3112 matches found
CVE-2019-3907
Premisys Identicard version 3.1.190 stores user credentials and other sensitive information with a known weak encryption method MD5 hash of a salt and password...
CVE-2019-3907
Premisys Identicard version 3.1.190 stores user credentials and other sensitive information with a known weak encryption method MD5 hash of a salt and password...
CVE-2019-3907
CVE-2019-3907 affects IDenticard PremiSys (3.1.190). The vulnerability arises from storing user credentials and sensitive data with a weak encryption method (MD5 with salt + password). Exploitation could lead to exposure of credentials and related data, contributing to broader access risks. The I...
Privilege Escalation
The Luci in Red Hat Conga is vulnerable to privilege escalation. Storing usernames and passwords in ac session cookies leads to incorrect session inactivity timeout and to get access to the user credential via the cookie...
CVE-2018-1000410
An information exposure vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier, and the Stapler framework used by these releases, in core/src/main/java/org/kohsuke/stapler/RequestImpl.java, core/src/main/java/hudson/model/Descriptor.java that allows attackers with...
The vulnerability of the IBM WebSphere Portal software arises from the lack of measures taken to protect the structure of the web page. This allows attackers to disclose user credentials during a secure session.
The vulnerability of the IBM WebSphere Portal software exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability can allow a malicious actor to gain access to user credentials during a secure session, thereby allowing the insertion of arbitra...
3S-Smart Software Solutions GmbH CODESYS Control V3 Products
1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION : Exploitable remotely/low skill level to exploit Vendor : 3S-Smart Software Solutions GmbH Equipment : CODESYS Control V3 products Vulnerability : Improper Access Control 2. RISK EVALUATION Successful exploitation of this vulnerability could allow...
CVE-2018-16092
In System Management Module SMM versions prior to 1.06, the FFDC feature includes the collection of SMM system files containing sensitive information; notably, the SMM user account credentials and the system shadow file...
Spotify Phishers Hijack Music Fans' Accounts
A phishing campaign with a clever Spotify lure has been spotted trying to harvest user credentials for the popular streaming service. Researchers at AppRiver detected the offensive earlier this month, in a campaign looking to compromise Spotify customers using bogus – but convincing – emails with...
Information Disclosure
kibana is vulnerable to information disclosure. An improperly initialized kibana login screen causes user-entered credentials to be shown in the URL bar and allows untrusted parties to obtain the user's credentials via access logs or through the Referer header when the user browses to another...
CVE-2018-16162
OpenDolphin 2.7.0 and earlier allows authenticated attackers to obtain other users credentials such as a user ID and/or its password via unspecified vectors...
Default credentials
OpenDolphin 2.7.0 and earlier allows authenticated attackers to obtain other users credentials such as a user ID and/or its password via unspecified vectors...
CVE-2018-16162
CVE-2018-16162 affects OpenDolphin, versions 2.7.0 and earlier. The vulnerability allows authenticated attackers to obtain other users’ credentials (e.g., user IDs and passwords) through unspecified vectors, resulting in information disclosure with partial to high impact on confidentiality and, p...
WordPress 4.6.x < 4.6.6 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A DOM-based cross-site scripting XSS vulnerability exists in the uploadSizeError function within file wp-includes/js/plupload/handlers.js when handling overly large file...
WordPress 4.4.x < 4.4.10 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A DOM-based cross-site scripting XSS vulnerability exists in the uploadSizeError function within file wp-includes/js/plupload/handlers.js when handling overly large file...
WordPress 4.3.x < 4.3.11 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A DOM-based cross-site scripting XSS vulnerability exists in the uploadSizeError function within file wp-includes/js/plupload/handlers.js when handling overly large file...
The vulnerability in the FortiOS operating system’s web portal allows a hacker to expose user credentials.
The vulnerability of the FortiOS operating system’s web portal relates to the storage of user credentials in an exposed manner. Exploiting this vulnerability allows a malicious actor to disclose user credentials remotely...
Swap Digger - Tool That Automates Swap Extraction And Searches For Linux User Credentials, Web Forms Credentials, Web Forms Emails, Http Basic Authentication, Wifi SSID And Keys, Etc
swapdigger is a bash script used to automate Linux swap analysis for post-exploitation or forensics purpose. It automates swap extraction and searches for Linux user credentials, Web form credentials, Web form emails, HTTP basic authentication, WiFi SSID and keys, etc. Download and run the tool O...