monitoring, network monitoring, application performance monitoring, APM, CMDB configuration management repository, and operation automation. Unauthorized access vulnerability exists in UCloud Full Stack O&...

IBM WebSphere Application Server 9.0.0.0 < 9.0.0.9 Information Disclosure (CVE-2018-1957)

The IBM WebSphere Application Server running on the remote host is version 9.0.0.0 through 9.0.0.9 prior to 9.0.0.10. It is, therefore, affected by a information disclosure vulnerability. The vulnerability exists in IBM WebSphere Application Server due to mishandling of data by the application...

CVE-2020-12266

An issue was discovered where there are multiple externally accessible pages that do not require any sort of authentication, and store system information for internal usage. The devices automatically query these pages to update dashboards and other statistics, but the pages can be accessed...

Design/Logic Flaw

An issue was discovered where there are multiple externally accessible pages that do not require any sort of authentication, and store system information for internal usage. The devices automatically query these pages to update dashboards and other statistics, but the pages can be accessed...

CVE-2020-12266

An issue was discovered where there are multiple externally accessible pages that do not require any sort of authentication, and store system information for internal usage. The devices automatically query these pages to update dashboards and other statistics, but the pages can be accessed...

信息收集

This repository is an information collection tool for penetration testing and vulnerability assessment. It is a collection of scripts and tools for gathering information about a target system or network. The repository is written in Python and includes various modules for different tasks such as...

New AgentTesla variant steals WiFi credentials

AgentTesla is a .Net-based infostealer that has the capability to steal data from different applications on victim machines, such as browsers, FTP clients, and file downloaders. The actor behind this malware is constantly maintaining it by adding new modules. One of the new modules that has been...

TA505 Crime Gang Deploys SDBbot for Corporate Network Takeover

The TA505 cybercrime group has ramped up its attacks lately, with a set of campaigns bent on spreading the persistent SDBbot remote-access trojan RAT laterally throughout an entire corporate environment, researchers said. SDBbot RAT is a custom job that has been observed in TA505 attacks since at...

Google Android System Information Disclosure Vulnerability (CNVD-2020-17114)

Android is a Linux-based open source operating system from Google and the Open Handset Alliance OHA in the U.S. System is one of the system components. A security vulnerability exists in System in Android version 10.0. The vulnerability can be exploited by an attacker to obtain information...

Google Android System Information Disclosure Vulnerability (CNVD-2020-17105)

Android is a Linux-based open source operating system from Google and the Open Handset Alliance OHA in the U.S. System is one of the system components. A security vulnerability exists in System in Android. An attacker can exploit this vulnerability to gain access to information...

DotNetNuke Cross-Site Scripting Vulnerability (CNVD-2020-24045)

DotNetNuke is a free , open source , scalable content management system , built on the ASP.NET platform Web application framework. DotNetNuke has a cross-site scripting vulnerability. An attacker can use this vulnerability to conduct an xss attack on the corresponding program to obtain other...

Linux: System Information in /etc/motd

The content of /etc/motd file is displayed to users after successful login. Following escape chars display information about the system: - \m: machine architecture - \r: operating system release - \s: operating system name - \v: operating system version Copyright C 2020 Greenbone Networks GmbH...

Security Bulletin: IBM Content Navigator discloses operating system information in logon response.

Summary IBM Content Navigator includes information about the host operating system in the response after the user successfully authenticates. Vulnerability Details CVEID: CVE-2019-4679 DESCRIPTION: IBM Content Navigator could allow an authenticated user to gain information about the hosting...

sLoad launches version 2.0, Starslord

sLoad, the PowerShell-based Trojan downloader notable for its almost exclusive use of the Background Intelligent Transfer Service BITS for malicious activities, has launched version 2.0. The new version comes on the heels of a comprehensive blog we published detailing the malware’s multi-stage...

Digi AnywhereUSB 14 XSS Injection Vulnerability

The AnywhereUSB product is a network-enabled USB hub that allows USB devices to be connected in any LAN. Digi AnywhereUSB 14 suffers from an XSS injection vulnerability, which could be exploited by an attacker to conduct an xss attack against the corresponding program to obtain other information ...

CVE-2019-7162

Zoho ManageEngine ADSelfService Plus 5.6 Build 5607 is affected by an information-disclosure vulnerability. An exposed service allows an unauthenticated actor to retrieve internal system information and modify the product installation. The issue is confirmed in multiple sources referencing this e...

Microsoft Access Information Disclosure Vulnerability

An information disclosure vulnerability exists in Microsoft Access software when the software fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system. To exploit the vulnerability, an...

Google Android System Information Disclosure Vulnerability (CNVD-2019-44270)

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. There is a security vulnerability in System in Google Android. An attacker can exploit the vulnerability to leak information...

Google Android System Information Disclosure Vulnerability (CNVD-2019-44264)

Android is a Linux-based open source operating system from Google and the Open Handset Alliance OHA in the U.S. System is one of the system components. A security vulnerability exists in System in Google Android version 10. The vulnerability can be exploited by an attacker to disclose information...