PT-2023-26000 · Hcl · Hcl Compass

Name of the Vulnerable Software and Affected Versions: HCL Compass affected versions not specified Description: HCL Compass is vulnerable to insecure password requirements. An attacker could easily guess the password and gain access to user accounts. Recommendations: At the moment, there is no...

Automatic disruption of human-operated attacks through containment of compromised user accounts

Our experience and insights from real-world incidents tell us that the swift containment of compromised user accounts is key to disrupting hands-on-keyboard attacks, especially those that involve human-operated ransomware. In these attacks, lateral movement follows initial access as the next...

The vulnerability of the Apache InLong data integration platform, related to weak password requirements, allows attackers to gain access to user accounts.

The vulnerability of the Apache InLong data integration platform is related to weak password requirements. Exploiting this vulnerability could allow a malicious actor to gain access to a user account remotely...

Cross-Site Request Forgery Vulnerability in NXLog Manager

NXLog Manager is a solution that can be used from a browser to easily manage and monitor a large number of NXLog Enterprise instances. NXLog Manager suffers from a cross-site request forgery vulnerability that can be exploited by a remote attacker to submit a specially crafted malicious request...

Design/Logic Flaw

An insufficiently protected credentials vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local authenticated administrators to gain access to user accounts and access sensitive data used by the user account via unspecified vectors. We have...

CVE-2023-23370

The CVE-2023-23370 issue affects QVPN Device Client (Windows) with the root cause being insufficient protection of credentials. Versions prior to 2.1.0.0518 are vulnerable; exploitation could allow local authenticated administrators to gain access to user accounts and sensitive data via unspecifi...

CVE-2023-23370 QVPN Device Client

An insufficiently protected credentials vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local authenticated administrators to gain access to user accounts and access sensitive data used by the user account via unspecified vectors. We have...

Some Meta Employees and Security Guards Hacked User Accounts

By Deeba Ahmed The fired individuals included on-contract security guards who worked for Meta and could access an internal tool for employees. This is a post from HackRead.com Read the original post: Some Meta Employees and Security Guards Hacked User Accounts...

CVE-2023-32791

Cross-Site Request Forgery CSRF vulnerability in NXLog Manager 5.6.5633 version. This vulnerability allows an attacker to manipulate and delete user accounts within the platform by sending a specifically crafted query to the server. The vulnerability is based on the lack of proper validation of t...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in NXLog Manager 5.6.5633 version. This vulnerability allows an attacker to manipulate and delete user accounts within the platform by sending a specifically crafted query to the server. The vulnerability is based on the lack of proper validation of t...

CVE-2023-32791 Cross-Site Request Forgery on NXLog Manager

Cross-Site Request Forgery CSRF vulnerability in NXLog Manager 5.6.5633 version. This vulnerability allows an attacker to manipulate and delete user accounts within the platform by sending a specifically crafted query to the server. The vulnerability is based on the lack of proper validation of t...

CVE-2023-32791 Cross-Site Request Forgery on NXLog Manager

Cross-Site Request Forgery CSRF vulnerability in NXLog Manager 5.6.5633 version. This vulnerability allows an attacker to manipulate and delete user accounts within the platform by sending a specifically crafted query to the server. The vulnerability is based on the lack of proper validation of t...

CVE-2023-32791

NXLog Manager is affected by a CSRF vulnerability in version 5.6.5633. The issue arises from insufficient validation of request origin, enabling a remote attacker to manipulate and delete user accounts by sending a crafted query to the server. The CVE record lists a CVSS v3.1 base score of 6.5 (M...

cashIT Security Breach

cashIT is an old cell phone recycling website by cashIT India. cashIT suffers from a security vulnerability that stems from a database disclosure system settings, user accounts, etc. that can be triggered via HTTP endpoints exposed to the network...

Nxlog 跨站请求伪造漏洞

NXLog Manager is a solution that can be used from a browser to easily manage and monitor a large number of NXLog Enterprise instances. NXLog Manager suffers from a cross-site request forgery vulnerability that can be exploited by a remote attacker to submit a specially crafted malicious request...

Application allows excessively long password value

Description Vrite v0.2.0 allows excessively long passwords to be set for user accounts which introduce several issues and challenges, primarily related to performance, storage, and compatibility. Proof of Concept 1. Make an user profile in the app. 2. Go to settings security Change password. 3. I...

OESA-2023-1687 shadow security update

This package includes the necessary programs for converting plain password files to the shadow password format and to manage user and group accounts. Security Fixes: When gpasswd1 asks for the new password, it asks twice as is usual for confirming the new password. Each of those 2 password prompt...

UBUNTU-CVE-2023-41324

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. An API user that have read access on users resource can steal accounts of other users. Users are advised t...

CVE-2023-41324 Account takeover through API in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. An API user that have read access on users resource can steal accounts of other users. Users are advised t...

CVE-2023-41885

CVE-2023-41885 affects Piccolo ORM. The BaseUser.login implementation leaks timing information, enabling malicious users to enumerate valid usernames (time-based user enumeration). Affected: versions before 0.121.0; fixed in 0.121.0. Impact is information disclosure and potential follow-on attack...