Code injection

IBM Kenexa LCMS Premier on Cloud stores user credentials in plain in clear text which can be read by an authenticated user...

CVE-2016-5950

IBM Kenexa LCMS Premier on Cloud stores user credentials in plain in clear text which can be read by an authenticated user...

CVE-2016-5950

CVE-2016-5950 affects IBM Kenexa LCMS Premier on Cloud. The vulnerability is that credentials are stored in plain text and could be read by an authenticated user, exposing sensitive information. The incident is documented with a CVSS3.0 base score of 6.5 (C:H/I:N/A:N) and CVSS2.0 base score 4.0 (...

PT-2017-9905

Name of the Vulnerable Software and Affected Versions IBM BigFix Inventory version 9.2 Description The issue concerns the storage of user credentials in plain text, which can be accessed by a local user. This allows unauthorized individuals to obtain sensitive information. Recommendations For IBM...

Advantech WebAccess 8.1 Post Authentication Credential Collector

This module allows you to log into Advantech WebAccess 8.1, and collect all of the credentials. Although authentication is required, any level of user permission can exploit this vulnerability. Note that 8.2 is not suitable for this. Module Options msf use auxiliary/gather/advantech/webaccesscred...

SentryHD 02.01.12e - Local Privilege Escalation

''' Exploit Title: SentryHD 02.01.12e Privilege Escalation Date: 18-01-2017 Software Link: http://www.minutemanups.com/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: local 1. Description Every user can read: c:\Program Files...

Error: The Citrix Broker Service failed to validate a user's credentials on an XML service

WhenDomain Pass-throughis configured, the following is seen in the event log for the StoreFront: Log Name:Application Source: Citrix Broker Service Date: 2/8/2017 7:31:58 AM Event ID: 2100 Task Category: None Level: Warning Keywords: User: NETWORK SERVICE Computer: VDA name Description: The Citri...

User Cannot Connect To Anonymous Store Without Username And Password.

Issue: User cannot connect to anonymous storewithout username and password. Steps To Reproduce The Issue on Receiver 4.4 Create a Store for Unauthenticated users in StoreFront 3.0. Confirm that Advertised is set toNo for this store Install Receiver 4.4. Add the Store URL for the Unauthenticated...

CVE-2016-4028

An issue was discovered in Open-Xchange OX Guard before 2.4.0-rev8. OX Guard uses an authentication token to identify and transfer guest users' credentials. The OX Guard API acts as a padding oracle by responding with different error codes depending on whether the provided token matches the...

Design/Logic Flaw

An issue was discovered in Open-Xchange OX Guard before 2.4.0-rev8. OX Guard uses an authentication token to identify and transfer guest users' credentials. The OX Guard API acts as a padding oracle by responding with different error codes depending on whether the provided token matches the...

PT-2016-5813

Name of the Vulnerable Software and Affected Versions Open-Xchange OX Guard versions prior to 2.4.0-rev8 Description An issue in Open-Xchange OX Guard allows attackers to guess the correct padding of the authentication token by exploiting the API's behavior as a padding oracle. This is possible d...

CVE-2016-6606

An issue was discovered in cookie encryption in phpMyAdmin. The decryption of the username/password is vulnerable to a padding oracle attack. This can allow an attacker who has access to a user's browser cookie file to decrypt the username and password. Furthermore, the same initialization vector...

School Full CBT 0.1 - SQL Injection

School Full CBT 0.1 - SQL Injection Exploit Title.............. School Full CBT SQL Injection Google Dork................ N/A Date....................... 14/10/2016 Exploit Author............. lahilote Vendor Homepage............ http://www.sourcecodester.com/node/9859 Software Link...

Fortinet FortiWLC Information Disclosure Vulnerability

Fortinet FortiWLC is a wireless controller from Fortinet. A security vulnerability exists in Fortinet FortiWLC. An attacker can exploit this vulnerability by reading the pam.log file to obtain sensitive user credentials...

CVE-2016-7561

Fortinet FortiWLC 6.1-2-29 and earlier, 7.0-9-1, 7.0-10-0, 8.0-5-0, 8.1-2-0, and 8.2-4-0 allow administrators to obtain sensitive user credentials by reading the pam.log file...

CVE-2016-7561

Fortinet FortiWLC 6.1-2-29 and earlier, 7.0-9-1, 7.0-10-0, 8.0-5-0, 8.1-2-0, and 8.2-4-0 allow administrators to obtain sensitive user credentials by reading the pam.log file...

Design/Logic Flaw

Fortinet FortiWLC 6.1-2-29 and earlier, 7.0-9-1, 7.0-10-0, 8.0-5-0, 8.1-2-0, and 8.2-4-0 allow administrators to obtain sensitive user credentials by reading the pam.log file...

CVE-2016-7561

Fortinet FortiWLC 6.1-2-29 and earlier, 7.0-9-1, 7.0-10-0, 8.0-5-0, 8.1-2-0, and 8.2-4-0 allow administrators to obtain sensitive user credentials by reading the pam.log file...

CVE-2016-7561

CVE-2016-7561 affects Fortinet FortiWLC: versions 6.1-2-29 and earlier, 7.0-9-1, 7.0-10-0, 8.0-5-0, 8.1-2-0, and 8.2-4-0. The issue allows administrators to obtain sensitive user credentials by reading the pam.log file. The connected documents confirm this information exposure vector and list a F...

CVE-2016-7561: Exposure of Sensitive Information to an Unauthorized Actor

Fortinet FortiWLC 6.1-2-29 and earlier, 7.0-9-1, 7.0-10-0, 8.0-5-0, 8.1-2-0, and 8.2-4-0 allow administrators to obtain sensitive user credentials by reading the pam.log file...