GuangWei GuangWei Honda APPv2.1 has information leakage vulnerability

GuangWei GAC Honda APP is an APP that provides car owners with remote control of their cars, one-click car inspection, GPS positioning, violation information query, fuel consumption analysis, convenient merchant interaction, quick query of car information and other functions. A vulnerability exis...

designer.diealbenmanufaktur.de XSS vulnerability

Open Bug Bounty ID: OBB-670717 Description| Value ---|--- Affected Website:| designer.diealbenmanufaktur.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-1000633

The vulnerability CVE-2018-1000633 affects Open Microscopy Environment OMERO.web prior to version 5.4.7. It exposes user passwords through log files created during login and password-change forms, enabling an attacker to read web server logs and potentially log in as the affected user. The issue ...

CVE-2016-6546 iTrack Easy mobile application stores the user password in base-64 encoding/cleartext

The iTrack Easy mobile application stores the account password used to authenticate to the cloud API in base64-encoding in the cache.db file. The base64 encoding format is considered equivalent to cleartext...

Cross site request forgery (csrf)

/upload/catalog/controller/account/password.php in OpenCart through 3.0.2.0 has CSRF via the index.php?route=account/password URI to change a user's password...

HP Enterprise VAN SDN Controller 2.7.18.0503 Remote Root

KL-001-2018-008 : HPE VAN SDN Unauthenticated Remote Root Vulnerability Title: HPE VAN SDN Unauthenticated Remote Root Vulnerability Advisory ID: KL-001-2018-008 Publication Date: 2018.06.25 Publication URL: https://korelogic.com/Resources/Advisories/KL-001-2018-008.txt 1. Vulnerability Details...

Design/Logic Flaw

The Olive Tree Ftp Server application 1.32 for Android has a "Sensitive Data on the Clipboard" vulnerability, as demonstrated by reading the "User password" field with the Drozer post.capture.clipboard module...

CVE-2018-12481

The Olive Tree Ftp Server application 1.32 for Android has a "Sensitive Data on the Clipboard" vulnerability, as demonstrated by reading the "User password" field with the Drozer post.capture.clipboard module...

CVE-2018-12481: Exposure of Sensitive Information to an Unauthorized Actor

The Olive Tree Ftp Server application 1.32 for Android has a "Sensitive Data on the Clipboard" vulnerability, as demonstrated by reading the "User password" field with the Drozer post.capture.clipboard module...

CVE-2018-11134

In order to perform actions that requires higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue managed that runs with root privileges and only allows a set of commands. One of the available commands allows changing any user's password including root. A...

CVE-2018-1148

In Nessus before 7.1.0, Session Fixation exists due to insufficient session management within the application. An authenticated attacker could maintain system access due to session fixation after a user password change...

CVE-2018-1148

In Nessus before 7.1.0, Session Fixation exists due to insufficient session management within the application. An authenticated attacker could maintain system access due to session fixation after a user password change...

Rooting a Logitech Harmony Hub: Improving Security in Today's IoT World

Introduction FireEye’s Mandiant Red Team recently discovered vulnerabilities present on the Logitech Harmony Hub Internet of Things IoT device that could potentially be exploited, resulting in root access to the device via SSH. The Harmony Hub is a home control system designed to connect to and...

CVE-2017-15518: Exposure of Sensitive Information to an Unauthorized Actor

All versions of OnCommand API Services prior to 2.1 and NetApp Service Level Manager prior to 1.0RC4 log a privileged database user account password. All users are urged to move to a fixed version. Since the affected password is changed during every upgrade/installation no further action is...

CVE-2018-5720

An issue was discovered on DODOCOOL DC38 3-in-1 N300 Mini Wireless Range Extend RTN2-AW.GD.R3465.1.20161103 devices. A Cross-site request forgery CSRF vulnerability allows remote attackers to hijack the authentication of users for requests that modify all the settings. This vulnerability can lead...

CVE-2018-1000018

An information disclosure in ovirt-hosted-engine-setup prior to 2.2.7 reveals the root user's password in the log file...

CVE-2018-1000018: Insertion of Sensitive Information into Log File

An information disclosure in ovirt-hosted-engine-setup prior to 2.2.7 reveals the root user's password in the log file...

Session fixation

Symantec Reporter 9.5 prior to 9.5.4.1 and 10.1 prior to 10.1.5.5 does not restrict excessive authentication attempts for management interface users. A remote attacker can use brute force search to guess a user password and gain access to Reporter...

CVE-2017-15531

Symantec Reporter 9.5 prior to 9.5.4.1 and 10.1 prior to 10.1.5.5 does not restrict excessive authentication attempts for management interface users. A remote attacker can use brute force search to guess a user password and gain access to Reporter...

Command injection

test/tcdatabase.rb in the lean-ruport gem 0.3.8 for Ruby places the mysql user password on the mysqldump command line, which allows local users to obtain sensitive information by listing the process...