CVE-2018-16223

Insecure Cryptographic Storage of credentials in com.vestiacom.qbeecamerapreferences.xml in the QBee Cam application through 1.0.5 for Android allows an attacker to retrieve the username and password...

Default credentials

Insecure Cryptographic Storage of credentials in com.vestiacom.qbeecamerapreferences.xml in the QBee Cam application through 1.0.5 for Android allows an attacker to retrieve the username and password...

CVE-2018-16222

Cleartext Storage of credentials in the iSmartAlarmData.xml configuration file in the iSmartAlarm application through 2.0.8 for Android allows an attacker to retrieve the username and password...

CVE-2018-19318

SRCMS 3.0.0 allows CSRF via admin.php?m=Admin&c=manager&a=update to change the username and password of the super administrator account...

SUSE-SU-2018:3781-1 Security update for openssh

This update for openssh fixes the following issues: Following security issues have been fixed: - CVE-2018-15919: Remotely observable behaviour in auth-gss2.c in OpenSSH could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. OpenSSH developers do not...

SUSE-SU-2018:3776-1 Security update for openssh

This update for openssh fixes the following issues: Following security issues have been fixed: - CVE-2018-15919: Remotely observable behaviour in auth-gss2.c in OpenSSH could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. OpenSSH developers do not...

CVE-2018-19301

tp4a TELEPORT 3.1.0 allows XSS via the login page because a crafted username is mishandled when an administrator later views the system log...

CVE-2018-19286

The server in mubu note 2018-11-11 has XSS by configuring an account with a crafted name value along with an arbitrary username value, and then creating and sharing a note...

Simple E-Document 1.31 - 'username' SQL Injection

Exploit Title: Simple E-Document 1.31 - 'username' SQL Injection Dork: N/A Date: 2018-11-14 Exploit Author: Ihsan Sencan Vendor Homepage: http://www.tecorange.com/index.php/download-free-open-source-software/79-simple-e-document-free-open-source-document-and-paper-m Software Link:...

Simple E-Document 1.31 - username SQL Injection

Simple E-Document 1.31 - username SQL Injection Exploit Title: Simple E-Document 1.31 - 'username' SQL Injection Dork: N/A Date: 2018-11-14 Exploit Author: Ihsan Sencan Vendor Homepage:...

BitZoom 1.0 - 'rollno' SQL Injection

Exploit Title: BitZoom 1.0 - 'rollno' SQL Injection Dork: N/A Date: 2018-11-14 Exploit Author: Ihsan Sencan Vendor Homepage: https://bitzoom.sourceforge.io/ Software Link: https://excellmedia.dl.sourceforge.net/project/bitzoom/bitzoom-master.zip Version: 1.0 Category: Webapps Tested on:...

SUSE-SU-2018:3768-1 Security update for openssh-openssl1

This update for openssh-openssl1 fixes the following issues: Security issues fixed: - CVE-2018-15919: Remotely observable behaviour in auth-gss2.c in OpenSSH could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. OpenSSH developers do not want to...

curl: Out-of-bounds write via unchecked multiplication

The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if it receives at least 1Gb as input via CURLOPTUSERNAME...

GPS Tracking System 2.12 - username SQL Injection

GPS Tracking System 2.12 - username SQL Injection Exploit Title: GPS Tracking System 2.12 - 'username' SQL Injection Dork: N/A Date: 2018-11-10 Exploit Author: Ihsan Sencan Vendor Homepage: https://sourceforge.net/projects/gpstracking/ Software Link:...

Data Center Audit 2.6.2 SQL Injection

Exploit Title: Data Center Audit 2.6.2 - 'username' SQL Injection Dork: N/A Date: 2018-11-09 Exploit Author: Ihsan Sencan Vendor Homepage: https://sourceforge.net/projects/datacenteraudit/ Software Link: https://netix.dl.sourceforge.net/project/datacenteraudit/datacenterauditv262.zip Version: 2.6...

Nominas 0.27 - 'username' SQL Injection

Exploit Title: Nominas 0.27 - 'username' SQL Injection Dork: N/A Date: 2018-11-09 Exploit Author: Ihsan Sencan Vendor Homepage: http://arixolab.com/proyecto.html Software Link: https://netix.dl.sourceforge.net/project/nominascrm/Nominas%20v0.27.tar.gz Version: 0.27 Category: Webapps Tested on:...

CVE-2018-19091

tianti 2.3 has reflected XSS in the user management module via the tianti-module-admin/user/list userName parameter...

Cross site scripting

tianti 2.3 has reflected XSS in the user management module via the tianti-module-admin/user/list userName parameter...

CVE-2018-19091

tianti 2.3 has reflected XSS in the user management module via the tianti-module-admin/user/list userName parameter...

CVE-2018-19078

The CVE-2018-19078 entry concerns Foscam Opticam i5 devices (System Firmware 1.5.2.11, Application Firmware 2.21.1.128). The issue is an information disclosure: the ONVIF media GetStreamUri response contains the administrator username and password. This is documented in CNVD-2018-22818 and echoed...