CVE-2017-1000092

Git Plugin connects to a user-specified Git repository as part of form validation. An attacker with no direct access to Jenkins but able to guess at a username/password credentials ID could trick a developer with job configuration permissions into following a link with a maliciously crafted Jenki...

jenkins-plugin-git: CSRF vulnerability allows capturing credentials (SECURITY-528)

The Git Plugin can leak credentials username and password used to access a git repo if an attacker-supplied URL is provided to the plugin. To supply the URL to the plugin, the attacker would need to guess a username/password ID and then trick a developer into following a specific URL...

CVE-2017-7783

If a long user name is used in a username/password combination in a site URL such as " http://UserName:[email protected]", the resulting modal prompt will hang in a non-responsive state or crash, causing a denial of service. This vulnerability affects Firefox 55...

U.S. Dept Of Defense: Multiple cryptographic vulnerabilities in login page on ███████

Summary: I realize that this report's title may not make sense yet. In one sentence: users logging in to the ███████ Server REST API Login page can have their passwords stolen by an attacker on the same LAN or WiFi as the victim trying to log in. Description: To save the reader any confusion, I'l...

CVE-2016-5762

Integer overflow in the Post Office Agent in Novell GroupWise before 2014 R2 Service Pack 1 Hot Patch 1 might allow remote attackers to execute arbitrary code via a long 1 username or 2 password, which triggers a heap-based buffer overflow...

Citrix Receiver: Difference of Logon Experience When Logon StoreFront with a Locked Account by Using Username/password and Smart Card

This article is intended for Citrix administrators and technical teams only.Non-admin users must contact their company’s Help Desk/IT support team and can refer toCTX297149for more information This article describes user experience of using Pass-throughwith username and password or smart card log...

CVE-2017-6351

The WePresent WiPG-1500 device with firmware 1.0.3.7 has a manufacturer account that has a hardcoded username / password. Once the device is set to DEBUG mode, an attacker can connect to the device using the telnet protocol and log into the device with the 'abarco' hardcoded manufacturer account...

Invalid password "nsgslbautosync: unable to establish master SSH connection: master process exited"

After changing the RPC passwords on our Netscalers, GSLB synchronization fails. Reverting to the default passwords allows GSLB sync to function. A non-default password is desired. Errors in the ns.log: "nsgslbautosync: Error executing command on gslb site...Reason: Error: Invalid username or...

NETWAVE IP Camera Password Disclosure Vulnerability

NETWAVE IP Camera is a webcam product. NETWAVE IP Camera suffers from a password disclosure vulnerability, which allows an attacker to obtain the username and password of the device via POC code, resulting in a password disclosure risk...

CVE-2016-6606

An issue was discovered in cookie encryption in phpMyAdmin. The decryption of the username/password is vulnerable to a padding oracle attack. This can allow an attacker who has access to a user's browser cookie file to decrypt the username and password. Furthermore, the same initialization vector...

Exagate WEBPack Management System SQL Injection Vulnerability

WEBPack Management System is a WEB-based hardware control software used by Exagate. An SQL injection vulnerability exists in the username and password parameters of the login.php page of the WEBPack Management System, which can be used by an attacker to compromise the application, access or modif...

Design by ARRR Design - SQL Injection

Design by ARRR Design - SQL Injection. Webapps exploit for PHP platform Exploit Title: Design by ARRR Design Get Username & Password Exploit Author: ./MalingSendal - Trenggalek Cyber Army Dork : intext:"Design by ARRR Design" Vendor Homepage: http://arrrdesign.web.id/ Date : 2016/10/07 Tested on ...

FreeBSD : asterisk -- RTP Resource Exhaustion (5cb18881-7604-11e6-b362-001999f8d30b)

The Asterisk project reports : The overlap dialing feature in chansip allows chansip to report to a device that the number that has been dialed is incomplete and more digits are required. If this functionality is used with a device that has performed username/password authentication RTP resources...

JVC IP Camera VN-T216VPRU - Credentials Disclosure

Exploit for cgi platform in category web applications 1. Advisory Information ======================================== Title : JVC IP-Camera VN-T216VPRU Remote Credentials Disclosure Vendor Homepage : http://pro.jvc.com/ Remotely Exploitable : Yes Tested on Camera types : VN-T216VPRU Product...

asterisk -- RTP Resource Exhaustion

The Asterisk project reports: The overlap dialing feature in chansip allows chansip to report to a device that the number that has been dialed is incomplete and more digits are required. If this functionality is used with a device that has performed username/password authentication RTP resources...

Bellini/Supercook Wi-Fi Yumi SC200 Information Disclosure / Code Execution

Bellini/Supercook Wi-Fi Yumi SC200 - Multiple vulnerabilities Reported By: ================================== James McLean - Primary: james dot mclean at gmail dot com Secondary: labs at juicedigital dot net Device Overview: ================================== From...

Bellini / Supercook Wi-Fi Yumi SC200 - Multiple Vulnerabilities

Exploit for hardware platform in category web applications ''' Bellini/Supercook Wi-Fi Yumi SC200 - Multiple vulnerabilities Reported By: ================================== James McLean - Primary: james dot mclean at gmail dot com Secondary: labs at juicedigital dot net Device Overview:...

SUSE-SU-2015:2385-1 Security update for grub2

This update for grub2 provides the following fixes: A security issues with a bufferoverflow when reading username and password was fixed bsc956631, CVE-2015-8370 Also following bugs were fixed: - Fix buffer overflows when reading username and password. bsc956631, CVE-2015-8370 - Expand list of...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in PHPJabbers Event Booking Calendar 2.0 allow remote attackers to hijack the authentication of administrators for requests that 1 change the username and password of the administrator via an update action to the AdminOptions controller or...

Xerox Workcentre 5735 LDAP Service Redential Extractor

This module extract the printer's LDAP username and password from Xerox Workcentre 5735. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Xerox Workcentre 5735 LDAP Service Redential Extractor',...