SUSE SLES10 Security Update : strongswan (SUSE-SU-2015:1228-1)

strongswan was updated to fix two security issues : An issue that could enable rogue servers to gain user credentials from a client in certain IKEv2 setups. CVE-2015-4171 A bug in decoding IDDERASN1DN ID payloads that could be used for remote denial of service attacks. CVE-2014-2891 Note that...

PT-2017-01: Information Disclosure in Rockwell Automation Micrologix 1100 and 1400 PLC

The specialists of the Positive Research center have detected an Information Disclosure vulnerability in Rockwell Automation Micrologix 1100 and 1400 PLC. Vulnerability in Allen-Bradly MicroLogix 1100 and 1400 allows remote attackers to obtain user credentials in clear text by sniffing...

Ubuntu: Security Advisory (USN-2628-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Design/Logic Flaw

Thermostat before 2.0.0 uses world-readable permissions for the web.xml configuration file, which allows local users to obtain user credentials by reading the file...

CVE-2015-3201

Thermostat before 2.0.0 uses world-readable permissions for the web.xml configuration file, which allows local users to obtain user credentials by reading the file...

CVE-2015-3201

Thermostat web application stores database credentials in a world-readable configuration file (web.xml), enabling a local user to read credentials and potentially access/modify monitored JVM data or control connected JVMs. Red Hat RHSA-2015:1052 and Fedora advisories/ Nessus entries document the ...

strongswan -- Information Leak Vulnerability

strongSwan Project reports: An information leak vulnerability was fixed that, in certain IKEv2 setups, allowed rogue servers with a valid certificate accepted by the client to trick it into disclosing user credentials even plain passwords if the client accepts EAP-GTC. This was caused because...

ESA-2015-044: EMC Documentum xMS Sensitive Information Disclosure Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2015-044: EMC Documentum xMS Sensitive Information Disclosure Vulnerability EMC Identifier: ESA-2015-044 CVE Identifier: CVE-2015-0527 Severity Rating: CVSS v2 Base Score: 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C Affected products: • EMC Documentum xCelerat...

[SYSS-2014-007] FrontRange DSM - Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2014-007 Product: FrontRange DSM Vendor: FrontRange Solutions USA Inc. and/or its affiliates Affected Versions: v7.2.1.2020, v7.2.2.2331 Tested Versions: v7.2.1.2020, v7.2.2.2331 Vulnerability Type: Use of Hard-coded Cryptographic...

科讯网校系统xss漏洞(密码为MD5加密)

简要描述： 大CMS厂商。。 http://www.kesion.com/ 已有 469,628 个网站选择KESION产品搭建，今日新增网站 104 个 拿了好多证书。 详细说明： 首先在他们网站 http://e.kesion.com/model/view.aspx?mid=3&id=4373 我目测只要有回复框就百分百存在这漏洞 而且全站判断的方式一样 为什么这样说呢 往下面看就知道了 http://e.kesion.com/model/view.aspx?mid=3&id=4373 2014年司法考试历年真题课件-民法 OK...

Http debug commands in FortiMail exposes users credentials to admins

...

WellinTech KingView < 6.53 (2012-10-09) User Credentials Not Securely Hashed

Binary data scadakingview6532012-10-09.nbin...

CVE-2015-0999

Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 store cleartext OPC User credentials in a configuration file, which allows local users to obtain sensitive information by reading this file...

Design/Logic Flaw

Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 store cleartext OPC User credentials in a configuration file, which allows local users to obtain sensitive information by reading this file...

CVE-2015-0999

Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 store cleartext OPC User credentials in a configuration file, which allows local users to obtain sensitive information by reading this file...

PT-2015-5017

Name of the Vulnerable Software and Affected Versions Schneider Electric InduSoft Web Studio versions prior to 7.1.3.4 SP3 Patch 4 Schneider Electric InTouch Machine Edition 2014 versions prior to 7.1.3.4 SP3 Patch 4 Description The issue allows local users to obtain sensitive information by...

CVE-2015-0999: Exposure of Sensitive Information to an Unauthorized Actor

Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 store cleartext OPC User credentials in a configuration file, which allows local users to obtain sensitive information by reading this file...

Loxone Smart Home Miniserver < 6.3 Multiple Vulnerabilities

According to its banner, the remote Loxone Smart Home Miniserver device is a version prior to 6.3. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists due to the device transmitting all data in cleartext. A remote man-in-the-middle attacker ca...

Password retrieve logic vulnerability summary-vulnerability warning-the black bar safety net

0x00 background description Please note these two articles: Password retrieve function there may be a problem Password retrieve function there may be issues supplemented From the above two documents the past six months, recently finishing a password to get back to the mind map, open the collectio...

Multi Gather RubyGems API Key

This module obtains a user's RubyGems API key from /.gem/credentials. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Multi Gather RubyGems API Key', 'Description' = %q This module obtains a...