Cisco TelePresence Server API Privilege Vulnerability

A vulnerability in Cisco TelePresence Server Software could allow an unauthenticated, remote attacker to emulate Cisco TelePresence Server endpoints. The vulnerability is due to how session identification information is maintained by a specific API of the affected software. An attacker could...

Dahua DHI-HCVR7216A-S3 Man-in-the-Middle Attack Vulnerability

Dahua DHI-HCVR7216A-S3 is a network DVR product from China Dahua Dahua. A man-in-the-middle attack vulnerability exists in Dahua DHI-HCVR7216A-S3 V3.210.0001.10 build 2016-06-06. As the Dahua DVR protocol running on TCP port 37777 is an unencrypted binary protocol. It allows an attacker to create...

CVE-2017-6432

An issue was discovered on Dahua DHI-HCVR7216A-S3 3.210.0001.10 build 2016-06-06 devices. The Dahua DVR Protocol, which operates on TCP Port 37777, is an unencrypted, binary protocol. Performing a Man-in-the-Middle attack allows both sniffing and injections of packets, which allows creation of...

CVE-2017-6432

An issue was discovered on Dahua DHI-HCVR7216A-S3 3.210.0001.10 build 2016-06-06 devices. The Dahua DVR Protocol, which operates on TCP Port 37777, is an unencrypted, binary protocol. Performing a Man-in-the-Middle attack allows both sniffing and injections of packets, which allows creation of...

CVE-2017-6432

The CVE-2017-6432 entry concerns Dahua DHI-HCVR7216A-S3 devices (firmware 3.210.0001.10, build 2016-06-06). The Dahua DVR protocol on TCP port 37777 is an unencrypted binary protocol; a Man-in-the-Middle can sniff and inject packets, enabling creation of fully privileged new users and capture of ...

CVE-2017-6297

The L2TP Client in MikroTik RouterOS versions 6.83.3 and 6.37.4 does not enable IPsec encryption after a reboot, which allows man-in-the-middle attackers to view transmitted data unencrypted and gain access to networks on the L2TP server by monitoring the packets for the transmitted data and...

CVE-2016-8375

An issue was discovered in Becton, Dickinson and Company BD Alaris 8015 Point of Care PC unit, Version 9.5 and prior versions, and Version 9.7, and 8000 PC unit. An unauthorized user with physical access to an affected Alaris PC unit may be able to obtain unencrypted wireless network authenticati...

CVE-2016-9334

An issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 controller 1763-L16AWA, Series A and B, Version 14.000 and prior versions; 1763-L16BBB, Series A and B, Version 14.000 and prior versions; 1763-L16BWA, Series A and B, Version 14.000 and prior versions; and 1763-L16DWD,...

CVE-2016-9346

An issue was discovered in Moxa MiiNePort E1 versions prior to 1.8, E2 versions prior to 1.4, and E3 versions prior to 1.1. Configuration data are stored in a file that is not encrypted...

Code injection

An issue was discovered in Moxa MiiNePort E1 versions prior to 1.8, E2 versions prior to 1.4, and E3 versions prior to 1.1. Configuration data are stored in a file that is not encrypted...

CVE-2016-9346

CVE-2016-9346 affects Moxa MiiNePort E1 (before 1.8), E2 (before 1.4), and E3 (before 1.1). The issue is cleartext storage of configuration data in an unencrypted file, enabling potential information disclosure. NVD notes CVSS v3 base score 5.3 (L: Low impact on confidentiality) with network acce...

CVE-2016-6110

IBM Tivoli Storage Manager discloses unencrypted login credentials to Vmware vCenter that could be obtained by a local user...

CVE-2016-6110

IBM Tivoli Storage Manager discloses unencrypted login credentials to Vmware vCenter that could be obtained by a local user...

Design/Logic Flaw

IBM Tivoli Storage Manager discloses unencrypted login credentials to Vmware vCenter that could be obtained by a local user...

CVE-2016-6110

IBM Tivoli Storage Manager discloses unencrypted login credentials to Vmware vCenter that could be obtained by a local user...

AlphaBay Dark Web Marketplace Hacked; Exposes Over 200,000 Private Messages

AlphaBay, possibly the largest active dark web marketplace at the moment, has paid a hacker after he successfully exploited vulnerabilities in the internal mailing system of the website and hijacked over 200,000 private unencrypted messages from several users. The hacker, using the pseudonym...

Downloads Resources over HTTP

Overview Affected versions of windows-build-tools insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code...

Starbucks: Exposed Unencrypted Telnet Endpoint

Hi, I'm not sure where to submit this as I know it is a low/medium risk issue on an asset which is out of scope. Essentially I stumbled across the endpoint whilst looking at other Starbucks domains within scope, the affected host is: franchisee.starbucks.com:23 it was found to be running an...

OmniView Information Disclosure Vulnerability

OmniView is a data management control center for monitoring and controlling backup generators. An information disclosure vulnerability exists in OmniView.The OmniView web application uses the HTTP protocol to transmit credentials, which could be sniffed by an attacker, leading to the disclosure o...

OmniView Information Disclosure Vulnerability (CNVD-2016-13111)

OmniView is a data management control center for monitoring and controlling backup generators. An information disclosure vulnerability exists in OmniView.The OmniView web application uses the HTTP protocol to transmit credentials, which could be sniffed by an attacker, leading to the disclosure o...