webEdition 6.3.8.0 Path Traversal Vulnerability

webEdition version 6.3.8.0 suffers from a path traversal vulnerability. Vendor: webEdition e.V. Vulnerable Versions: 6.3.8.0 SVN-Revision: 6985 and probably prior Tested Version: 6.3.8.0 SVN-Revision: 6985 Advisory Publication: August 6, 2014 without technical details Vendor Notification: August ...

Apple Launches iOS 8, Fixes Dozens of Security Flaws

Apple has released iOS 8, a massive update to its mobile operating system, that includes fixes for more than 40 security vulnerabilities. Apple is touting iOS 8 as the biggest update to the software since it launched the App Store, and, aside from the security fixes, there are hundreds of new...

ManageEngine DeviceExpert User Credentials Information Disclosure Vulnerability

ManageEngine DeviceExpert is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

Salesforce Warns Customers of Dyreza Banker Trojan Attacks

Salesforce.com is warning its customers that the Dyreza banker Trojan is now believed to be targeting some of the company’s users. The Trojan, which has the ability to bypass SSL, typically goes after customers of major banks, but seems to be expanding its reach. Dyreza is relatively new among th...

phpMyFAQ 2.8.x - Multiple Vulnerabilities

Title: phpMyFAQ 2.8.X - Multiple Vulnerabilities Vendor: phpmyfaq.de Date: 04.09.19 Version: = 2.8.12 Latest ATM Tested on: Apache 2.2 / PHP 5.4 / Linux Contact: smash at devilteam.pl 1 Persistent XSS Administrator is able to view information about specific user session in 'Statistic' tab. Over...

CVE-2014-5036

The Storage Controller SC component in Eucalyptus 3.4.2 through 4.0.x before 4.0.1, when Dell Equallogic SAN is used, logs the CHAP user credentials, which allows local users to obtain sensitive information by reading the logs...

CVE-2014-5036

The Storage Controller SC component in Eucalyptus 3.4.2 through 4.0.x before 4.0.1, when Dell Equallogic SAN is used, logs the CHAP user credentials, which allows local users to obtain sensitive information by reading the logs...

CVE-2014-5036

The Storage Controller SC component in Eucalyptus 3.4.2 through 4.0.x before 4.0.1, when Dell Equallogic SAN is used, logs the CHAP user credentials, which allows local users to obtain sensitive information by reading the logs...

ManageEngine DeviceExpert User Credentials

This module extracts usernames and salted MD5 password hashes from ManageEngine DeviceExpert version 5.9 build 5980 and prior. This module has been tested successfully on DeviceExpert version 5.9.7 build 5970. Module Options msf use auxiliary/scanner/http/manageengine/deviceexpertusercreds msf...

Community Health data leak suspected of the use of the Heartbleed vulnerability-a vulnerability warning-the black bar safety net

When the Heartbleed OpenSSL vulnerability in 4 months is discovered, the security community many experts are warning that the vulnerability could be used to expose sensitive data, although at the time also there is no evidence that attackers are actively using Heartbleed vulnerability. And now, a...

supermicro-ipmi-conf NSE Script

Attempts to download an unprotected configuration file containing plain-text user credentials in vulnerable Supermicro Onboard IPMI controllers. The script connects to port 49152 and issues a request for "/PSBlock" to download the file. This configuration file contains users with their passwords ...

逐浪CMS SQL注入漏洞

简要描述： RT 详细说明： http://demo.zoomla.cn/user/UserShop/OrderList.aspx?menu=souch&souchtable=&souchkey= braid 密码：123456 1点左边的添加账单生成一个订单 2看下图 漏洞证明： 表：...

Phabricator: Back - Refresh - Attack To Obtain User Credentials

Back - refresh attack is attack which enables an adversary to obtain application credentials by going by to previous page and re-submitting the expired-document. How to perform: 1. Register to https:///auth/register/ 2. Once registered, press "Back" on the browser window. Now you'll see the...

United.com Insecure Transit

United Airwaysr united.com Insecure Transmission of User Credentials Revision Date: May 6th, 2014 Reason for Revision: Issue has been fixed by united.com Systems: www.united.com Severity: Critical Category: Information Disclosure Author: Michael Scheidell, CCISO – Managing Director, Security...

Authentication flaw

Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions via a request to TCP port 37777...

CVE-2013-6117

Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions via a request to TCP port 37777...

PHPizabi 0.848b C1 HFP3 - Database Information Disclosure Vuln

No description provided by source. -------------------------------------------------------- PHPizabi v0.848b C1 HFP3 database information exposure -------------------------------------------------------- I would like to state that I am in no way responsible for how this information is used. It is...

ASPApp PortalAPP 0 Remote User Database Access Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/9354/info A problem has been identified in ASPapp PortalApp when user credentials are stored on a system. Because of this, an attacker may be able to gain unauthorized access to sensitive information...

FOSCAM IP-Cameras Improper Access Restrictions

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ MayGion IP Cameras multiple vulnerabilities 1. Advisory Information Title: MayGion IP Cameras multiple vulnerabilities Advisory ID: CORE-2013-0322 Advisory URL:...

Supernews <= 2.6.1 - SQL Injection Exploit

No description provided by source. ?php Exploit Title: Supernews = 2.6.1 SQL Injection Exploit Google Dork: intext:2003 - 2004 : SuperNews : Todos os direitos reservados Date: 2012/ Author: WhiteCollarGroup Software Link: http://phpbrasil.com/script/vT0FaOCySSH/supernews Version: 2.6.1 Tested on:...