2136 matches found
Imgur Confirms 2014 Breach of 1.7 Million User Accounts
Popular image sharing community Imgur said last week it was the victim of a data breach in 2014 that exposed 1.7 million user accounts. In a breach notice posted to its website last Friday, the company said users are being notified via email that they must update their passwords immediately. “On...
CVE-2017-1000391
Jenkins versions 2.88 and earlier and 2.73.2 and earlier stores metadata related to 'people', which encompasses actual user accounts, as well as users appearing in SCM, in directories corresponding to the user ID on disk. These directories used the user ID for their name without additional...
CVE-2017-1000395
Jenkins 2.73.1 and earlier, 2.83 and earlier provides information about Jenkins user accounts which is generally available to anyone with Overall/Read permissions via the /user/username/api remote API. This included e.g. Jenkins users' email addresses if the Mailer Plugin is installed. The remote...
CVE-2017-1221
IBM Tivoli Endpoint Manager IBM BigFix 9.2 and 9.5 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 123861...
CVE-2017-1221
IBM Tivoli Endpoint Manager IBM BigFix 9.2 and 9.5 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 123861...
Zhuhai Light Point Culture Communication Co., Ltd Light Point APP has information leakage vulnerability
Light Dot APP is a reading APP focusing on comics, which integrates comics, stories and knowledge to provide users with a light reading comics platform. There is an information leakage vulnerability when registering and retrieving password to get verification code in Light APP, attackers can...
Cross site scripting
In TinyWebGallery v2.4, an XSS vulnerability is located in the mkname, mkitem, and item parameters of the Add/Create module. Remote attackers with low-privilege user accounts for backend access are able to inject malicious script codes into the TWG Explorer item listing. The request method to...
CVE-2017-16636
In Bludit v1.5.2 and v2.0.1, an XSS vulnerability is located in the new page, new category, and edit post function body message context. Remote attackers are able to bypass the basic editor validation to trigger cross site scripting. The XSS is persistent and the request method to inject via edit...
CVE-2017-16635
In TinyWebGallery v2.4, an XSS vulnerability is located in the mkname, mkitem, and item parameters of the Add/Create module. Remote attackers with low-privilege user accounts for backend access are able to inject malicious script codes into the TWG Explorer item listing. The request method to...
VerticalScope hacked again; 2.7 million user accounts affected
By Waqas In June 2016 we reported that the well-known Toronto, Canada-based This is a post from HackRead.com Read the original post: VerticalScope hacked again; 2.7 million user accounts affected...
Debian DLA-1151-2 : wordpress regression update
The fix for CVE-2017-14990 issued as DLA-1151-1 was incomplete and caused a regression. It was discovered that an additional database upgrade and further code changes would be necessary. At the moment these changes are deemed as too intrusive and thus the initial patch for CVE-2017-14990 has been...
Cross site scripting
Shopware v5.2.5 - v5.3 is vulnerable to cross site scripting in the customer and order section of the content management system backend modules. Remote attackers are able to inject malicious script code into the firstname, lastname, or order input fields to provoke persistent execution in the...
WordPress 4.8.2 Activation Key Failed Expiry Vulnerability
WordPress version 4.8.2 fails to have an expiration mechanism tied to activation keys allowing for eternal use. Details ================ Software: WordPress Version: 4.8.2 Homepage: https://wordpress.org/ Advisory report: https://security.dxw.com/advisories/wordpress-signups-activation/ CVE:...
CVE-2017-14990
WordPress 4.8.2 stores cleartext wpsignups.activationkey values but stores the analogous wpusers.useractivationkey values as hashes, which might make it easier for remote attackers to hijack unactivated user accounts by leveraging database read access such as access gained through an unspecified...
Sql injection
WordPress 4.8.2 stores cleartext wpsignups.activationkey values but stores the analogous wpusers.useractivationkey values as hashes, which might make it easier for remote attackers to hijack unactivated user accounts by leveraging database read access such as access gained through an unspecified...
CVE-2017-14990
WordPress 4.8.2 stores cleartext wpsignups.activationkey values but stores the analogous wpusers.useractivationkey values as hashes, which might make it easier for remote attackers to hijack unactivated user accounts by leveraging database read access such as access gained through an unspecified...
CVE-2017-14990
CVE-2017-14990 is confirmed in the connected documents. WordPress 4.8.2 stores cleartext values in wp_signups.activation_key, while wp_users.user_activation_key is stored as a hash, which could enable an attacker with database read access (for example via an unspecified SQL injection) to hijack u...
MISP Override Access Vulnerability
MISP is a suite of open source software solutions for collecting, storing, distributing and sharing cybersecurity metrics and threats cybersecurity event analysis and malware analysis. A security vulnerability exists in versions of MISP prior to 2.4.80. An attacker can exploit the vulnerability t...