Boxcryptor Cross Site Scripting

============================================= INTERNET SECURITY AUDITORS ALERT 2014-001 - Original release date: February 4, 2014 - Last revised: February 4, 2014 - Discovered by: Vicente Aguilera Diaz - Severity: 4.3/10 CVSSv2 Base Scored - CVE-ID: - =============================================...

ABB Relion 650 Series OpenSSL Vulnerability (Update A)

OVERVIEW --------- Begin Update A Part 1 of 2-------- This updated advisory is a follow-up to the original advisory titled ICSA-14-126-01 ABB Relion 650 Series OpenSSL Vulnerability, that was published May 06, 2014, on the NCCIC/ICS-CERT web site. ABB has identified an OpenSSL vulnerability in it...

Default credentials

Spacewalk-backend in Red Hat Network RHN Satellite and Proxy 5.4 includes cleartext user passwords in an error message when a system registration XML-RPC call fails, which allows remote administrators to obtain the password by reading 1 the server log and 2 an email...

CVE-2014-1673

Check Point Session Authentication Agent allows remote attackers to obtain sensitive information user credentials via unspecified vectors...

CVE-2014-1673

Check Point Session Authentication Agent allows remote attackers to obtain sensitive information user credentials via unspecified vectors...

Adult WebMaster PHP - Password Disclosure

Adult WebMaster PHP - Password Disclosure + Exploit:Adult Webmaster PHP - Password Disclosure + Author: vinicius777 + Email/Twitter: vinicius777 AT gmail @vinicius777 + Vendor Homepage: http://sourceforge.net/projects/adultweb/ 1 Administrative Credential Disclosure PoC: root@kali:/ curl...

Starbucks' iOS app storing user credentials in plain text

Watch out, coffee drinkers. If you are one of those 10 million Starbucks customers, who purchases drinks and food directly from their Smartphones, this news is for you! If you use Starbucks’ official iOS app, you should know that the company is not encrypting any of your information, including yo...

DoliWamp 'jqueryFileTree.php' Traversal Gather Credentials

This module will extract user credentials from DoliWamp - a WAMP packaged installer distribution for Dolibarr ERP on Windows - versions 3.3.0 to 3.4.2 by hijacking a user's session. DoliWamp stores session tokens in filenames in the 'tmp' directory. A directory traversal vulnerability in...

GLSA-201401-03 : Nagstamon: Information disclosure

The remote host is affected by the vulnerability described in GLSA-201401-03 Nagstamon: Information disclosure Nagstamons automatic request to check for updates includes plaintext username and password information for one of the monitor servers that the Nagstamon instance connects to. Impact : A...

Nagstamon: Information disclosure

Background Nagstamon is a Nagios status monitor application. Description Nagstamon’s automatic request to check for updates includes plaintext username and password information for one of the monitor servers that the Nagstamon instance connects to. Impact A remote attacker could eavesdrop on this...

Design/Logic Flaw

monitor/index.php in op5 Monitor and op5 Appliance before 5.5.1 allows remote authenticated users to obtain sensitive information such as database and user credentials via error messages that are triggered by 1 a malformed hoststatustypes parameter to status/service/all or 2 a crafted request to...

CVE-2012-0263

monitor/index.php in op5 Monitor and op5 Appliance before 5.5.1 allows remote authenticated users to obtain sensitive information such as database and user credentials via error messages that are triggered by 1 a malformed hoststatustypes parameter to status/service/all or 2 a crafted request to...

PT-2013-6248 · Cisco · Cisco Unified Communications Manager

Name of the Vulnerable Software and Affected Versions: Cisco Unified Communications Manager affected versions not specified Description: The TFTP service allows remote attackers to obtain sensitive information from a phone via an RRQ operation, as demonstrated by discovering a cleartext...

South Korea hit by Android Trojan, Malware in Gaming apps and DDoS attack

Last Tuesday, The National Police Agency of South Korea warned the people that many Malware infected video games being offered in the South Korean markets with the purpose of launching Cyber attacks on the Country. That Malware is collecting location data and IP addresses of infected users and...

SAP Sybase Adaptive Server Enterprise vulnerable to XML injection

Overview SAP Sybase Adaptive Server Enterprise Version 15.7 ESD 2 and possibly earlier versions contains an XML injection vulnerability CWE-91. Description CWE-611:Improper Restriction of XML External Entity Reference 'XXE' SAP Sybase Adaptive Server Enterprise ASE Version 15.7 ESD 2 contains an...

RuggedCom Rugged Operating System < 3.12.2 Multiple Security Vulnerabilities

Binary data 8027.prm...

MGASA-2013-0296 Updated ssmtp package fixes security vulnerability

It was reported that ssmtp, an extremely simple MTA to get mail off the system to a mail hub, did not perform x509 certificate validation when initiating a TLS connection to server. A rogue server could use this flaw to conduct man-in- the-middle attack, possibly leading to user credentials leak...

OTRS 2.1.x < 2.1.8, 2.2.x < 2.2.6 SOAP Security Bypass Vulnerability

Open Ticket Request System OTRS is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

XAMPP 1.8.1 Local Write Access Vulnerability

XAMPP version 1.8.1 allows an unprivileged user the ability to write to the local disk. It has been detected than an unprivileged user can write in the local disk and the local file "lang.tmp" can be modified in the remote machine. The injection is done through the page "/xampp/lang.php"...

Cisco Releases Security Advisory

Cisco has released a security advisory to address a vulnerability in the web framework of Cisco Prime Central for Hosted Collaboration Solution HCS Assurance. This vulnerability could allow an unauthenticated, remote attacker to access sensitive information on the system, including user...