3112 matches found
iOS core application design vulnerability that exposed the user's Apple ID credentials-vulnerability warning-the black bar safety net
! Check Point alert of the Apple iOS to the core application may be exposed to user credentials. Fortunately iOS 9 contains the relevant patch. Apple ID the ios operating system specifically for user provides convenience to users themselves through an Apple ID to manage the device. Now, iOS marke...
Schneider Electric StruxureWare Building Expert Security Patch
Industrial control manufacturer Schneider Electric has published new firmware for its StruxureWare Building Expert building automation system that patches a remotely exploitable vulnerability. Researcher Artyom Kurbatov discovered that the system transmits user credentials in plaintext between th...
Vulnerability that allows bypassing the reCaptcha test
PMASA-2015-4 Announcement-ID: PMASA-2015-4 Date: 2015-09-08 Summary Vulnerability that allows bypassing the reCaptcha test Description This vulnerability allows to complete the reCaptcha test and subsequently perform a brute force attack to guess user credentials without having to complete furthe...
phpMyAdmin -- reCaptcha bypass
The phpMyAdmin development team reports: This vulnerability allows to complete the reCaptcha test and subsequently perform a brute force attack to guess user credentials without having to complete further reCaptcha tests. We consider this vulnerability to be non critical since reCaptcha is an...
Apache James Server 2.3.2 - Remote Command Execution
Exploit Title: Apache James Server 2.3.2 Authenticated User Remote Command Execution Date: 16\10\2014 Vendor Homepage: http://james.apache.org/server/ Software Link: http://ftp.ps.pl/pub/apache/james/server/apache-james-2.3.2.zip 版本: Apache James Server 2.3.2 Tested on: Ubuntu, Debian...
CVE-2015-0943
Basware Banking Maksuliikenne before 9.10.0.0 does not encrypt communication between the client and the backend server, which allows man-in-the-middle attackers to obtain encryption keys, user credentials, and other sensitive information by sniffing the network or modify this traffic by inserting...
ceph-deploy: keyring permissions are world readable in ~ceph
It was discovered that ceph-deploy, a utility for deploying Red Hat Ceph Storage, would create the keyring file with world readable permissions, which could possibly allow a local user to obtain authentication credentials from the keyring file...
PT-2016-41: Information Disclosure in GE Proficy HMI/SCADA iFIX, Proficy HMI/SCADA CIMPLICITY, and Proficy Historian
The specialists of the Positive Research center have detected an Information Disclosure vulnerability in GE Proficy HMI/SCADA iFIX, Proficy HMI/SCADA CIMPLICITY, and Proficy Historian. Vulnerability due to insufficient protection of user credentials allows attackers to obtain user passwords. How ...
Chiyu Technology fingerprint access control contains multiple vulnerabilities
Overview Multiple models of Chiyu Technology fingerprint access control devices contain a cross-site scripting XSS vulnerability and an authentication bypass vulnerability. Description CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS- CVE-2015-2870According to t...
SUSE SLES10 Security Update : strongswan (SUSE-SU-2015:1228-1)
strongswan was updated to fix two security issues : An issue that could enable rogue servers to gain user credentials from a client in certain IKEv2 setups. CVE-2015-4171 A bug in decoding IDDERASN1DN ID payloads that could be used for remote denial of service attacks. CVE-2014-2891 Note that...
PT-2017-01: Information Disclosure in Rockwell Automation Micrologix 1100 and 1400 PLC
The specialists of the Positive Research center have detected an Information Disclosure vulnerability in Rockwell Automation Micrologix 1100 and 1400 PLC. Vulnerability in Allen-Bradly MicroLogix 1100 and 1400 allows remote attackers to obtain user credentials in clear text by sniffing...
Ubuntu: Security Advisory (USN-2628-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Design/Logic Flaw
Thermostat before 2.0.0 uses world-readable permissions for the web.xml configuration file, which allows local users to obtain user credentials by reading the file...
CVE-2015-3201
Thermostat before 2.0.0 uses world-readable permissions for the web.xml configuration file, which allows local users to obtain user credentials by reading the file...
CVE-2015-3201
Thermostat web application stores database credentials in a world-readable configuration file (web.xml), enabling a local user to read credentials and potentially access/modify monitored JVM data or control connected JVMs. Red Hat RHSA-2015:1052 and Fedora advisories/ Nessus entries document the ...
strongswan -- Information Leak Vulnerability
strongSwan Project reports: An information leak vulnerability was fixed that, in certain IKEv2 setups, allowed rogue servers with a valid certificate accepted by the client to trick it into disclosing user credentials even plain passwords if the client accepts EAP-GTC. This was caused because...
ESA-2015-044: EMC Documentum xMS Sensitive Information Disclosure Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2015-044: EMC Documentum xMS Sensitive Information Disclosure Vulnerability EMC Identifier: ESA-2015-044 CVE Identifier: CVE-2015-0527 Severity Rating: CVSS v2 Base Score: 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C Affected products: • EMC Documentum xCelerat...
[SYSS-2014-007] FrontRange DSM - Multiple Vulnerabilities
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2014-007 Product: FrontRange DSM Vendor: FrontRange Solutions USA Inc. and/or its affiliates Affected Versions: v7.2.1.2020, v7.2.2.2331 Tested Versions: v7.2.1.2020, v7.2.2.2331 Vulnerability Type: Use of Hard-coded Cryptographic...
科讯网校系统xss漏洞(密码为MD5加密)
简要描述： 大CMS厂商。。 http://www.kesion.com/ 已有 469,628 个网站选择KESION产品搭建，今日新增网站 104 个 拿了好多证书。 详细说明： 首先在他们网站 http://e.kesion.com/model/view.aspx?mid=3&id=4373 我目测只要有回复框就百分百存在这漏洞 而且全站判断的方式一样 为什么这样说呢 往下面看就知道了 http://e.kesion.com/model/view.aspx?mid=3&id=4373 2014年司法考试历年真题课件-民法 OK...
