CVE-2019-13100

The Send Anywhere application 9.4.18 for Android stores confidential information insecurely on the system i.e., in cleartext, which allows a non-root user to find out the username/password of a valid user via /data/data/com.estmob.android.sendanywhere/sharedprefs/sendanywheredevice.xml...

CVE-2019-13099

The Momo application 2.1.9 for Android stores confidential information insecurely on the system i.e., in cleartext, which allows a non-root user to find out the username/password of a valid user and a user's access token via Logcat...

CVE-2019-1575

Information disclosure in PAN-OS 7.1.23 and earlier, PAN-OS 8.0.18 and earlier, PAN-OS 8.1.8-h4 and earlier, and PAN-OS 9.0.2 and earlier may allow for an authenticated user with read-only privileges to extract the API key of the device and/or the username/password from the XML API in PAN-OS and...

CVE-2019-1575

CVE-2019-1575 is a PAN-OS information disclosure affecting PAN-OS 7.1.x before 7.1.24, 8.0.x before 8.0.19, 8.1.x before 8.1.8-h5, and 9.0.x before 9.0.2-h4. An authenticated user with read-only privileges could extract the device API key and/or username/password from the XML API, potentially ena...

CSRF vulnerability and missing permission checks in electricflow allowed SSRF

A missing permission check in a form validation method in electricflow allowed users with Overall/Read permission to initiate a connection test to an attacker-specified server with attacker-specified username and password. Additionally, the form validation method did not require POST requests,...

CVE-2019-11383

An issue was discovered in the Medha WiFi FTP Server application 1.8.3 for Android. An attacker can read the username/password of a valid user via /data/data/com.medhaapps.wififtpserver/sharedprefs/com.medhaapps.wififtpserverpreferences.xml...

Malwarebytes’ 2019 security predictions

Every year, we at Malwarebytes Labs like to stare into our crystal ball and foretell the future of malware. Okay, maybe we don't have a crystal ball, but we do have years and years of experience in observing trends and sensing shifts in patterns. When it comes to security, though, we can only kno...

PvPGN Stats ladder/stats.php file SQL injection vulnerability

PvPGN Stats is a PHP-based tool that supports the integration of websites with the PvPGN game server, displaying server status, ladder pages, and more. A SQL injection vulnerability exists in the ladder/stats.php file in PvPGN Stats version 2.4.6, which stems from the program failing to filter...

Design/Logic Flaw

If a long user name is used in a username/password combination in a site URL such as " http://UserName:email protected", the resulting modal prompt will hang in a non-responsive state or crash, causing a denial of service. This vulnerability affects Firefox 55...

CVE-2018-11544

The Olive Tree Ftp Server application 1.32 for Android has Insecure Data Storage because a username and password are stored in the /data/data/com.theolivetree.ftpserver/sharedprefs/com.theolivetree.ftpserverpreferences.xml file as the prefUsername and prefUserpass strings...

Auto Dealership & Vehicle Showroom WebSys 1.0 - XSS / CSRF / Authentication Bypass Vulnerabiliti

Exploit for php platform in category web applications Exploit Title: Auto Dealership & Vehicle Showroom WebSys 1.0 - Persistent Cross-Site Scripting / Cross-Site Request Forgery / Admin panel Authentication bypass Exploit Author: Borna nematzadeh L0RD or email protected Vendor Homepage:...

TBK DVR4104 DVR4216 - Credentials Leak

TBK DVR4104 DVR4216 - Credentials Leak -- coding: utf-8 -- import json import requests import argparse import tableprint as tp class Colors: BLUE = '\03394m' GREEN = '\03332m' RED = '\0330;31m' DEFAULT = '\0330m' ORANGE = '\03333m' WHITE = '\03397m' BOLD = '\0331m' BRCOLOUR = '\0331;37;40m' banne...

DLink DIR-601 - Admin Password Disclosure(CVE-2018-5708)

Description Having local access to the network but being unauthenticated to the administrator panel, a user can disclose the built in Admin username/password to access the admin panel 2. Proof of Concept For proof of concept, the real Admin password is "thisisatest" Step 1: Access default...

Dell EMC ScaleIO certification attempts to limit improper vulnerabilities

Dell EMC ScaleIO is a software-defined solution for converting DAS storage to shared data block storage from Dell, U.S.A. Light Installation Agent LIA is one of the installation agent programs. A security vulnerability exists in LIA in Dell EMC ScaleIO versions prior to 2.5, which stems from the...

How to suppress Citrix Receiver credentials prompt

This article describes how to suppress the Username\Password prompt in Citrix Receiver for Windows. Note : This article is applicable forReceiver for Windows 4.4.1000and later. Credential prompt as shown in the preceding screen shot will be displayed when a store has been configured at the Add...

Dodocool DC38 N300 - Cross-site Request Forgery Vulnerability

Exploit for php platform in category web applications Exploit Title: DODOCOOL DC38 N300 Cross-site Request Forgery Date: 17-01-2018 Exploit Authors: Raffaele Sabato Contact: https://twitter.com/syrion89 Vendor: DODOCOOL Vendor Homepage: www.dodocool.com Version: RTN2-AW.GD.R3465.1.20161103 CVE:...

Authentication flaw

Missing authentication for the remote configuration port 1236/tcp on the Cohu 3960HD allows an attacker to change configuration parameters such as IP address and username/password via specially crafted XML SOAP packets...

CVE-2017-8861

Missing authentication for the remote configuration port 1236/tcp on the Cohu 3960HD allows an attacker to change configuration parameters such as IP address and username/password via specially crafted XML SOAP packets...

Mozilla Firefox 55 - Denial of Service

Mozilla Firefox 55 - Denial of Service Exploit Title: Mozilla Firefox Firefox Lockout Vulnerability"; //Content to be forcibly viewed echo ""; //End echo "setTimeout"location.href ='".$location."';",10000;"; ? Solution: Update to version 55 https://www.mozilla.org/en-US/firefox/55.0/releasenotes/...

Mozilla Firefox < 55 - Denial of Service Exploit

Exploit for multiple platform in category dos / poc Exploit Title: Mozilla Firefox Firefox Lockout Vulnerability"; //Content to be forcibly viewed echo ""; //End echo "setTimeout"location.href ='".$location."';",10000;"; ? Solution: Update to version 55...